AZ-400 Question 189
Select 2You are a DevOps engineer for a company deploying a microservices-based application across Development, Test, and Production environments in Azure. The team wants to avoid manual configuration drift, ensure that all infrastructure changes are version-controlled, and apply consistent configuration across each environment. Which two configuration management strategies should you prioritize to meet these requirements?
- A
Use a YAML-based Azure Pipeline to provision and configure infrastructure from a centralized repository containing Infrastructure as Code templates (e.g., ARM, Bicep, or Terraform).
- B
Create ephemeral virtual machines that are hand-configured after each deployment without documenting the steps in code.
- C
Leverage Azure Automation State Configuration (or DSC) to enforce and maintain a desired state on all target nodes via an idempotent approach.
- D
Store sensitive application settings in plain text within the same repository as your source code to simplify updates.
Show answer and explanation
Correct answers: A, C
Explanation
A robust configuration management strategy relies on storing definitions and configurations in version-controlled repositories, using automated pipelines, and employing idempotent configurations to ensure consistency across environments. Azure DevOps best practices include using IaC templates (ARM, Bicep, or Terraform), YAML-based pipelines for repeatable deployments, and tools such as Azure Automation State Configuration or DSC to enforce desired states. Refer to Microsoft documentation at https://docs.microsoft.com/azure/devops for further guidance on secure configuration management and Infrastructure as Code.
- A. Correct.
Option 1 is correct. Storing your Infrastructure as Code (IaC) templates in a version-controlled repository and using a YAML-based Azure Pipeline helps maintain consistent and repeatable deployments. Any changes to templates can be tracked, reviewed, and automatically applied across environments.
- B. Incorrect.
Option 2 is incorrect. Manually configuring ephemeral VMs introduces high risk of configuration drift and cannot easily be reproduced or tracked in version control. This approach conflicts with the principles of Infrastructure as Code.
- C. Correct.
Option 3 is correct. Using Azure Automation State Configuration or Desired State Configuration (DSC) enforces a desired state on target machines. It provides an idempotent approach, meaning if the configuration is already in the desired state, no further changes are applied, ensuring consistent configuration.
- D. Incorrect.
Option 4 is incorrect. Storing sensitive data (such as passwords or API keys) in plain text is a security risk. Best practices recommend using secure secrets management solutions like Azure Key Vault or Azure DevOps secure variable groups.