AZ400-Q: choose an integration identity
A service must read pull-request metadata across selected repositories and post review comments. It should not act as a human user or hold a long-lived personal token. What is the best identity pattern?
- A) A narrowly permissioned GitHub App installed only on the required repositories. ✓
- B) A shared administrator PAT with no expiry.
- C) Every developer’s personal GitHub token.
- D) Anonymous repository write access.
Answer: A. A GitHub App has its own installable identity and scoped permissions, making it more appropriate than shared human credentials for this integration.
Why not the others: Shared or personal tokens are difficult to govern and revoke. Anonymous write is unsafe.