AZ-400 Question 191
Select 2You are a lead DevOps engineer responsible for defining an Infrastructure as Code (IaC) strategy for your organization using Azure Resource Manager (ARM) templates. Recently, you discovered environment drift occurring after production deployments. To ensure consistent deployments and prevent drift, you plan to automate the testing and deployment of your ARM templates using Azure DevOps. You also want to enforce governance so that changes are only merged after passing automated validation in an ephemeral environment. Which two actions should you take to achieve this objective?
- A
Use a single shared main branch for committing template changes and run the CI/CD pipeline only after merges to the main branch.
- B
Enable branch policies in Azure DevOps to require a successful pipeline deployment to a temporary test environment before merging pull requests.
- C
Store all ARM templates in a centralized Azure DevOps repository and use pull requests to merge changes between branches.
- D
Allow each developer to maintain their own separate repository to isolate individual ARM template changes and deployments.
- E
Always deploy the ARM templates first to the production environment and then test them in a secondary environment to confirm correctness.
Show answer and explanation
Correct answers: B, C
Explanation
Adopting an IaC strategy requires strict version control and automated validation processes. According to Microsoft� recommended DevOps practices, storing infrastructure templates in a single Git repository and using pull requests ensures that changes undergo review and automated testing. Enforcing branch policies that require successful builds or deployments to a temporary environment before merging helps detect issues early, preventing configuration drift and stabilizing production deployments. Refer to the Azure DevOps documentation on 'Branch Policies' and 'Infrastructure as Code Best Practices' for further guidance.
- A. Incorrect.
Option 1: Incorrect. Relying on a single shared main branch and running pipelines only after merging does not prevent environment drift or ensure that code changes are validated in an ephemeral environment. You need to validate changes before they reach the main branch.
- B. Correct.
Option 2: Correct. Enabling branch policies and requiring a successful deployment to a test environment as part of the CI process ensures changes are validated before merging, preventing the introduction of drift.
- C. Correct.
Option 3: Correct. Storing your ARM templates in a centralized Git repository and using pull requests is a core best practice in IaC. Pull requests enable code reviews, automated tests, and an audit trail of changes.
- D. Incorrect.
Option 4: Incorrect. Isolating changes in separate developer repositories can lead to inconsistent code management, making it difficult to enforce common policies and track changes across the organization.
- E. Incorrect.
Option 5: Incorrect. Deploying to production first and then testing in a secondary environment defeats the purpose of early validation and increases the risk of introducing drift into production.