AZ-104 Question 112
Single answerYou are an Azure administrator for a company that wants to standardize deployments across dev, test, and production. They plan to reference an existing Azure Key Vault for secret management and apply Azure Policy assignments for governance. To simplify maintenance, they want to keep shared logic in one place and avoid duplicating code for each environment. Which approach should you recommend to efficiently meet these requirements using Bicep?
- A
Use a single Bicep file that references an existing Key Vault and applies the Policy assignment. Pass environment-specific parameters from a pipeline for each deployment.
- B
Write separate Bicep files for each environment, embedding unique Key Vault details and Policy definitions in each file.
- C
Embed the Key Vault secrets and Policy definitions within a parent ARM template, then call nested Azure templates for each environment.
- D
Convert the Bicep file into multiple JSON ARM templates, one per environment, each referencing the Key Vault and policy settings directly.
Show answer and explanation
Correct answer: A
Explanation
Parametrizing a single Bicep file and using references to existing resources is an effective way to ensure consistency, limit duplication, and simplify policy assignment across multiple environments. Modularizing the deployment and passing in environment-specific values at runtime adheres to best practices in Azure Resource Manager deployments.
- A. Correct.
This approach uses modular Bicep features and environment parameters, avoiding duplication of code while referencing the existing Key Vault and applying policies consistently.
- B. Incorrect.
Creating separate Bicep files for each environment duplicates logic and makes maintenance difficult if changes are needed across multiple files.
- C. Incorrect.
While nested ARM templates can be used, embedding all definitions within a parent template creates longer, less modular files and can be harder to reuse.
- D. Incorrect.
Converting to multiple JSON ARM templates reintroduces duplication and complicates maintenance whenever config changes are necessary.