AZ400-Q: isolate untrusted build workloads
A self-hosted agent runs pull requests from external contributors and also deploys production. Security identifies the agent’s persistent workspace and credentials as a risk. What is the best correction?
- A) Give the agent more production permissions.
- B) Disable all pull-request builds.
- C) Separate untrusted build execution from privileged deployment runners, minimize credentials, and clean/ephemeralize workspaces where possible. ✓
- D) Store deployment secrets in repository comments.
Answer: C. Trust boundaries matter: code from untrusted PRs must not execute beside durable production credentials.
Why not the others: More privileges/comments worsen risk; disabling validation loses an important control.