100% Latest & Updated Microsoft AZ-400 Practice Test Questions, Exam Dumps & Verified Answers!
30 Days Free Updates, Instant Download!
Question 660
A Bicep template hardcodes production resource names, so deploying staging overwrites a shared environment. Choose TWO measures that implement and verify an effective Azure DevOps response to this specific situation. (Choose TWO.)
- Dismiss the known risk for bicep reusable modules with environment-specific parameters and keep no evidence or accountable owner after deployment.
- Bypass review and testing for bicep reusable modules with environment-specific parameters whenever the release deadline is urgent, applying the change to production immediately.
- Define reusable Bicep modules with parameter files and explicit resource scopes and dependencies.
- Declare bicep reusable modules with environment-specific parameters successful solely from a green pipeline status and skip checking its actual control outcome.
- Run deployment what-if and deploy to an isolated subscription to confirm idempotence and environment boundaries.
Explanation
Correct Answers
C:Define reusable Bicep modules with parameter files and explicit resource scopes and dependencies. Declarative IaC must define intended state, scope, and dependencies rather than rely on mutable manual steps. Template duplication and hardcoded scopes can introduce policy drift or unintended resource replacement.
E:Run deployment what-if and deploy to an isolated subscription to confirm idempotence and environment boundaries. Declarative IaC must define intended state, scope, and dependencies rather than rely on mutable manual steps.
Incorrect Answers
A:Dismiss the known risk for bicep reusable modules with environment-specific parameters and keep no evidence or accountable owner after deployment. It conflicts with the stated operating condition: Declarative IaC must define intended state, scope, and dependencies rather than rely on mutable manual steps.
B:Bypass review and testing for bicep reusable modules with environment-specific parameters whenever the release deadline is urgent, applying the change to production immediately. It conflicts with the stated operating condition: Declarative IaC must define intended state, scope, and dependencies rather than rely on mutable manual steps.
D:Declare bicep reusable modules with environment-specific parameters successful solely from a green pipeline status and skip checking its actual control outcome. It conflicts with the stated operating condition: Declarative IaC must define intended state, scope, and dependencies rather than rely on mutable manual steps.
Question 661
Two engineers apply changes simultaneously to the same Azure Terraform state and overwrite each other's resource updates. Which implementation BEST addresses the operational issue?
- Use Azure Resource Manager or Bicep what-if and scope-aware approvals to review intended resource changes.
- Apply supported Azure Machine Configuration or desired-state controls with compliance monitoring and remediation procedures.
- Use a protected remote state backend with locking, environment separation, and approval of plans before apply.
- Pin reusable IaC module versions and review changes using integration plans for all important consumers.
Explanation
Correct Answer
C:Use a protected remote state backend with locking, environment separation, and approval of plans before apply. Terraform state represents actual managed resources and needs concurrency and confidentiality controls. State corruption can trigger destructive infrastructure changes or leak sensitive attributes.
Incorrect Answers
A:Use Azure Resource Manager or Bicep what-if and scope-aware approvals to review intended resource changes. That applies to arm template what-if detecting unintended replacements, not terraform state lock and controlled backend for azure.
B:Apply supported Azure Machine Configuration or desired-state controls with compliance monitoring and remediation procedures.
D:Pin reusable IaC module versions and review changes using integration plans for all important consumers. That applies to versioned infrastructure modules and breaking upgrade control, not terraform state lock and controlled backend for azure.
Question 662
Two engineers apply changes simultaneously to the same Azure Terraform state and overwrite each other's resource updates. How should the team validate the intended result?
- Provision and retire a test environment as a low-privilege user and inspect applied governance controls.
- Try compliant and prohibited IaC deployments in test subscriptions and validate policy evaluation and exemption handling.
- Introduce benign drift on a test VM and confirm reported compliance and authorized correction.
- Attempt concurrent test operations and verify one waits for the lock while state history remains recoverable.
Explanation
Correct Answer
D:Attempt concurrent test operations and verify one waits for the lock while state history remains recoverable. Terraform state represents actual managed resources and needs concurrency and confidentiality controls.
Incorrect Answers
A:Provision and retire a test environment as a low-privilege user and inspect applied governance controls.
B:Try compliant and prohibited IaC deployments in test subscriptions and validate policy evaluation and exemption handling.
C:Introduce benign drift on a test VM and confirm reported compliance and authorized correction. That applies to azure machine configuration desired state assurance, not terraform state lock and controlled backend for azure.
Question 663
Two engineers apply changes simultaneously to the same Azure Terraform state and overwrite each other's resource updates. Which design distinction is MOST relevant in these conditions?
- Terraform state represents actual managed resources and needs concurrency and confidentiality controls.
- Policy-as-code constrains resource creation and must align to its actual assignment and exemption scopes.
