AZ400-Q: prevent artifact tampering between stages
A deployment stage consumes an artifact produced by CI. The team must ensure it deploys the exact approved output rather than a replacement uploaded later. Which design is best?
- A) Download any file with the same display name from a shared folder.
- B) Rebuild in the deployment stage.
- C) Let developers manually attach a ZIP before every deployment.
- D) Promote a pipeline-produced immutable artifact with run/version provenance and restrict artifact publishing permissions. ✓
Answer: D. Immutable, provenance-linked artifacts and controlled publishing prevent an unreviewed replacement from being substituted between build and deploy.
Why not the others: Shared names, rebuilds, and manual attachments weaken artifact identity and control.