AZ-400 Question 187
Select 2Your company maintains a fleet of Windows-based application servers both on-premises and in Azure. You need to ensure each server has a consistent baseline configuration, including specific security policies, custom PowerShell modules, and standardized registry settings. After discussions with your DevOps team, you decide to use Azure Automation State Configuration (a cloud-based DSC solution) to manage and enforce these configurations. Which two actions should you take to implement and maintain this configuration management strategy?
- A
A. Configure each server to use the Azure Automation pull server and regularly check in to receive the latest DSC configurations
- B
B. Manually run a PowerShell script on each server every week to apply DSC configurations from a shared file share on-premises
- C
C. Store your DSC configuration scripts in an Azure DevOps repository and integrate them into a release pipeline to publish updates to Azure Automation
- D
D. Use Azure Backup to regularly capture a VM snapshot and restore it whenever configuration drift is detected
- E
E. Define a DSC Local Configuration Manager (LCM) refresh frequency on each node to periodically enforce the desired state
Show answer and explanation
Correct answers: A, C
Explanation
Using Azure Automation State Configuration (built on PowerShell DSC) allows you to define desired states for servers and automatically enforce them. Storing configuration scripts in a version-controlled Azure DevOps repository and publishing them to Azure Automation ensures consistent, trackable deployment. Configuring each server as a 'pull node' enables them to periodically retrieve and apply the latest configurations from Azure Automation. For more details, refer to the Microsoft documentation on Azure Automation State Configuration at https://learn.microsoft.com/azure/automation/automation-dsc-overview.
- A. Correct.
A. This option is correct. By configuring servers to pull from Azure Automation State Configuration, each node (server) periodically checks in with the pull server to receive and apply the latest DSC configurations.
- B. Incorrect.
B. This approach is typically error-prone and does not leverage Azure Automation. While running a script manually might apply DSC, it does not provide automatic or continuous configuration compliance, making it an inefficient solution.
- C. Correct.
C. This option is correct. Storing DSC configurations in an Azure DevOps repository and automating their deployment through a release pipeline ensures version control, continuous integration, and consistent publishing to Azure Automation.
- D. Incorrect.
D. Azure Backup snapshots are for disaster recovery and data protection, not continuous enforcement of configuration states. Snapshots do not address configuration drift proactively, so this is not the best choice for a configuration management strategy.
- E. Incorrect.
E. Setting an LCM refresh frequency is valid, but it should be configured in conjunction with a pull server (like Azure Automation State Configuration). By itself, defining a refresh frequency without a properly configured pull server or pipeline does not fulfill the strategy.