Infrastructure that is clicked together in a portal cannot be reviewed, repeated, or rebuilt reliably. AZ-400 expects you to manage environments as code and to keep the pipelines that deploy them healthy, fast, and affordable. This set covers infrastructure as code (Bicep, ARM, deployment modes, what-if, configuration management, Azure Machine Configuration, and Azure Deployment Environments) and pipeline maintenance (caching, concurrency, retention, and pipeline health).
This is the fifth post in our AZ-400 series (Questions 41-50). The previous set, AZ-400 Questions 31-40: Deployment Strategies and Release Safety, covers blue-green, canary, and feature flags. Every question here is an original practice scenario, not a copy of a real exam item.
Question 41: Choosing an Azure-Native IaC Language
Contoso deploys only to Azure and wants an infrastructure-as-code language with concise syntax, first-class Azure support on day one for new resource types, and no state file to manage. What should they choose?
A) Manually exported ARM templates edited by hand
B) PowerShell scripts that call New-AzResource for each resource
C) Bicep
D) Azure portal deployments documented in a wiki
👁 Reveal Answer
Correct Answer: C
Explanation: Bicep is Azure’s declarative IaC language. It compiles to ARM templates, supports new Azure resource types and API versions as soon as they are available, and relies on Azure Resource Manager to track deployed state, so there is no separate state file. B is imperative: you script each step and must handle ordering and idempotency yourself. A works but exported templates are verbose and hard to maintain. D is not infrastructure as code. If an organization deploys across several clouds, Terraform is the common alternative — it does use a state file.
Question 42: Previewing Changes Before Deployment
Before a Bicep deployment runs in production, Fabrikam’s reviewers want to see exactly which resources will be created, changed, or deleted. What should the pipeline run first?
A) A what-if operation for the deployment
B) A bicep build command only
C) A complete-mode deployment to a test subscription
D) An Azure Policy compliance scan
👁 Reveal Answer
Correct Answer: A
Explanation: The what-if operation (for example, az deployment group what-if) compares the template with the current state in Azure and lists resources that would be created, modified, or deleted, without changing anything. Running it in a pipeline stage before an approval gives reviewers real evidence. B only compiles Bicep to JSON and validates syntax. C changes a different environment, which says little about production. D reports compliance against rules, not the changes a specific deployment will make.
Question 43: The Danger of Complete Mode
A pipeline deploys a Bicep file to a shared resource group using complete deployment mode. A teammate’s storage account in that resource group is not defined in the file. What happens to it during the deployment?
A) Nothing — complete mode only adds resources
B) It is deleted, because complete mode removes resources not defined in the template
C) It is moved to a new resource group
D) The deployment fails until the storage account is added
👁 Reveal Answer
Correct Answer: B
Explanation: In complete mode, Resource Manager deletes resources in the resource group that are not in the template (subject to some resource-type exceptions). Incremental mode — the default — leaves unlisted resources alone. That is why complete mode should only target resource groups whose entire contents are owned by one template, and why running what-if first is wise. A describes incremental mode. C and D are not how deployment modes behave. Deployment stacks are another option when you need to manage and clean up a defined set of resources safely.
Question 44: Keeping Server Settings from Drifting
Northwind Traders has hundreds of Windows and Linux servers in Azure and on-premises (connected with Azure Arc). It needs to audit and enforce operating-system settings, such as required services and security baselines, and report drift centrally. What should it use?
A) A wiki checklist reviewed monthly
B) Bicep templates redeployed every hour
C) Azure Monitor alerts on CPU usage
D) Azure Machine Configuration, assigned through Azure Policy
👁 Reveal Answer
Correct Answer: D
Explanation: Azure Machine Configuration (formerly guest configuration) audits and can apply settings inside the operating system of Azure VMs and Arc-enabled servers. Assignments are delivered through Azure Policy, so compliance and drift are reported centrally. B manages Azure resources, not settings inside the OS. C measures performance, not configuration. A is manual and cannot enforce anything. Remember the split: Bicep and ARM define Azure resources; desired state configuration tools manage what runs inside the machines.
Question 45: Self-Service Environments for Developers
Developers at Woodgrove Bank wait days for the platform team to create test environments. The platform team wants developers to spin up approved environments on demand from curated templates, with cost and policy guardrails, and tear them down when finished. Which service fits?
A) Azure DevTest Labs formula sharing by email
B) Azure Deployment Environments
C) Giving every developer Owner on the subscription
D) Azure Blueprints
👁 Reveal Answer
Correct Answer: B
Explanation: Azure Deployment Environments lets platform teams publish IaC templates in a catalog and define projects and environment types with the subscriptions, permissions, and policies to use. Developers then create and delete environments themselves within those guardrails. A is a workaround, not a governed self-service model. C removes all guardrails. D is deprecated in favor of template specs and deployment stacks, and it was never a developer self-service tool.
