hardMultiple ChoiceObjective-mapped
Storing Terraform State Safely with Azure Storage State Locking
A team uses Terraform to manage Azure infrastructure. They want to store the Terraform state file securely and enable collaboration. What is the recommended approach?
Quick Answer
Storing the Terraform state file in an Azure Storage account with state locking enabled gives the team a centralized, durable backend with native locking through Azure Blob Storage leases, preventing two people from applying changes to the same state simultaneously and corrupting it. It also comes with encryption at rest and RBAC-based access control, standard practice for infrastructure-as-code.
⚠ Common exam trap
Watch out — candidates often assume Terraform Cloud is always the best remote backend, but the question specifies Azure infrastructure, and the recommended approach for Azure is the native Azure Storage backend due to its tight integration, lower latency, and no additional licensing cost.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Store the state file in an Azure Storage account with state locking enabled
Storing the Terraform state file in an Azure Storage account with state locking enabled is the recommended approach because it provides a centralized, durable backend that supports native state locking via Azure Blob Storage leases. This prevents concurrent modifications and state corruption, enabling safe collaboration among team members. Azure Storage also offers encryption at rest and access control via RBAC, aligning with security best practices for infrastructure-as-code.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Store the state file in an Azure Storage account with state locking enabled
Why this is correct
Azure Storage provides remote state with leasing for locking, ensuring consistency.
- ✗
Store the state file in a local folder and commit to Git
Why it's wrong here
Local state is not shared and committing to Git can expose secrets and cause conflicts.
- ✗
Store the state file in Terraform Cloud
Why it's wrong here
Terraform Cloud is a SaaS solution but not Azure-native; Azure Storage is the recommended backend for Azure.
- ✗
Store the state file in a Git repository with manual locking
Why it's wrong here
Git doesn't support state locking, leading to corruption.
Quick reference
Azure Blob Storage Tier Comparison
| Tier | Storage Cost | Retrieval Cost | Latency | Use Case |
|---|---|---|---|---|
| Hot | Highest | Lowest | Immediate | Active data, frequent reads |
| Cool | Lower | Higher | Immediate | Data accessed < once / month |
| Cold | Lower still | Higher | Immediate | Data accessed < once / quarter |
| Archive | Lowest | Highest + rehydration delay | Hours | Long-term compliance retention |
Go deeper
Related to this question
Learn chapter
Introduction to DevOps and Azure DevOps
Key term
Least privilege
Least privilege is a security principle that means giving users, systems, or programs only the minimum permissions they need to do their job and nothing more.
Key term
IaC
Infrastructure as Code (IaC) manages and provisions IT infrastructure through machine-readable definition files, rather than manual hardware configuration.
About these practice questions
One of 823 original AZ-400 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on AZ-400
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Your organization uses Azure Pipelines to manage infrastructure as code with Terraform. The pipeline runs terraform plan and apply. You need to ensure that the state file is stored securely and can be locked to prevent concurrent modifications. What should you configure?
hard- A.Store the state file in a Git repository with LFS.
- ✓ B.Use the Terraform Cloud backend with remote operations.
- C.Store the state file in Azure Pipelines secure files.
- ✓ D.Use an Azure Storage account as the backend with a container for the state file.
Why B: Both Azure Storage backend (D) and Terraform Cloud backend (B) satisfy the requirement of secure state storage and locking. Azure Storage uses blob leases; Terraform Cloud uses its own locking mechanism. The original explanation only justifies D but does not explain why B is incorrect, and it cannot be considered incorrect as written.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-400 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-400 exam.