AZ-400 Question 190
Select 2Your organization is transitioning to an Infrastructure as Code (IaC) approach to manage Azure resources. You have decided to store your infrastructure templates in a Git repository and want to ensure that any changes are automatically validated, tested, and only deployed to production once all checks pass. Which two actions should you take to meet these requirements?
- A
Enable pull request triggers in your IaC pipeline to run validation checks and unit tests automatically.
- B
Merge all changes directly into the main branch to simplify version history.
- C
Implement mandatory pull request approvals and block merging if pipeline checks fail.
- D
Store environment-specific credentials in the repository for seamless deployments.
Show answer and explanation
Correct answers: A, C
Explanation
Adopting an IaC strategy requires implementing automated validation via CI/CD pipelines and enforcing code reviews to maintain consistency and security. Azure DevOps supports pull request triggers for automated tests and also lets you create branch policies (including mandatory approvals and blocking merges on failing checks) to ensure a robust IaC workflow. Refer to the official Azure DevOps documentation on 'Branch policies' and 'Build validation' for best practices on configuring these processes.
- A. Correct.
Option 1 is correct. By configuring pull request (PR) triggers, you ensure that whenever a change is proposed, the pipeline automatically runs template validation and unit or integration tests. This helps catch issues earlier and maintain a high level of code quality.
- B. Incorrect.
Option 2 is incorrect. Merging all changes directly to the main branch without proper review and automated checks can lead to undetected configuration or deployment errors, defeating the purpose of automated validation.
- C. Correct.
Option 3 is correct. Mandatory approvals on pull requests and blocking merges if pipeline checks fail enforce a comprehensive review and testing process, making sure that only validated code is merged.
- D. Incorrect.
Option 4 is incorrect. Storing credentials or secrets directly in source control is a risky practice that can lead to security breaches. Sensitive data should be stored in secure locations such as Azure Key Vault.