AZ400-Q: validate an untrusted fork pull request
A public project receives a pull request from a fork. What is the safe pipeline posture?
- A) Expose all production secrets so tests behave identically.
- B) Auto-merge it if tests start.
- C) Run deployment jobs against production.
- D) Run restricted validation without privileged secrets and require trusted review before any privileged action. ✓ Answer: D. Fork code is untrusted; secrets and deployment authority must stay out of its execution context. Why not the others: The other choices expose credentials or bypass review.