AZ-400 Question 197
Select 2Your organization wants to provide developers with on-demand, self-service dev/test environments in Azure. They plan to use Azure Deployment Environments to ensure each environment follows organizational policies and cost constraints. Which two actions should you take to implement a secure, on-demand self-deployment solution while maintaining compliance requirements?
- A
Define environment templates using Bicep or ARM, store them in a Git repository, and consume them through environment definitions within Azure Deployment Environments.
- B
Grant the Global Administrator role to all developers so they can manage any resource without additional permissions.
- C
Use Azure Policy to enforce allowed resource SKUs and cost constraints on the environment definitions, linking these policies to the appropriate subscriptions.
- D
Disable RBAC on the environment so developers can freely deploy any resource from the Azure Marketplace.
Show answer and explanation
Correct answers: A, C
Explanation
When designing Azure Deployment Environments for on-demand self-deployment, it is critical to enforce governance and compliance without hindering developer productivity. Infrastructure as Code (IaC) templates (Bicep or ARM) should be version-controlled in a central repository and coupled with Azure Policy to ensure only approved resources are deployed. Role-Based Access Control (RBAC) should remain enabled to grant developers the correct permissions, and Global Administrator assignment should be avoided. For more details, refer to Microsoft's documentation on Azure Deployment Environments and best practices for enterprise-scale governance using Azure Policy.
- A. Correct.
By defining environment templates with IaC (Bicep or ARM) and storing these in a Git repo, you create consistent, reusable definitions. Using environment definitions in Azure Deployment Environments enables self-service for developers with controlled deployments.
- B. Incorrect.
Granting the Global Administrator role bypasses organizational governance and is highly insecure. This role should be restricted to a minimal set of administrators.
- C. Correct.
Azure Policy can automatically enforce allowed resource types, SKUs, and cost settings, ensuring each environment remains compliant with organizational standards even with self-service deployment.
- D. Incorrect.
Disabling RBAC would remove essential security controls, allowing any user to provision potentially non-compliant or costly resources.