Question 890 An audit requires a record of who approved infrastructure changes and what properties changed. Which IaC practice supports this? Store reviewed infrastructure definitions in version control with change history Keep only manually exported portal screenshots after each deployment Keep all instructions only in a developer's terminal history Delete earlier templates after each rollout Explanation Correct Answer A:Source commits and reviews create a useful intent audit trail. Incorrect Answers B:Screenshots do not provide the reviewable, version-controlled infrastructure definitions and approval history required. C:Local history isn't reliable shared change control. D:Removing history obscures changes.
Question 891 A deployment adds public ingress to a database subnet, and security wants review before provisioning. Where can a preventive control be placed? Pull-request review and automated checks of the IaC change Rely only on after-the-fact audits instead of checking code before deployment Only in post-incident invoices Review only the deployed network rules after the public ingress is already active Explanation Correct Answer A:Reviewing the proposed network rule before rollout can prevent exposure. Incorrect Answers B:Post-deployment checks may detect unsafe ingress after it has already been introduced. C:Billing reports won't prevent the insecure configuration. D:Post-deployment review does not prevent the unsafe rule from being applied in the first place.
Question 892 An IaC repository contains an administrator password in plain text. Which remediation is most appropriate? Place secrets in plain-text template parameters and rely on a private repository Use longer plaintext passwords in the same public repository Assign more resource tags to the password file Move secrets to supported protected secret/identity mechanisms and remove exposed values Explanation Correct Answer D:Versioned infrastructure code should not publish reusable credentials. Incorrect Answers A:A private repository is not a substitute for secure secret storage and non-disclosure in code history. B:Length doesn't prevent disclosure. C:Metadata doesn't encrypt repository history.
Question 893 A team has one tested infrastructure template but needs different VM sizes for dev and production. What authoring technique helps? Copy and randomly edit every resource by hand each run Keep identical production-size resources in every test lab regardless of need Hardcode identical VM sizes into every environment rather than parameterize deployments Use validated parameters or environment-specific deployment inputs Explanation Correct Answer D:Parameterization separates reusable infrastructure logic from environment values. Incorrect Answers A:Ad hoc edits increase drift. B:This may waste test cost. C:Reused templates need environment-specific inputs instead of forcing an unsuitable SKU everywhere.
Question 894 An engineer manually changes a VM network rule after a reviewed IaC deployment. What operational issue should the team recognize? Manual changes automatically rewrite Git history The deployed configuration may drift from the source-controlled desired state Compare only the current portal view without checking the reviewed IaC desired state The VM becomes free because a manual change occurred Explanation Correct Answer B:Out-of-band changes can make later deployments and audits unpredictable. Incorrect Answers A:Azure doesn't update source commits unconditionally. C:A current-state snapshot cannot by itself establish drift from an approved definition. D:Configuration drift isn't a pricing credit.
Question 895 An update to an IaC template causes application downtime. What release practice helps future recovery? Only increase VNet address space without diagnosing the failure Delete every prior template permanently Assume an older template always reverses external data mutations automatically Retain tested prior definitions and use a controlled rollback or forward-fix plan Explanation Correct Answer D:Version history and deployment testing support recovery from bad changes. Incorrect Answers A:IP expansion isn't a universal release rollback. B:Removing known-good intent impedes rollback. C:Infrastructure rollback and data recovery are separate.
Question 896 An infrastructure deployment is rerun with identical declared settings. Which IaC property is desirable? Force a random VM size at each run Repeatable convergence to the defined state without needless duplicate resources Erase subscription role assignments before every run Create new unrelated resources on every retry regardless of names Explanation Correct Answer B:Idempotent deployments reduce side effects on retries. Incorrect Answers A:Random configuration doesn't converge. C:Unrelated destructive actions aren't repeatable configuration. D:Duplication undermines stable desired state.
Question 897 A team writes the desired Azure resource topology rather than specifying every portal click required to create it. What is this style? A manual runbook screenshot A guest operating-system package list alone Treat an ad hoc sequence of manual commands as a complete declarative desired-state specification Declarative IaC Explanation Correct Answer D:The engine compares a declared resource state with actual deployment targets. Incorrect Answers A:Screenshots aren't a machine-readable desired-state model. B:Guest packages aren't the full Azure infrastructure topology. C:Imperative actions do not inherently express the end state that a declarative template represents.
Question 898 A company wants to see proposed resource changes before applying a risky deployment. What practice can help? Preview/what-if analysis and validation for supported IaC tooling Only rename templates without inspecting changes Deploy first, then infer intent from downtime Turn off activity logging during tests Explanation Correct Answer A:A change preview can reveal unexpected creates, updates or deletes. Incorrect Answers B:Names don't show desired-state differences. C:Immediate unreviewed writes can introduce risk. D:Less audit data doesn't validate configuration.
Question 899 A development team deploys ARM templates from CI and wants to block unapproved regions even if code review misses them. Which Azure service provides a deployment-level guardrail? Azure Policy assigned to the appropriate scope Azure Storage Explorer Rely solely on a deployment success message rather than evaluate policy compliance before applying changes A VM data disk snapshot Explanation Correct Answer A:Policy can deny noncompliant resource locations independently of the template author. Incorrect Answers B:A storage browser isn't a resource policy gate. C:A deployment operation can succeed without satisfying every required external policy rule or review. D:Disk recovery isn't a policy enforcement engine.
Question 900 Two teams need the same network baseline but different application resources. Which IaC design principle promotes maintainability? Treat all resource groups as identical containers with no parameters Use reusable modules/templates for approved common infrastructure components Copy an outdated network rule set into every repo without ownership Use unrelated random CIDRs in every environment without planning Explanation Correct Answer B:Shared reviewed components reduce duplicate configuration logic. Incorrect Answers A:Environment differences may still need explicit inputs. C:Forks can diverge and become unsafe. D:Address conflicts can result.
