A company has a large number of Azure VMs that must meet specific compliance requirements, including certain file contents and registry values. The compliance team wants to audit these settings continuously and receive a report of non-compliant VMs. The team also wants to remediate non-compliant VMs automatically. The team prefers to use Azure Policy and wants to avoid managing custom DSC configurations. Which approach should the team take?

Create custom Azure Policy definitions using Azure Machine Configuration (guest configuration) with audit and remediation effects.

Use Azure Security Center's regulatory compliance dashboard with built-in recommendations.

Use Azure Automation State Configuration with a custom DSC configuration for each compliance requirement.

Use Azure Monitor with a custom log query to check for the required settings and trigger an alert.

A company is implementing a configuration management strategy for its Azure infrastructure. They want to use a single source of truth for both infrastructure provisioning and configuration management. The team wants to store all definitions in Git and use Azure DevOps for deployment. Which approach should they use?

Use Bicep for provisioning and Azure Automation State Configuration for configuration management, both stored in Git.

Use Azure PowerShell scripts for both provisioning and configuration.

Use Azure Policy for both provisioning and configuration.

Use Terraform for both provisioning and configuration management.

A team is designing desired state configurations for their Azure VMs. They want to ensure that the configuration is automatically applied to new VMs as soon as they are deployed. Which approach should they use?

Embed the DSC configuration in the ARM template as an extension

Register the VMs with Azure Automation State Configuration and assign the desired configuration

Manually run the DSC configuration on each VM after deployment

Create a custom script that runs on VM startup

A team is defining an infrastructure as code (IaC) strategy. They want to ensure that infrastructure changes are reviewed and tested before being applied to production. Which practice should be included in the strategy?

Apply IaC templates directly to production from a local machine

Store IaC templates in a version-controlled repository and use pull requests for changes

Use a shared network drive to store IaC templates

Email IaC templates to team members for manual review

Microsoft Certified:DevOps Engineer Expert

Domain 3Objective 5

Design and Implement Infrastructure as Code (IaC) AZ-400 Practice Questions (Page 8)

Part of the Design and implement build and release pipelines domain, which makes up ~41% of our current practice bank. Microsoft does not publish an official question count, but from its 140-minute exam (~55–95 total, ~23–39 in this domain), expect 4–7 from this objective — we provide 43 practice questions to prepare you well beyond it. (estimate)

43questions here

9free pages

9concepts

9 Concepts in This Objective

Configuration Management Technologies
Configuration Management Strategy
IaC Strategy Definition
Desired State Configuration Design
Azure Automation State Configuration
Azure Resource Manager and Bicep
Azure Machine Configuration
Azure Deployment Environments Design
Azure Deployment Environments Implementation

Questions 36–40

36expert · hard
A company has a large number of Azure VMs that must meet specific compliance requirements, including certain file contents and registry values. The compliance team wants to audit these settings continuously and receive a report of non-compliant VMs. The team also wants to remediate non-compliant VMs automatically. The team prefers to use Azure Policy and wants to avoid managing custom DSC configurations. Which approach should the team take?
Select an answer first
37application · medium
A company is implementing a configuration management strategy for its Azure infrastructure. They want to use a single source of truth for both infrastructure provisioning and configuration management. The team wants to store all definitions in Git and use Azure DevOps for deployment. Which approach should they use?
Select an answer first
38application · medium
A development team is new to infrastructure as code and wants to define Azure resources using a declarative syntax that is concise and supports modularization. They plan to store the definitions in Git and deploy them through Azure DevOps. The team also wants to validate the syntax locally before committing. Which tool should the team use?
Select an answer first
39foundation · easy
A team is designing desired state configurations for their Azure VMs. They want to ensure that the configuration is automatically applied to new VMs as soon as they are deployed. Which approach should they use?
Select an answer first
40foundation · easy
A team is defining an infrastructure as code (IaC) strategy. They want to ensure that infrastructure changes are reviewed and tested before being applied to production. Which practice should be included in the strategy?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to AZ-400

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “AZ-400” is a trademark of its owner, used for identification only.

Design and Implement Infrastructure as Code (IaC) AZ-400 Practice Questions (Page 8)

Questions 36–40

A team is designing desired state configurations for their Azure VMs. They want to ensure that the configuration is automatically applied to new VMs as soon as they are deployed. Which approach should they use?

A team is defining an infrastructure as code (IaC) strategy. They want to ensure that infrastructure changes are reviewed and tested before being applied to production. Which practice should be included in the strategy?

Keep studying — Design and implement build and release pipelines