nerdexam
Microsoft

AZ-400 · Question #592

Drag and Drop Question You have an Azure DevOps project that contains a repo named Repo1. Repo1 contains Terraform code that defines the infrastructure of an app. You need to create a pipeline named P

The correct answer is - task: TerraformCLI@0 displayName: 'Run terraform init' inputs: command: init workingDirectory: $(terraformWorkingDirectory); - task: TerraformCLI@0 displayName: 'Run terraform validate' inputs: command: validate workingDirectory: $(terraformWorkingDirectory); - task: TerraformCLI@0 displayName: 'Run terraform plan' inputs: command: plan workingDirectory: $(terraformWorkingDirectory) environmentServiceName: $(ServiceConnection) commandOptions: -out=tfplan; - task: DownloadPipelineArtifact@2 inputs: artifact: plan patterns: '**/*tfplan' path: $(terraformWorkingDirectory). The correct sequence for Pipeline1 is: (1) Static Code Analysis using Checkov to immediately fail the pipeline on misconfiguration, (2) Run terraform init to initialize the working directory, (3) Run terraform plan with the -out=tfplan flag to generate a plan file, and (4) Publis

Submitted by ashley.k· Mar 6, 2026Design and implement a release strategy - specifically configuring CI pipelines for infrastructure-as-code (IaC) workflows including security scanning, Terraform plan generation, and artifact publishing in Azure DevOps (AZ-400 Domain: Develop a Security and Compliance Plan / Implement Infrastructure as Code)

Question

Drag and Drop Question You have an Azure DevOps project that contains a repo named Repo1. Repo1 contains Terraform code that defines the infrastructure of an app. You need to create a pipeline named Pipeline1 that will perform the following actions: - Immediately trigger a pipeline failure if a code misconfiguration is detected. - Publish a terraform plan artifact. Which four elements should you include in Pipeline1 in sequence? To answer, move the appropriate elements from the list of elements to the answer area and arrange them in the correct order. Answer:

Exhibit

AZ-400 question #592 exhibit

Answer Area

Drag items

- task: DownloadPipelineArtifact@2 inputs: artifact: plan patterns: '**/*tfplan' path: $(terraformWorkingDirectory)- bash: $(terraformWorkingDirectory)/checkov.sh $(terraformWorkingDirectory) displayName: Static Code Analysis- task: TerraformCLI@0 displayName: 'Run terraform plan' inputs: command: plan workingDirectory: $(terraformWorkingDirectory) environmentServiceName: $(ServiceConnection) commandOptions: -out=tfplan- task: TerraformCLI@0 displayName: 'Run terraform validate' inputs: command: validate workingDirectory: $(terraformWorkingDirectory)- task: TerraformCLI@0 displayName: 'Run terraform init' inputs: command: init workingDirectory: $(terraformWorkingDirectory)

Correct arrangement

    • task: TerraformCLI@0 displayName: 'Run terraform init' inputs: command: init workingDirectory: $(terraformWorkingDirectory)
    • task: TerraformCLI@0 displayName: 'Run terraform validate' inputs: command: validate workingDirectory: $(terraformWorkingDirectory)
    • task: TerraformCLI@0 displayName: 'Run terraform plan' inputs: command: plan workingDirectory: $(terraformWorkingDirectory) environmentServiceName: $(ServiceConnection) commandOptions: -out=tfplan
    • task: DownloadPipelineArtifact@2 inputs: artifact: plan patterns: '**/*tfplan' path: $(terraformWorkingDirectory)

Explanation

The correct sequence for Pipeline1 is: (1) Static Code Analysis using Checkov to immediately fail the pipeline on misconfiguration, (2) Run terraform init to initialize the working directory, (3) Run terraform plan with the -out=tfplan flag to generate a plan file, and (4) Publish the tfplan as a pipeline artifact. This order ensures that misconfigurations are caught before any Terraform operations run (fail fast principle), then the plan is generated and published as required. The DownloadPipelineArtifact task is incorrect here because this pipeline is responsible for publishing the artifact, not downloading it - downloading would be done in a separate release/apply pipeline. The sequence matters critically: Checkov must run first for immediate failure on misconfiguration, terraform init must precede plan, and publishing must be the final step after the plan file exists.

Topics

#Azure DevOps Pipelines#Terraform IaC#Static Code Analysis / Checkov#Pipeline Artifact Management

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full AZ-400 Practice