easyMultiple ChoiceObjective-mapped
AZ-400 Practice Question: A DevOps engineer needs to ensure that only…
A DevOps engineer needs to ensure that only approved Azure Resource Manager (ARM) templates are used for deployments. They want to enforce this at the subscription level. Which Azure service should they use?
⚠ Common exam trap
Many candidates confuse Azure Policy with Azure RBAC, thinking that role-based access can restrict template content, when in fact RBAC only controls who can deploy, not what they deploy.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure Policy
Azure Policy is the correct service because it allows you to create, assign, and manage policies that enforce specific rules on your Azure resources. You can define a custom policy to audit or deny resources that do not contain metadata indicating they were deployed from an approved ARM template. Azure Policy evaluates all resource creation and update requests against these rules, blocking or auditing non-compliant deployments at the subscription level. RBAC only controls who can deploy, not what is deployed; Azure Blueprints packages templates but does not enforce their exclusive use.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Azure Role-Based Access Control (RBAC)
Why it's wrong here
Azure RBAC governs who can perform actions on resources based on identity and role assignments, but it does not inspect the content or version of ARM templates being deployed. It controls authorization to deploy, not what is deployed, so it cannot enforce that only approved template versions are used.
- ✓
Azure Policy
Why this is correct
Azure Policy can evaluate ARM template properties during deployment and deny or audit resources that do not comply with defined rules, such as allowed template versions or specific resource types. This enables enforcing approved templates across the enterprise by blocking non-compliant deployment attempts.
- ✗
Azure Blueprints
Why it's wrong here
Azure Blueprints packages ARM templates, policies, and role assignments into a repeatable artifact for subscription creation, but it does not inherently validate or approve the templates it deploys. Unless explicit policies are added to the blueprint, it cannot enforce that only approved template versions are used.
- ✗
Azure Management Groups
Why it's wrong here
Azure Management Groups provide hierarchical organization for subscriptions and can serve as a scope for applying policies or RBAC, but they do not themselves inspect or enforce ARM template versions. They merely define structure and policy inheritance, not deployment content validation.
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
Introduction to DevOps and Azure DevOps
Key term
DevOps
DevOps is a set of practices that combines software development (Dev) and IT operations (Ops) to shorten the development lifecycle and deliver high-quality software continuously.
Key term
Azure Policy
Azure Policy is a service in Microsoft Azure that lets you create, assign, and manage rules to ensure your resources stay compliant with your company standards and service-level agreements.
About these practice questions
This AZ-400 question is part of Courseiva's 823-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-400 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-400 exam.