AZ400-Q: remove a cloud credential from CI
A pipeline runs in Azure and currently stores a long-lived service-principal secret. What is the strongest replacement when supported?
- A) Use workload identity federation or managed identity with scoped Azure RBAC. ✓
- B) Put the secret in a YAML comment.
- C) Base64-encode the secret in the repository.
- D) Give every contributor the secret. Answer: A. Federated or managed identity avoids a stored long-lived credential and can be narrowly authorized. Why not the others: Encoding and broad sharing do not secure a secret.