AZ400-Q: handle a signing certificate in CI
A mobile build needs a signing certificate during packaging. The certificate must not be committed to the repository or exposed in logs. Which design is best?
- A) Encode the certificate in a YAML variable.
- B) Attach the certificate to the pull-request description.
- C) Store it in the platform’s protected secure-file/secret mechanism, authorize only the required pipeline, download it only for the job, and remove it after use. ✓
- D) Put it in the published build artifact for future builds.
Answer: C. Sensitive files need protected storage, narrow pipeline access, controlled job-time use, and no log/artifact exposure.
Why not the others: YAML, PRs, and artifacts are inappropriate locations for a private signing certificate.