AZ-400 Question 181
Select 3You work at a company that deploys Azure infrastructure across multiple environments using Infrastructure as Code (IaC). The team uses Terraform for provisioning and wants to enforce consistent environments while maintaining strong security for secrets. Which of the following actions should you take to meet these requirements? (Choose all that apply.)
- A
Store all environment secrets within your main Terraform variables file so they remain version-controlled
- B
Use Azure Key Vault and Terraform's key vault data source to securely retrieve secrets at deploy time
- C
Create separate variable files (e.g., dev.tfvars, prod.tfvars) to define environment-specific parameters
- D
Hard-code production resource names in the Terraform scripts for quick lookups
- E
Configure a remote backend (e.g., Azure Storage) to centrally store and lock Terraform state
Show answer and explanation
Correct answers: B, C, E
Explanation
In practice, applying IaC best practices involves separating configuration from code, storing secrets securely, and maintaining a single source of truth for state management. Microsoft� documentation recommends integrating Azure Key Vault for secret management in Terraform (see official Terraform provider docs for Azure), using separate environment variable files to handle differing configuration parameters, and employing a secure remote backend for Terraform state. These steps help maintain consistent deployments and protect sensitive data across multiple Azure environments.
- A. Incorrect.
Option 1: Incorrect. Storing secrets directly in version-controlled files risks compromising sensitive data. Best practice is to keep secrets in a secure location and reference them rather than commit them to source control.
- B. Correct.
Option 2: Correct. Using Azure Key Vault to store and retrieve secrets at deploy time is a secure approach, recommended by Microsoft to protect sensitive data in IaC pipelines.
- C. Correct.
Option 3: Correct. Defining separate variable files per environment (for example dev.tfvars, test.tfvars, prod.tfvars) allows you to maintain consistency in the Terraform code while customizing values for each environment.
- D. Incorrect.
Option 4: Incorrect. Hard-coding production resource names can lead to inconsistencies and brittleness in your Terraform templates, violating the principle of reusable, parameter-driven IaC.
- E. Correct.
Option 5: Correct. Using a remote backend (like Azure Storage) to centrally store and lock Terraform state ensures consistent state tracking across team members and safeguards against concurrency issues.