Microsoft DevOps Engineer Expert AZ-400 Practice Question
You need to create a new YAML pipeline in Azure DevOps that builds code stored in a private GitHub Enterprise Cloud repository. The solution must meet the following requirements:
The pipeline must run automatically for every push and pull-request to the main branch.
Azure DevOps must be able to fetch sources without storing any user-scoped Personal Access Tokens (PATs).
The GitHub organization blocks authorization of external OAuth apps but allows installation of GitHub Apps.
In Azure DevOps, which action should you perform first to satisfy all the requirements?
Create a service connection of type GitHub and authenticate with a user PAT that has repo and admin:repo_hook scopes.
Mirror the GitHub repository into Azure Repos Git and configure the pipeline to use the mirrored repository as its source.
Create a service connection of type External Git that clones the repository over SSH using a read-only deploy key.
Create a GitHub service connection that uses GitHub App authentication and install the Azure Pipelines GitHub App in the ContosoGit organization.
Using the built-in Azure Pipelines GitHub App is the recommended and most secure integration method. When you create a GitHub service connection that authenticates through the Azure Pipelines GitHub App and then install that app into the GitHub organization, Azure DevOps can:
Clone the repository and register webhooks without storing any user PATs (the app uses its own installation token that Azure DevOps requests on demand).
Receive events for pushes and pull-requests so that YAML triggers (for example, trigger: and pr:) work automatically.
Comply with organizations that disallow external OAuth apps, because GitHub Apps are installed rather than granted user consent.
SSH deploy keys (choice involving External Git) do not raise pull-request events and would require manual webhook wiring. A user PAT (choice involving PAT) is disallowed by policy and would store a long-lived secret. Mirroring the repository to Azure Repos (choice involving mirroring) circumvents the requirement to build directly from GitHub and removes real-time PR validation.
Ask Bash
Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.
What is GitHub App authentication?
Open an interactive chat with Bash
How do you install the Azure Pipelines GitHub App in a GitHub organization?
Open an interactive chat with Bash
What are YAML triggers and how do they work in Azure Pipelines?
Open an interactive chat with Bash
Microsoft DevOps Engineer Expert AZ-400
Design and implement build and release pipelines
Your Score:
Report Issue
Bash, the Crucial Exams Chat Bot
AI Bot
Loading...
Loading...
Loading...
Pass with Confidence.
IT & Cybersecurity Package
You have hit the limits of our free tier, become a Premium Member today for unlimited access.
Military, Healthcare worker, Gov. employee or Teacher? See if you qualify for a Community Discount.
Monthly
$19.99
$19.99/mo
Billed monthly, Cancel any time.
3 Month Pass
$44.99
$14.99/mo
One time purchase of $44.99, Does not auto-renew.
MOST POPULAR
Annual Pass
$119.99
$9.99/mo
One time purchase of $119.99, Does not auto-renew.
BEST DEAL
Lifetime Pass
$189.99
One time purchase, Good for life.
What You Get
All IT & Cybersecurity Package plans include the following perks and exams .