- Declarative IaC must define intended state, scope, and dependencies rather than rely on mutable manual steps.
- Declarative infrastructure deployment can be syntactically valid while proposing harmful state transitions.
Explanation
Correct Answer
A:Terraform state represents actual managed resources and needs concurrency and confidentiality controls. State corruption can trigger destructive infrastructure changes or leak sensitive attributes.
Incorrect Answers
B:Policy-as-code constrains resource creation and must align to its actual assignment and exemption scopes.
C:Declarative IaC must define intended state, scope, and dependencies rather than rely on mutable manual steps.
D:Declarative infrastructure deployment can be syntactically valid while proposing harmful state transitions. That applies to arm template what-if detecting unintended replacements, not controlling principle for terraform state lock and controlled backend for azure.
Question 664
Two engineers apply changes simultaneously to the same Azure Terraform state and overwrite each other's resource updates. Which ongoing guardrail would BEST prevent this problem from recurring?
- Publish module change notes and stage breaking updates with controlled dependent migrations.
- Version environment definitions and routinely clean up expired resources and exceptional permissions.
- Review policy versions and exemption expiry after organizational hierarchy or compliance changes.
- Monitor state backend access and support recovery procedures after interrupted plans.
Explanation
Correct Answer
D:Monitor state backend access and support recovery procedures after interrupted plans. State corruption can trigger destructive infrastructure changes or leak sensitive attributes.
Incorrect Answers
A:Publish module change notes and stage breaking updates with controlled dependent migrations. This helps sustain a control for versioned infrastructure modules and breaking upgrade control; it does not directly stop recurrence of terraform state lock and controlled backend for azure described in this case.
B:Version environment definitions and routinely clean up expired resources and exceptional permissions. This helps sustain a control for azure deployment environments for governed self-service; it does not directly stop recurrence of terraform state lock and controlled backend for azure described in this case.
C:Review policy versions and exemption expiry after organizational hierarchy or compliance changes.
Question 665
Two engineers apply changes simultaneously to the same Azure Terraform state and overwrite each other's resource updates. Which risk is directly created by the described failure?
- State corruption can trigger destructive infrastructure changes or leak sensitive attributes.
- Template duplication and hardcoded scopes can introduce policy drift or unintended resource replacement.
- Configuration drift can disable monitoring or create inconsistent vulnerability exposure across servers.
- Unreviewed IaC effects can interrupt services or delete data despite a green pipeline parse.
Explanation
Correct Answer
A:State corruption can trigger destructive infrastructure changes or leak sensitive attributes. This is the directly relevant business or security consequence of terraform state lock and controlled backend for azure. Root cause: Terraform state represents actual managed resources and needs concurrency and confidentiality controls.
Incorrect Answers
B:Template duplication and hardcoded scopes can introduce policy drift or unintended resource replacement. That risk is relevant to bicep reusable modules with environment-specific parameters, but the specific unresolved condition here concerns terraform state lock and controlled backend for azure and has a different direct consequence.
C:Configuration drift can disable monitoring or create inconsistent vulnerability exposure across servers. That risk is relevant to azure machine configuration desired state assurance, but the specific unresolved condition here concerns terraform state lock and controlled backend for azure and has a different direct consequence.
D:Unreviewed IaC effects can interrupt services or delete data despite a green pipeline parse. That risk is relevant to arm template what-if detecting unintended replacements, but the specific unresolved condition here concerns terraform state lock and controlled backend for azure and has a different direct consequence.
Question 666
A production state file is stored locally on a developer laptop without backup or access control. Which solution should be prioritized to resolve the stated failure?
- Pin reusable IaC module versions and review changes using integration plans for all important consumers.
- Apply supported Azure Machine Configuration or desired-state controls with compliance monitoring and remediation procedures.
- Use a protected remote state backend with locking, environment separation, and approval of plans before apply.
- Use Azure Resource Manager or Bicep what-if and scope-aware approvals to review intended resource changes.
Explanation
Correct Answer
C:Use a protected remote state backend with locking, environment separation, and approval of plans before apply. Terraform state represents actual managed resources and needs concurrency and confidentiality controls. State corruption can trigger destructive infrastructure changes or leak sensitive attributes.
Incorrect Answers
A:Pin reusable IaC module versions and review changes using integration plans for all important consumers. That applies to versioned infrastructure modules and breaking upgrade control, not terraform state lock and controlled backend for azure.
B:Apply supported Azure Machine Configuration or desired-state controls with compliance monitoring and remediation procedures.
D:Use Azure Resource Manager or Bicep what-if and scope-aware approvals to review intended resource changes. That applies to arm template what-if detecting unintended replacements, not terraform state lock and controlled backend for azure.