Question 46: Infrastructure Code Gets Tested Too
Adventure Works stores Bicep files in Git. They want mistakes caught before anything reaches Azure. Which pipeline steps should run on every pull request that changes infrastructure code?
A) No checks — IaC changes are reviewed only after deployment
B) A full production deployment
C) Linting and validation of the Bicep files, plus a what-if against a test environment
D) A load test of the application
👁 Reveal Answer
Correct Answer: C
Explanation: An IaC strategy treats infrastructure like application code: it lives in source control and changes are tested automatically. The Bicep linter catches errors and best-practice violations, validation checks the template against Azure, and what-if shows the effect before merge. B is far too risky for a pull request. A finds problems only once they have already reached Azure. D tests the application, not the infrastructure definition.
Question 47: Speeding Up Slow Restores
Tailspin Toys’ Node.js pipeline spends four minutes on npm install in every run, even when dependencies have not changed. Which change reduces this most directly?
A) Add a Cache task keyed on the package-lock.json file
B) Increase the job timeout
C) Run the pipeline less often
D) Move npm install to a separate stage
👁 Reveal Answer
Correct Answer: A
Explanation: Pipeline caching saves files (such as the npm cache) between runs under a key. Basing the key on the lock file means the cache is reused until dependencies actually change, then rebuilt automatically. That cuts time and agent minutes. B lets slow runs continue but does not speed them up. C delays feedback. D adds stage overhead and still runs the full install.
Question 48: Balancing Concurrency and Cost
Litware’s developers often wait 20 minutes for pipelines to start because jobs queue behind each other. Agents are fast once a job begins. What should you review first?
A) The retention policy for old runs
B) The size of the Git repository
C) The number of branch policies
D) The number of parallel jobs purchased or self-hosted agents available
👁 Reveal Answer
Correct Answer: D
Explanation: In Azure Pipelines, the number of jobs that can run at the same time is limited by parallel jobs (for Microsoft-hosted agents) and by available agents (for self-hosted pools). Long queue times with fast runs point to too little concurrency. You can buy more parallel jobs, add agents, or reduce demand — for example, by avoiding duplicate CI runs on every push to a PR branch. B affects checkout time, not queuing. C affects merges. A affects storage, not wait time.
Question 49: Keeping the Releases That Matter
Coho Winery’s project retention settings delete pipeline runs and their artifacts after 30 days. Auditors require the run and artifacts for every production release to be kept for seven years. What should you do?
A) Set project retention to seven years for all runs
B) Retain the specific production runs (for example, with a retention lease added by the pipeline) and copy release artifacts to long-term storage
C) Take screenshots of each release
D) Disable retention entirely
👁 Reveal Answer
Correct Answer: B
Explanation: A retention strategy should keep what matters and let the rest expire. Retention leases (or marking a run to be retained) exclude specific runs from automatic cleanup, and a pipeline step can add a lease for every production deployment. For multi-year requirements, also copy release artifacts to durable storage such as an immutable Azure Storage container or a package feed. A keeps every CI run for years and wastes storage. C is not an audit trail. D lets storage grow without limit.
Question 50: Watching Pipeline Health
A DevOps lead wants to know which pipelines fail most often, how long runs take over time, and which tests are flaky, so she can prioritise fixes. What should she use?
A) The Git commit history
B) The Azure Boards burndown chart
C) Azure Pipelines analytics reports for pipeline pass rate, duration, and test failures
D) Azure Advisor cost recommendations
👁 Reveal Answer
Correct Answer: C
Explanation: Azure Pipelines analytics shows pipeline pass rate, failure trends, run duration, and test analytics including flaky tests. These are the pipeline-health signals named in the AZ-400 outline (failure rate, duration, and flaky tests), and they can be added to dashboards. B tracks work remaining in a sprint. A shows code changes, not pipeline outcomes. D suggests Azure resource savings but does not report on pipelines.
Study Tips for IaC and Pipeline Maintenance
- Know Bicep’s safety tools. Linter for quality, validation for correctness, what-if for impact.
- Remember deployment modes. Incremental (default) leaves unlisted resources; complete deletes them.
- Separate resource definition from OS configuration. Bicep and ARM build Azure resources; Azure Machine Configuration manages settings inside servers.
- Optimize in the right place. Slow steps call for caching; long queues call for more concurrency.
- Retain selectively. Keep production runs and artifacts; let ordinary CI runs expire.
Keep Practicing for AZ-400
Continue with AZ-400 Questions 51-60: Security, Secrets, and Compliance Scanning. For reference, read Microsoft’s Bicep what-if documentation with Question 42 and the pipeline caching guide with Question 47.
