AZ-400 Question 193
Single answerYour organization needs to ensure consistent configuration across all Windows virtual machines running in multiple Azure environments. You want to store configurations in source control, automatically deploy them via a DevOps pipeline, and continuously monitor and remediate configuration drift. You plan to use Azure Automation State Configuration for DSC (Desired State Configuration). Which approach should you implement to best meet these requirements?
- A
Use Bicep templates to deploy the DSC extension to each VM and connect it to Azure Automation State Configuration, storing and managing DSC configurations in the Automation account
- B
Use a custom marketplace script extension that pulls DSC configurations from GitHub and runs them locally on each VM when triggered by an Azure Pipeline
- C
Use Azure Resource Manager templates to deploy the DSC extension on each VM and manually store configuration scripts in each VM's file system
- D
Use Azure Automanage Machine Configuration on each VM as the sole solution for storing, deploying, and remediating DSC configurations without an Automation account
Show answer and explanation
Correct answer: A
Explanation
Bicep templates offer a modern, concise way to define Azure resources (including VM extensions) in code. By integrating with Azure Automation State Configuration, you can store, monitor, and remediate DSC configurations at scale without manual intervention. This aligns with best practices for DevOps-driven infrastructure management. For more details, refer to the Microsoft documentation on 'Use Azure Automation State Configuration to manage DSC at scale' and 'Bicep documentation' for best practices.
- A. Correct.
Correct. Bicep is a recommended Infrastructure as Code (IaC) language for Azure, allowing you to define the VM and the DSC extension. Azure Automation State Configuration can store DSC configurations, monitor for drift, and automatically remediate changes. This approach meets both the code management and continuous compliance requirements.
- B. Incorrect.
Incorrect. While custom script extensions can run DSC scripts, this approach relies on manually wiring up the GitHub repository and scripting tasks in the pipeline. It doesn�t leverage Azure Automation State Configuration� built-in drift detection and remediation, making it less suitable for enterprise-scale management.
- C. Incorrect.
Incorrect. ARM templates can deploy the DSC extension, but storing DSC configurations manually on each VM makes it difficult to manage updates and automatically remediate drift. This manual approach undermines the DevOps requirement for version-controlled, consistent environments.
- D. Incorrect.
Incorrect. Azure Automanage Machine Configuration helps apply and monitor baseline configurations, but it does not entirely replace Azure Automation State Configuration for DSC. It lacks the full capabilities for DSC script storage, robust drift remediation, and integration with pipeline-driven IaC processes.