Question 667
A production state file is stored locally on a developer laptop without backup or access control. Which evidence would BEST demonstrate that the fix operates as intended?
- Try compliant and prohibited IaC deployments in test subscriptions and validate policy evaluation and exemption handling.
- Attempt concurrent test operations and verify one waits for the lock while state history remains recoverable.
- Provision and retire a test environment as a low-privilege user and inspect applied governance controls.
- Introduce benign drift on a test VM and confirm reported compliance and authorized correction.
Explanation
Correct Answer
B:Attempt concurrent test operations and verify one waits for the lock while state history remains recoverable. Terraform state represents actual managed resources and needs concurrency and confidentiality controls.
Incorrect Answers
A:Try compliant and prohibited IaC deployments in test subscriptions and validate policy evaluation and exemption handling.
C:Provision and retire a test environment as a low-privilege user and inspect applied governance controls.
D:Introduce benign drift on a test VM and confirm reported compliance and authorized correction. That applies to azure machine configuration desired state assurance, not terraform state lock and controlled backend for azure.
Question 668
A production state file is stored locally on a developer laptop without backup or access control. Which design distinction is MOST relevant in these conditions?
- Declarative IaC must define intended state, scope, and dependencies rather than rely on mutable manual steps.
- Policy-as-code constrains resource creation and must align to its actual assignment and exemption scopes.
- Terraform state represents actual managed resources and needs concurrency and confidentiality controls.
- Declarative infrastructure deployment can be syntactically valid while proposing harmful state transitions.
Explanation
Correct Answer
C:Terraform state represents actual managed resources and needs concurrency and confidentiality controls. State corruption can trigger destructive infrastructure changes or leak sensitive attributes.
Incorrect Answers
A:Declarative IaC must define intended state, scope, and dependencies rather than rely on mutable manual steps.
B:Policy-as-code constrains resource creation and must align to its actual assignment and exemption scopes.
D:Declarative infrastructure deployment can be syntactically valid while proposing harmful state transitions. That applies to arm template what-if detecting unintended replacements, not controlling principle for terraform state lock and controlled backend for azure.
Question 669
A production state file is stored locally on a developer laptop without backup or access control. Which ongoing guardrail would BEST prevent this problem from recurring?
- Monitor state backend access and support recovery procedures after interrupted plans.
- Review policy versions and exemption expiry after organizational hierarchy or compliance changes.
- Review module versioning and parameter validation for every supported environment.
- Version environment definitions and routinely clean up expired resources and exceptional permissions.
Explanation
Correct Answer
A:Monitor state backend access and support recovery procedures after interrupted plans. State corruption can trigger destructive infrastructure changes or leak sensitive attributes.
Incorrect Answers
B:Review policy versions and exemption expiry after organizational hierarchy or compliance changes.
C:Review module versioning and parameter validation for every supported environment. This helps sustain a control for bicep reusable modules with environment-specific parameters; it does not directly stop recurrence of terraform state lock and controlled backend for azure described in this case.
D:Version environment definitions and routinely clean up expired resources and exceptional permissions. This helps sustain a control for azure deployment environments for governed self-service; it does not directly stop recurrence of terraform state lock and controlled backend for azure described in this case.
Question 670
A production state file is stored locally on a developer laptop without backup or access control. Which risk is directly created by the described failure?
- State corruption can trigger destructive infrastructure changes or leak sensitive attributes.
- Unreviewed IaC effects can interrupt services or delete data despite a green pipeline parse.
- Configuration drift can disable monitoring or create inconsistent vulnerability exposure across servers.
- Template duplication and hardcoded scopes can introduce policy drift or unintended resource replacement.
Explanation
Correct Answer
A:State corruption can trigger destructive infrastructure changes or leak sensitive attributes. This is the directly relevant business or security consequence of terraform state lock and controlled backend for azure. Root cause: Terraform state represents actual managed resources and needs concurrency and confidentiality controls.
Incorrect Answers
B:Unreviewed IaC effects can interrupt services or delete data despite a green pipeline parse. That risk is relevant to arm template what-if detecting unintended replacements, but the specific unresolved condition here concerns terraform state lock and controlled backend for azure and has a different direct consequence.
C:Configuration drift can disable monitoring or create inconsistent vulnerability exposure across servers. That risk is relevant to azure machine configuration desired state assurance, but the specific unresolved condition here concerns terraform state lock and controlled backend for azure and has a different direct consequence.
D:Template duplication and hardcoded scopes can introduce policy drift or unintended resource replacement. That risk is relevant to bicep reusable modules with environment-specific parameters, but the specific unresolved condition here concerns terraform state lock and controlled backend for azure and has a different direct consequence.
Designing and Implementing Microsoft DevOps Solutions (AZ-400) Practice Tests
