AZ400-Q: identify the exact release source
A build artifact version
2.4.0was deployed. Auditors need a stable source reference for the code that produced it. What should the release process record?
- A) An immutable Git tag or commit SHA linked to the artifact and deployment evidence. ✓
- B) The developer’s current local branch name only.
- C) The latest commit on
mainat audit time. - D) An unversioned screenshot of the pipeline.
Answer: A. An immutable tag or commit SHA identifies a specific source state and can be linked to the artifact and deployment.
Why not the others: Local branches and current main can change. Screenshots are weak evidence.