AZ400-Q: secure a webhook integration
A repository webhook creates a work item in another system after a pull request merges. The receiving endpoint sometimes receives duplicate deliveries. Which design is required?
- A) Accept every request because it came from the internet.
- B) Verify the webhook signature, record delivery identifiers, and make processing idempotent so retries and duplicates do not create duplicate work. ✓
- C) Disable retries permanently.
- D) Give the endpoint an Owner role in Azure.
Answer: B. Webhook consumers must authenticate the sender and handle retries/duplicates safely. Idempotency makes repeating a delivery harmless.
Why not the others: Unverified requests permit spoofing. Disabling retries loses resilience. Azure Owner is unrelated to webhook processing.
Related
devops-collaboration-integration · webhooks · devops-traceability