Microsoft DevOps Engineer Expert AZ-400 Practice Question

You are designing a GitHub Actions workflow for a private organization-owned repository. The workflow must

push code changes back to its own repository branches, and
call the GitHub REST API to open an issue in another private repository within the same organization. You must follow least-privilege principles and avoid storing long-lived credentials in the workflow file. Which authentication approach should you implement?

Add an SSH deploy key to the repository and configure the workflow to use the key for both Git operations and REST API calls.
Create a fine-grained personal access token scoped to the organization and store it as an encrypted repository secret.
Register an organization-wide GitHub App with the required minimal permissions and authenticate the workflow by requesting its short-lived installation access token at run time.
Use the automatically generated ${{ secrets.GITHUB_TOKEN }} with its default permissions.

Report Issue

Answer Description

A GitHub App that is installed at the organization level can be granted only the repository permissions the workflow needs and issues a short-lived (1-hour) installation access token at run time. The token allows the workflow to interact with any repositories where the app is installed, satisfying the requirement to create an issue in a second repository while still enabling pushes to the current repository. The automatically generated GITHUB_TOKEN is short-lived but is restricted to the single repository that contains the workflow, so it cannot access the second repository. A fine-grained personal access token can be scoped narrowly, but it is still a user-bound secret that lives for up to one year and must be stored as a secret, which violates the "avoid long-lived credentials" constraint. An SSH deploy key is limited to Git operations on the single repository to which it is added and cannot authenticate REST API calls across multiple repositories.

Ask Bash

Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.