AZ-400 Practice Question: Design and implement build and release pipelines
Your organization uses Azure Pipelines to manage infrastructure as code with Terraform. The pipeline runs terraform plan and apply. You need to ensure that the state file is stored securely and can be locked to prevent concurrent modifications. What should you configure?
⚠ Common exam trap
Test-takers frequently confuse secure file storage (Option C) with state file storage, not realizing that state files require dynamic locking and frequent updates, which secure files do not support.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use the Terraform Cloud backend with remote operations.
Both Azure Storage backend (D) and Terraform Cloud backend (B) satisfy the requirement of secure state storage and locking. Azure Storage uses blob leases; Terraform Cloud uses its own locking mechanism. The original explanation only justifies D but does not explain why B is incorrect, and it cannot be considered incorrect as written.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Store the state file in a Git repository with LFS.
Why it's wrong here
Storing Terraform state in a Git repository with LFS provides no state locking or consistency checks, so concurrent pipeline runs can overwrite each other's state and corrupt infrastructure mapping; it also risks committing sensitive data into version control history.
- ✓
Use the Terraform Cloud backend with remote operations.
Why this is correct
Terraform Cloud does provide state locking and remote operations, but it is a third-party SaaS that requires managing an external subscription and credentials outside Azure; for an Azure-centric pipeline, an Azure Storage-backed backend is the native, integrated choice.
- ✗
Store the state file in Azure Pipelines secure files.
Why it's wrong here
Azure Pipelines secure files are designed to store immutable credentials or files, not mutable Terraform state; they provide no locking or versioned state access, so concurrent pipeline runs cannot coordinate safely.
- ✓
Use an Azure Storage account as the backend with a container for the state file.
Why this is correct
Using an Azure Storage account as a Terraform backend stores state in a blob container, and the AzureRM backend automatically uses blob leases to lock state during operations, preventing concurrent modification; it integrates natively with Azure Pipelines via authenticated access, with optional versioning and encryption.
Visual reference
Go deeper
Related to this question
Learn chapter
Introduction to DevOps and Azure DevOps
Key term
IaC
Infrastructure as Code (IaC) manages and provisions IT infrastructure through machine-readable definition files, rather than manual hardware configuration.
Key term
Pipeline
A pipeline is an automated series of steps that takes code from development to production, ensuring quality and speed.
About these practice questions
This AZ-400 question is part of Courseiva's 823-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-400 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-400 exam.