AZ400-Q: keep VM settings compliant after provisioning
Bicep creates VMs correctly, but operating-system TLS settings drift over time. The platform team needs audit and optional remediation at scale. What should it add?
- A) A pipeline comment that says “use TLS.”
- B) A storage account lock.
- C) A DNS CNAME record.
- D) Azure Machine Configuration/Policy-based desired-state assignment with compliance reporting and the appropriate enforcement mode. ✓
Answer: D. Machine Configuration extends configuration/compliance control into the guest OS after Azure resource provisioning.
Why not the others: Comments, locks, and DNS do not manage VM guest settings.
Related
azure-machine-configuration · desired-state · configuration-drift