Microsoft DevOps Engineer Expert AZ-400 Practice Question

Your organization hosts all source code in GitHub Enterprise Cloud and needs to implement continuous delivery to multiple Azure Kubernetes Service (AKS) clusters in different Azure subscriptions. The security team requires that no long-lived credentials be stored in the pipeline platform and that deployment jobs support branch protection rules with manual approvers for production promotions. You need the simplest solution that meets these requirements without adding another SaaS product. Which deployment automation option should you choose?

Rely on GitHub webhooks to trigger kubectl deployment scripts executed from developers' workstations.
Create multi-subscription service connections in Azure Pipelines hosted in Azure DevOps Services.
Implement deployment workflows by using GitHub Actions and OIDC-based federated credentials to Azure.
Adopt a third-party continuous delivery platform that integrates with both GitHub and Azure AD.

Report Issue

Answer Description

GitHub Actions natively supports OpenID Connect (OIDC) federation with Azure AD, allowing workflows to request short-lived access tokens for each run instead of storing service-principal secrets. GitHub environments and required reviewers provide gated approvals that integrate with branch protection rules. Because the source code already resides in GitHub Enterprise Cloud, using GitHub Actions avoids introducing Azure DevOps or another external service while meeting both the security and governance requirements. Azure Pipelines would require adding another service; classic GitHub webhooks alone do not offer pipeline automation; third-party CD tools add unnecessary complexity.

Ask Bash

Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.