AZ400-Q: respond to an exposed credential
Secret scanning detects a personal access token committed to a public repository. The developer deletes the line in a follow-up commit. What must happen next?
- A) Revoke/rotate the token immediately, assess its use, remove it from history where required, and add prevention controls. ✓
- B) Close the alert because the latest commit no longer contains the token.
- C) Rename the repository.
- D) Add the token to a variable group for backup.
Answer: A. A credential may already have been copied from history, forks, logs, or caches. Revocation is the urgent containment action; history remediation and prevention follow.
Why not the others: Deleting a visible line does not invalidate a token. Renaming and duplicating the credential do not reduce exposure.