Design and implement build and release pipelines →mediumMultiple Choice

AZ-400 Practice Question: Design and implement build and release pipelines

Exhibit

Refer to the exhibit.

```json
{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "location": {
      "type": "string",
      "defaultValue": "[resourceGroup().location]"
    },
    "vmName": {
      "type": "string"
    }
  },
  "resources": [
    {
      "type": "Microsoft.Compute/virtualMachines",
      "apiVersion": "2021-03-01",
      "name": "[parameters('vmName')]",
      "location": "[parameters('location')]",
      "properties": {
        "hardwareProfile": {
          "vmSize": "Standard_DS2_v2"
        },
        "osProfile": {
          "computerName": "[parameters('vmName')]",
          "adminUsername": "azureuser",
          "adminPassword": "P@ssw0rd123!"
        }
      }
    }
  ]
}
```

Refer to the exhibit. You are reviewing an ARM template used in an Azure Pipeline deployment. Which security concern should you address?

⚠ Common exam trap

The trap is that candidates focus on technical template correctness (apiVersion, VM size, defaults) rather than the security anti-pattern — the exam expects you to spot the hardcoded credential as the priority security issue.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The admin password is hardcoded in the template

Hardcoding an admin password directly in an ARM template exposes credentials in source control, pipeline logs, and deployment history, creating a serious security vulnerability. The correct remediation is to reference a secret from Azure Key Vault or use a secure parameter, not to embed the value. This is the security concern the question asks you to identify.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The VM size is too small for production
Why it's wrong here
Selecting a VM size is an operational capacity decision, not a security control. Even a small SKU can be hardened with proper network security groups, identity management, and encryption, so the size alone does not introduce a vulnerability or violate ARM template security best practices.
✗
The apiVersion is outdated
Why it's wrong here
The apiVersion 2021-03-01 is a valid and supported version for Microsoft.Compute virtual machines, and using a newer apiVersion does not automatically improve security. API version mismatch or deprecation may cause deployment failures, but it is not a credential exposure or security misconfiguration.
✓
The admin password is hardcoded in the template
Why this is correct
Hardcoding the admin password as a plaintext string in the ARM template or its default parameters exposes the secret to anyone with read access to the source repository or deployment history. The template should accept the password via a secureString parameter and reference an Azure Key Vault secret, or use a managed identity and guest configuration to set credentials without embedding them.
✗
The location parameter has a default value
Why it's wrong here
Giving the location parameter a default value of the resource group's location is a common practice that improves deployment usability. It does not expose sensitive data, weaken access control, or alter authentication, so it is not a security issue in the context of template review.

Go deeper

AZ-400 Practice Question: Design and implement build and release pipelines

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question