Design and Implement a Strategy for Managing Sensitive Information in Automation AZ-400 Practice Questions (Page 9)

Questions 41–45

1. 41expert · hard

   Your GitHub Actions workflow needs to deploy to Azure. You want to use workload identity federation, but you also need to ensure that the workflow can only deploy from the main branch. Which configuration should you use?

   • AUse a certificate and restrict it to the main branch.
   • BUse a personal access token and restrict it to the main branch.
   • CConfigure the federated credential with a subject that includes the repository and branch, and add a condition in the workflow to check the branch.
   • DUse a service principal with a client secret and restrict the secret to the main branch.
   Reveal Solution Discussion Select an answer first
2. 42foundation · easy

   Which of the following is a type of item that can be stored in Azure Key Vault?

   • ANetwork security group rules
   • BVirtual machine images
   • CAzure Resource Manager templates
   • DConnection strings and passwords
   Reveal Solution Discussion Select an answer first
4. 43expert · hard

   Your GitHub Actions workflow deploys to Azure. You currently use a service principal with a client secret stored as a GitHub secret. You want to reduce the risk of secret leakage and eliminate the need to rotate the client secret. However, your security team requires that the workflow only runs from the main branch and that the authentication method does not rely on long-lived credentials. What should you do?

   • AStore the client secret in Azure Key Vault and retrieve it in the workflow.
   • BUse a GitHub environment secret for the client secret and protect the environment with a required reviewer.
   • CConfigure OpenID Connect with a federated credential that includes the main branch as a subject claim.
   • DCreate a new service principal for each deployment and store its secret in GitHub.
   Reveal Solution Discussion Select an answer first
5. 44expert · hard

   Your GitHub Actions workflow needs to authenticate to Azure using OIDC. You have configured the federated credential, but the workflow fails with an authorization error. You have verified that the workflow runs on the main branch. What is the most likely cause?

   • AThe Azure subscription is not associated with the Azure AD tenant.
   • BThe workflow does not have permission to use OIDC.
   • CThe Azure AD application does not have the required API permissions.
   • DThe subject claim in the federated credential does not match the workflow's branch or repository.
   Reveal Solution Discussion Select an answer first
6. 45foundation · easy

   Which of the following is NOT a supported method for adding a certificate to Azure Key Vault?

   • AGenerating a new certificate using Key Vault's integration with a certificate authority.
   • BCopying a certificate directly from a virtual machine's certificate store.
   • CImporting an existing certificate from a PFX file.
   • DUploading a certificate from a local file using the Azure portal.
   Reveal Solution Discussion Select an answer first