Design and implement build and release pipelines →mediumMultiple ChoiceObjective-mapped

AZ-400 Practice Question: Design and implement build and release pipelines

Exhibit

Refer to the exhibit.

```json
{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "location": {
      "type": "string",
      "defaultValue": "[resourceGroup().location]"
    },
    "vmName": {
      "type": "string"
    }
  },
  "resources": [
    {
      "type": "Microsoft.Compute/virtualMachines",
      "apiVersion": "2021-03-01",
      "name": "[parameters('vmName')]",
      "location": "[parameters('location')]",
      "properties": {
        "hardwareProfile": {
          "vmSize": "Standard_DS2_v2"
        },
        "osProfile": {
          "computerName": "[parameters('vmName')]",
          "adminUsername": "azureuser",
          "adminPassword": "P@ssw0rd123!"
        }
      }
    }
  ]
}
```

Refer to the exhibit. You are reviewing an ARM template used in an Azure Pipeline deployment. Which security concern should you address?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The admin password is hardcoded in the template

The admin password is hardcoded in plain text in the ARM template, which is a significant security vulnerability. Passwords should be stored securely using Azure Key Vault or referenced as secure parameters. Option A is incorrect because VM size is not a security concern. Option B is incorrect because the apiVersion is valid. Option D is incorrect because a default value for location is acceptable.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The VM size is too small for production
Why it's wrong here
Selecting a VM size is an operational capacity decision, not a security control. Even a small SKU can be hardened with proper network security groups, identity management, and encryption, so the size alone does not introduce a vulnerability or violate ARM template security best practices.
✗
The apiVersion is outdated
Why it's wrong here
The apiVersion 2021-03-01 is a valid and supported version for Microsoft.Compute virtual machines, and using a newer apiVersion does not automatically improve security. API version mismatch or deprecation may cause deployment failures, but it is not a credential exposure or security misconfiguration.
✓
The admin password is hardcoded in the template
Why this is correct
Hardcoding the admin password as a plaintext string in the ARM template or its default parameters exposes the secret to anyone with read access to the source repository or deployment history. The template should accept the password via a secureString parameter and reference an Azure Key Vault secret, or use a managed identity and guest configuration to set credentials without embedding them.
✗
The location parameter has a default value
Why it's wrong here
Giving the location parameter a default value of the resource group's location is a common practice that improves deployment usability. It does not expose sensitive data, weaken access control, or alter authentication, so it is not a security issue in the context of template review.

Go deeper

AZ-400 Practice Question: Design and implement build and release pipelines

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question