hardMultiple Choice
Storing Terraform State Safely with Azure Storage State Locking
A team uses Terraform to manage Azure infrastructure. They want to store the Terraform state file securely and enable collaboration. What is the recommended approach?
Quick Answer
Storing the Terraform state file in an Azure Storage account with state locking enabled gives the team a centralized, durable backend with native locking through Azure Blob Storage leases, preventing two people from applying changes to the same state simultaneously and corrupting it. It also comes with encryption at rest and RBAC-based access control, standard practice for infrastructure-as-code.
⚠ Common exam trap
Watch out — candidates often assume Terraform Cloud is always the best remote backend, but the question specifies Azure infrastructure, and the recommended approach for Azure is the native Azure Storage backend due to its tight integration, lower latency, and no additional licensing cost.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Store the state file in an Azure Storage account with state locking enabled
Storing the Terraform state file in an Azure Storage account with state locking enabled is the recommended approach because it provides a centralized, durable backend that supports native state locking via Azure Blob Storage leases. This prevents concurrent modifications and state corruption, enabling safe collaboration among team members. Azure Storage also offers encryption at rest and access control via RBAC, aligning with security best practices for infrastructure-as-code.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Store the state file in an Azure Storage account with state locking enabled
Why this is correct
Azure Storage provides durable, centralised storage for the state file, and blob leasing delivers state locking so concurrent pipeline runs cannot corrupt it. This satisfies both the security and collaboration requirements, unlike local storage, which offers neither shared access nor locking.
- ✗
Store the state file in a local folder and commit to Git
Why it's wrong here
A local state file committed to Git gives no remote locking, so concurrent runs overwrite each other, and state contents including secrets are exposed in repository history. Local state suits a single practitioner working alone on a throwaway configuration, not a collaborating team.
- ✗
Store the state file in Terraform Cloud
Why it's wrong here
Terraform Cloud stores state remotely with locking and versioning, but the question concerns Azure infrastructure managed by a team already using Terraform; the recommended approach keeps state in an Azure Storage account backend with blob leasing, which provides the same locking and encryption within their existing cloud boundary.
- ✗
Store the state file in a Git repository with manual locking
Why it's wrong here
Git provides version history but no state locking mechanism; manual locking relies on human discipline and cannot prevent two pipelines writing state simultaneously, causing corruption. Git storage is workable only for read-only reference copies, never as the live backend for concurrent applies.
Quick reference
Azure Blob Storage Tier Comparison
| Tier | Storage Cost | Retrieval Cost | Latency | Use Case |
|---|---|---|---|---|
| Hot | Highest | Lowest | Immediate | Active data, frequent reads |
| Cool | Lower | Higher | Immediate | Data accessed < once / month |
| Cold | Lower still | Higher | Immediate | Data accessed < once / quarter |
| Archive | Lowest | Highest + rehydration delay | Hours | Long-term compliance retention |
Go deeper
Related to this question
Learn chapter
Implementing Security and Compliance in Pipelines
Key term
Least privilege
Least privilege is a security principle that means giving users, systems, or programs only the minimum permissions they need to do their job and nothing more.
Key term
IaC
Infrastructure as Code (IaC) manages and provisions IT infrastructure through machine-readable definition files, rather than manual hardware configuration.
About these practice questions
One of 696 original AZ-400 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on AZ-400
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Your organization uses Azure Pipelines to manage infrastructure as code with Terraform. The pipeline runs terraform plan and apply. You need to ensure that the state file is stored securely and can be locked to prevent concurrent modifications. What should you configure?
hard- A.Store the state file in a Git repository with LFS.
- ✓ B.Use the Terraform Cloud backend with remote operations.
- C.Store the state file in Azure Pipelines secure files.
- ✓ D.Use an Azure Storage account as the backend with a container for the state file.
Why B: Both Azure Storage backend (D) and Terraform Cloud backend (B) satisfy the requirement of secure state storage and locking. Azure Storage uses blob leases; Terraform Cloud uses its own locking mechanism. The original explanation only justifies D but does not explain why B is incorrect, and it cannot be considered incorrect as written.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-400 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-400 exam.