Task 3.5: Design and implement infrastructure as code (IaC)

• APut a CanNotDelete lock on the resource group and keep deploying with az deployment group create

  Incorrect

  A delete lock still lets engineers change rules in the portal, which is the drift the team wants to stop.

• BRun a scheduled what-if each night and email the differences to the network team

  Incorrect

  What-if reports differences after the fact; it doesn't prevent anyone from changing the resources.

• CDeploy the file as a deployment stack with deny settings mode denyWriteAndDelete, excluding the pipeline's principal

  Correct

  The stack's deny assignment blocks writes and deletes on its managed resources for everyone except the excluded principals.

• DRemove Contributor from all engineers and grant them Reader on the subscription

  Incorrect

  Engineers lose access to everything else they manage, and Owners could still edit the resources.

A deployment stack manages a group of resources as a unit. Its deny settings (none, denyDelete or denyWriteAndDelete) create a deny assignment that blocks unauthorized changes to managed resources, and up to five principals, such as a pipeline's identity, can be excluded.

• AA what-if operation for the deployment, with its output shown to reviewers

  Correct

  What-if previews how each resource will change, including deletions, before anything is deployed.

• BThe Bicep linter only, failing on any warning

  Incorrect

  The linter checks syntax and best practices in the file; it can't see what exists in Azure.

• CA full deployment to production from each pull request, rolled back if reviewers object

  Incorrect

  Deploying to production before review is the risk the team wants to remove.

• DA Bicep build that turns the files into ARM JSON for reviewers to read

  Incorrect

  Compiled JSON shows the template, not the changes it would make to live resources.

Azure Resource Manager's what-if operation shows how resources will change if you deploy a Bicep file, listing creations, modifications and deletions, at resource group, subscription, management group or tenant scope. The linter checks the file itself.

• AAzure Automation State Configuration with nodes set to apply and autocorrect

  Incorrect

  State Configuration retires on 30 September 2027, and the team is removing its Automation accounts.

• BAzure Machine Configuration assigned through Azure Policy with the Apply and Autocorrect mode

  Correct

  It audits or configures settings inside Azure and Arc-enabled machines at scale and brings them back into conformance on drift.

• CA Bicep file that sets the settings through the VM resources' properties on each deployment run

  Incorrect

  Resource properties don't cover in-guest settings, and nothing corrects later drift inside the machines.

• DA scheduled pipeline that runs a configuration script on every server each night

  Incorrect

  A nightly script leaves drift in place for up to a day and has no per-setting compliance reporting.

Azure Machine Configuration, a feature of Azure Policy, audits or configures settings inside Azure and Arc-enabled machines. Its modes are Audit, Apply and Monitor, and Apply and Autocorrect, which restores conformance when drift occurs. Azure Automation State Configuration retires on 30 September 2027, with Machine Configuration as its replacement.

• ARead the secret with an Azure CLI step and pass it with --parameters on the command line

  Incorrect

  The value passes through the pipeline and the command line, which can be logged.

• BgetSecret for a secure module parameter, with template deployment enabled on the vault

  Correct

  getSecret passes only a reference to the secret, and Resource Manager reads it when the vault allows template deployment.

• CStore the password in the .bicepparam file and mark the file as secret in the repository

  Incorrect

  A parameters file is in source control, so the password would be stored with the code.

• DOutput the password from a first module and pass the output into the SQL module

  Incorrect

  Outputs are recorded in the deployment history, which exposes the value.

Instead of entering a secure value in a Bicep file or parameters file, you can reference a Key Vault secret. The getSecret function provides it to a module parameter that has the @secure() decorator, without exposing the value; the vault must have enabledForTemplateDeployment set.

• ATemplate specs

  Correct

  A template spec stores a template as an Azure resource, with access through Azure RBAC rather than SAS tokens.

• BA public GitHub repository

  Incorrect

  Public storage exposes the templates and isn't controlled with Azure RBAC.

• CA longer SAS token lifetime

  Incorrect

  Longer tokens are a bigger risk and still aren't RBAC.

• DDeployment stacks

  Incorrect

  Stacks manage deployed resources as a group; they don't share templates for others to deploy.

Template specs store ARM templates, and Bicep compiled to them, as Azure resources for later deployment, with versions and access managed through Azure RBAC instead of SAS tokens.

• AIt describes the desired end state and lets the tool work out how

  Correct

  Declarative configuration describes what you want, not how to get there.

• BIt lists the commands to run, in order, to build the environment step by step

  Incorrect

  That's the imperative approach.

• CIt runs only once and can't be reapplied

  Incorrect

  A Bicep file can be deployed again whenever it's needed.

• DIt records changes made in the portal

  Incorrect

  Templates define resources; they don't record portal changes.

Declarative configuration describes what you want; imperative configuration describes how to achieve it.

• AAzure Deployment Stack Contributor

  Incorrect

  Stack Contributors can manage stacks but can't create or delete deny assignments.

• BAzure Deployment Stack Owner

  Correct

  Stack Owners can manage stacks, including those with deny assignments.

• CReader

  Incorrect

  Reader can't create stacks.

• DUser Access Administrator

  Incorrect

  That role manages role assignments, not deployment stacks.

Deployment stacks have two built-in roles: Azure Deployment Stack Contributor manages stacks but can't create or delete deny assignments, and Azure Deployment Stack Owner manages stacks including deny assignments.

• ATechnical debt in the application code

  Incorrect

  The differences are in server configuration, not application code.

• BConfiguration drift

  Correct

  Drift is servers diverging from their defined configuration over time through manual or ad hoc changes.

• CA deployment race condition

  Incorrect

  A race condition is a timing problem between concurrent operations.

• DA blue-green mismatch

  Incorrect

  Blue-green is a release pattern, not a name for configuration divergence.

Configuration drift happens when changes made outside the defined configuration accumulate, so environments that should match no longer do. Desired state configuration tools detect and correct it.