An external deployment pipeline supports OpenID Connect and must access Azure without storing a long-lived client secret. Which two controls should its identity design include? Select 2 answers.

Select all that apply. Every correct option and no extras are required for credit in the app.

A.Store a reusable human password as the federation token.
B.Configure workload identity federation with matching issuer, subject, and audience trust.
C.Accept any external subject from any issuer.
D.Grant narrowly scoped target permissions to the workload's Entra identity.
E.Assume token exchange grants subscription Owner automatically.

Show the answer and explanation

✓ Correct answers

Configure workload identity federation with matching issuer, subject, and audience trust.
Grant narrowly scoped target permissions to the workload's Entra identity.

Federation exchanges a matching trusted external token, while authorization remains a separate least-privilege grant. Unrestricted issuer or subject trust broadens impersonation opportunities. Human passwords are not a substitute for the configured token trust, and exchange does not automatically grant Owner. Source: AZ-305 Study Guide.pdf, PDF page(s) 15.

Read the source reference

This item is flagged for content review.

Read and review here, or open the app to practise and save your results on this device.

Practise in the app

Unofficial study aid; not affiliated with or endorsed by Microsoft. Original practice questions are not real examination questions and do not guarantee an exam result.