Microsoft DevOps Engineer Expert AZ-400 Practice Question

In Azure DevOps, you run a self-hosted build agent on an Azure virtual machine that has a system-assigned managed identity with Contributor rights to the subscription. You must enable all pipelines in a project to deploy Bicep templates to the subscription without storing any credentials in Azure DevOps. Which configuration should you create?

Create an Azure Resource Manager service connection that automatically generates a new service principal secured by a client secret.
Create a GitHub service connection authenticated with a project-level personal access token scoped to all repositories.
Create an Azure Kubernetes Service (AKS) service connection that uses a Kubernetes service account and kubeconfig file.
Create an Azure Resource Manager service connection that authenticates with the agent's system-assigned managed identity and scope it to the agent pool.

Report Issue

Answer Description

An Azure Resource Manager service connection can authenticate by using the managed identity of the self-hosted agent that resides in the target subscription. Because the identity is already trusted by Azure AD, no client secret or certificate is stored in Azure DevOps, satisfying the requirement to avoid storing credentials. A Kubernetes service connection, a GitHub service connection that relies on a personal access token, or an Azure Resource Manager connection that uses a new service principal secured by a secret would all store credentials in Azure DevOps and therefore do not meet the requirement.

Ask Bash

Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.