Design and Implement Infrastructure as Code (IaC) AZ-400 Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A company needs to ensure that all Azure VMs have a specific file present and that a particular service is running. The compliance team wants to see a report of which VMs are compliant and which are not, and they want to remediate non-compliant VMs automatically. The team prefers to use Azure Policy. Which approach should the team take?

   • ACreate a custom Azure Policy initiative using Azure Machine Configuration (guest configuration) with audit and remediation effects.
   • BUse Azure Automation State Configuration with a DSC configuration and assign it to all VMs.
   • CUse Azure Security Center's recommendations to identify VMs that do not have the file or service.
   • DUse Azure Monitor with a custom log query to check for the file and service and trigger an alert.
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A company wants to provide self-service environments for developers, but the security team requires that all environments be isolated from each other and from production. The environments must be automatically deleted after 72 hours. The company also wants to enforce that only approved templates are used and that developers cannot modify the environment definitions. Which solution should the company implement?

   • AA shared Azure subscription with a pipeline that developers trigger manually and a cleanup task that runs after 72 hours.
   • BAzure Resource Manager templates stored in a repository with a script that developers run locally to deploy and delete environments.
   • CAzure DevTest Labs with a custom formula and an auto-shutdown policy that deletes VMs after 72 hours.
   • DAzure Deployment Environments with a catalog of approved environment definitions, a lifecycle policy for 72-hour deletion, and RBAC that grants developers only the 'Deployer' role.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A team is migrating from ARM templates to Bicep. They have a large set of existing ARM templates that are used in production. The team wants to reuse the existing templates without rewriting them and wants to incrementally adopt Bicep for new resources. Which approach should the team take?

   • AUse a hybrid approach where ARM templates are deployed first and Bicep files are deployed second, with no cross-references.
   • BWrap the ARM templates in a Bicep module using the 'loadTextContent' function to embed the JSON.
   • CKeep the existing ARM templates as-is and author new Bicep files that use the 'existing' keyword to reference resources defined in the ARM templates.
   • DConvert all ARM templates to Bicep using the decompile command and then delete the original ARM templates.
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A company has a mix of Azure VMs and on-premises servers running Windows and Linux. The team wants a configuration management strategy that supports both operating systems, provides central reporting, and can remediate drift automatically. The on-premises servers can reach Azure over the internet. The team is already using Azure Automation. Which strategy should the team adopt?

   • AUse a custom PowerShell script that runs on a schedule to apply configurations to all servers.
   • BUse Azure Policy with guest configuration for Azure VMs and a separate tool for on-premises servers.
   • CUse Azure Automation State Configuration for both Windows and Linux servers, registering all servers as DSC nodes.
   • DUse Ansible with playbooks stored in Git and executed via Azure Pipelines for all servers.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A team is using Bicep to deploy Azure resources. They have a module that creates a storage account and a module that creates a function app. The function app needs to reference the storage account's connection string. The team wants to pass this value between modules without hardcoding it. Which approach should the team use?

   • AUse the 'resource' keyword in the function app module to redeclare the storage account and access its properties.
   • BUse a parameter in the function app module and pass the connection string as a parameter value during deployment.
   • CUse the 'existing' keyword in the function app module to reference the storage account and retrieve its connection string.
   • DUse the 'output' keyword in the storage account module to return the connection string and reference it in the function app module.
   Reveal Solution Discussion Select an answer first