AZ400-Q: separate pipeline controls
A team stores a GitHub Actions workflow in its repository. Every pull request must run unit tests. A deployment to production must require an operations approval. Build artifacts must remain available for 30 days for incident investigation. Which design best meets all three requirements?
- A) Put a
production=truerepository variable in the workflow and keep every run forever. - B) Trigger tests on pull requests, use a protected production environment for the deployment job, and set an artifact retention policy that meets 30 days. ✓
- C) Store a production credential as a repository secret; secrets require approval before use.
- D) Require a pull-request review and let the workflow deploy on every push to
mainwithout an environment.
Answer: B. Pull-request triggers and required checks protect integration. A protected deployment environment applies approval and checks at the production deployment boundary. Artifact retention preserves evidence for the required period. These are independent controls.
Why the others fail: A variable does not protect an environment and indefinite retention is not a policy. A secret is an authentication mechanism, not an approval gate. A PR review approves code; it does not necessarily approve each production deployment.