AZ400-Q: prevent a pipeline-template escalation
A central pipeline template can deploy to production. Application teams may supply parameters but must not inject arbitrary shell commands or replace the production identity. How should the platform team design it?
- A) Expose typed, allowlisted parameters; keep privileged steps and service connections inside the protected template/environment; restrict who can change the template. ✓
- B) Accept a free-form
scriptparameter and trust code review. - C) Give every application repository write access to the template repository.
- D) Put the production credential in a plain-text YAML variable.
Answer: A. Reusable pipeline components are supply-chain boundaries. Restricting inputs, identities, and template changes prevents untrusted callers from turning a shared template into arbitrary privileged execution.
Why not the others: Free-form script injection and broad write access defeat the boundary. Plain-text credentials are exposed secrets.
Related
pipeline-templates · pipeline-security · devops-platform-authentication