AZ-400 Infrastructure as Code 5 — Questions and Answers
Question 1: Which Terraform feature allows you to define reusable infrastructure components with input variables and output values?
- Terraform workspaces
- Terraform modules (Correct answer)
- Terraform data sources
- Terraform providers
Correct answer: Terraform modules
Terraform modules are self-contained packages of Terraform configuration with defined inputs (variables) and outputs, enabling reuse across projects.
Question 2: In Azure DevOps, what is the recommended way to store Terraform state files to support team collaboration and state locking?
- Commit the .tfstate file directly to the Git repository
- Store in Azure Blob Storage with state locking via Azure Storage lease mechanism (Correct answer)
- Use a local backend on a shared network drive accessible to all team members
- Store in Azure Key Vault as a secret
Correct answer: Store in Azure Blob Storage with state locking via Azure Storage lease mechanism
Azure Blob Storage with the `azurerm` backend provides remote state storage and uses Azure Storage blob leases to implement state locking, preventing concurrent modifications.
Question 3: What is the function of `@allowed` decorator in Azure Bicep?
- Restricts which Azure regions the template can be deployed to
- Defines the set of permissible values for a parameter (Correct answer)
- Marks a parameter as allowed to be empty or null
- Specifies which resource types are allowed in the deployment
Correct answer: Defines the set of permissible values for a parameter
The `@allowed` decorator constrains a parameter to only accept values from a specified list, causing deployment validation to fail if an unlisted value is provided.
Question 4: When implementing IaC in a CI/CD pipeline, what is the purpose of separating `terraform plan` and `terraform apply` into different pipeline stages?
- It allows Terraform to cache the provider plugins between stages
- It enables human review and approval of the planned changes before infrastructure is modified (Correct answer)
- It reduces the total time for Terraform operations by parallelizing work
- It prevents Terraform from needing write access to the state file during planning
Correct answer: It enables human review and approval of the planned changes before infrastructure is modified
Separating plan from apply allows teams to review exactly what infrastructure changes will occur and require approval gates before any modifications are made to production.
Question 5: Which Azure CLI command deploys a Bicep file to a specific resource group?
- az bicep deploy --file main.bicep --resource-group myRG
- az deployment group create --resource-group myRG --template-file main.bicep (Correct answer)
- az arm deploy --bicep main.bicep --group myRG
- az group deploy create --template main.bicep --name myRG
Correct answer: az deployment group create --resource-group myRG --template-file main.bicep
`az deployment group create` with `--template-file` accepts both `.json` ARM templates and `.bicep` files for resource group-scoped deployments.
Question 6: In Terraform, what does the `ignore_changes` lifecycle argument do when specified for a resource attribute?
- Prevents Terraform from ever modifying that attribute after initial creation (Correct answer)
- Causes Terraform to skip reading that attribute during refresh
- Removes the attribute from the state file entirely
- Forces the attribute to be set to its default value on every apply
Correct answer: Prevents Terraform from ever modifying that attribute after initial creation
`ignore_changes` tells Terraform to ignore drift on specified attributes after initial creation, so external changes to those attributes won't be overwritten on the next apply.
Question 7: What is the primary purpose of Azure Blueprints in an enterprise IaC strategy?
- Replacing ARM templates with a newer JSON format
- Packaging role assignments, policies, resource groups, and ARM templates for repeatable environment governance (Correct answer)
- Providing a visual drag-and-drop interface for designing Azure architectures
- Automatically converting Terraform configurations to ARM templates
Correct answer: Packaging role assignments, policies, resource groups, and ARM templates for repeatable environment governance
Azure Blueprints bundle together policy assignments, RBAC role assignments, resource groups, and ARM templates into a single versioned artifact for consistent environment provisioning.
AZ-400 Infrastructure as Code 5
Which Terraform feature allows you to define reusable infrastructure components with input variables and output values?