AZ-400 Question 194
Select 2Your team is planning to deploy and maintain a consistent Windows OS baseline for new and existing Azure VMs, which includes installing certain Windows features, configuring registry settings, and installing mandatory software. The environment is fully hosted in Azure, and you want a solution that integrates easily with your CI/CD pipeline and can automatically remediate configuration drift. Which two approaches can help you achieve this with minimal overhead?
- A
Use Bicep templates to define and deploy the Azure infrastructure, and use Azure Automanage Machine Configuration to enforce and remediate OS-level settings.
- B
Use only Bicep templates to define both Azure infrastructure and detailed OS configurations, relying on resource definitions for drift prevention.
- C
Use Azure Resource Manager templates for infrastructure creation and Azure Automation State Configuration (DSC) to continuously apply and remediate OS configurations.
- D
Install all required features and software directly into a custom Windows base image stored in an Azure Shared Image Gallery and manually update the image when changes are needed.
Show answer and explanation
Correct answers: A, C
Explanation
Both Bicep + Azure Automanage Machine Configuration (Option 1) and ARM + Azure Automation DSC (Option 3) are valid, automated approaches that integrate well with CI/CD and provide continuous enforcement of OS-level configurations. Bicep and ARM templates address infrastructure as code, while Azure Automanage Machine Configuration and Azure Automation DSC handle the ongoing configuration management. For more details, refer to the official documentation on Azure Automanage (https://learn.microsoft.com/azure/automanage/automanage-machine-configuration-overview) and Azure Automation DSC (https://learn.microsoft.com/azure/automation/automation-dsc-overview).
- A. Correct.
Option 1 is CORRECT. Bicep templates can handle infrastructure deployment (e.g., creating VMs, networks, etc.) while Azure Automanage Machine Configuration ensures that OS-level settings (features, registry, software) remain in compliance. This approach leverages Infrastructure as Code (IaC) plus post-deployment configuration management, making it suitable for CI/CD integration.
- B. Incorrect.
Option 2 is INCORRECT. While Bicep handles infrastructure provisioning, it does not inherently manage detailed OS-level configurations or automate drift remediation for Windows features and settings. Additional services, such as Azure Automation DSC or Azure Automanage Machine Configuration, are typically required.
- C. Correct.
Option 3 is CORRECT. ARM templates can provision the infrastructure, and Azure Automation State Configuration (DSC) can continuously enforce the desired OS configurations. DSC will detect and remediate drift by re-applying the configuration, which aligns well with a CI/CD workflow.
- D. Incorrect.
Option 4 is INCORRECT. Manually installing configurations in a custom base image requires continuous image updates and redeployments. It does not inherently provide an automated mechanism to detect or remediate drift on running VMs, increasing overhead and complexity.