AZ400-Q: prevent an unauthorized production pipeline
A team member creates a new pipeline in the same project and attempts to use the production service connection. The platform team wants only approved pipelines to deploy. Which control matters most?
- A) Put “production only” in the connection description.
- B) Let every project contributor use every service connection.
- C) Restrict service-connection use/authorization and environment permissions to approved pipelines and identities. ✓
- D) Give the team member a larger personal access token.
Answer: C. Service connections and protected environments need explicit authorization boundaries. Repository write alone should not imply production cloud deployment permission.
Why not the others: Descriptions and broader tokens are not enforcement; open authorization defeats the requirement.
Related
subscription-connection · deployment-environment · pipeline-security