Question 450
After the team applies this response: Configure workload identity federation or managed identity where supported and scope the target permissions to deployment needs. In the situation—A GitHub workflow needs to publish to an Azure resource but uses a long-lived service-principal secret in repository settings. Which evidence BEST demonstrates the response is effective?
Explanation
Correct Answer
This evidence directly verifies the proposed control under the stated failure scenario: Inspect the federated credential claims and run an authorized deployment without storing a long-lived secret. The governing engineering principle is: Workload federation reduces persistent credential exposure when token audience, issuer and subject are constrained.
Incorrect Answers
A test report is useful only when failing assertions are reliably enforced by the pipeline controller. The needed step here is to inspect the federated credential claims and run an authorized deployment without storing a long-lived secret.
Artifact retention must preserve operational recovery and evidence while controlling unnecessary storage. The appropriate remedy is to inspect the federated credential claims and run an authorized deployment without storing a long-lived secret.
Pipeline migration should preserve effective controls and dependencies, not merely convert script text. Instead, the response must inspect the federated credential claims and run an authorized deployment without storing a long-lived secret.






Designing and Implementing Microsoft DevOps Solutions (AZ-400) Practice Tests