AZ-400 Question 186
Single answerYou are supporting a line-of-business application that runs across multiple Windows and Linux virtual machines in Azure. Your compliance policy requires that each newly provisioned VM adopt a consistent baseline configuration, including specific file paths, service states, and security policies. You also need this configuration to be version-controlled in Azure Repos and enforced automatically to maintain compliance. Which configuration management technology would you recommend to meet these requirements?
- A
Ansible running on self-hosted VMs
- B
Azure Automation State Configuration (DSC)
- C
Terraform scripts stored in Azure Repos
- D
Manual scripts triggered from Azure Pipelines
Show answer and explanation
Correct answer: B
Explanation
In Azure-centric environments where you want a state-based approach to enforce and audit both Windows and Linux VM configurations, Azure Automation State Configuration (DSC) offers native integration and a simplified deployment model. This aligns with best practices for Infrastructure as Code, version control, and continuous compliance. For more details, refer to Microsoft documentation on Azure Automation State Configuration: https://docs.microsoft.com/azure/automation/automation-dsc-overview.
- A. Incorrect.
Ansible is a valid configuration management technology; however, it requires setting up and maintaining your own control node or hosted environment. While Ansible can be integrated with Azure, the question specifically highlights a need for a service deeply integrated with Azure� native workflows, making other options more suitable for this scenario.
- B. Correct.
Azure Automation State Configuration (formerly DSC) allows you to manage both Windows and Linux configurations directly within Azure. You can store configurations in Azure Repos, automatically provision VMs with desired configurations, and continuously check for compliance, making it the most aligned solution in this scenario.
- C. Incorrect.
Terraform is primarily focused on creating and managing infrastructure (provisioning resources like VMs, networks, and storage). While it can handle some aspects of configuration, it is primarily Infrastructure as Code rather than a full-fledged configuration management tool for ongoing compliance and drift control.
- D. Incorrect.
Manual scripts triggered from Azure Pipelines can automate a portion of the configuration process but do not provide a robust state-based approach. You would have to manually manage drift detection and updates, making it error-prone compared to a dedicated configuration management solution.