Practice question 487 of 498 · hard
A software supplier contributes code through pull requests. The enterprise uses GitHub Actions federation, but the federated identity accepts every branch and the build job can update production infrastructure. Audit streaming is already healthy. Which change best reduces the remaining supply-chain path while retaining automated deployment?
Choose the single best answer.
Show the answer and explanation
✓ Correct answer
- Bind production federation to a protected approved workflow and environment, and narrow its deployment scope
Bind production federation to a protected approved workflow and environment, and narrow its deployment scope: Federation removes a stored secret, but its trust conditions and permissions still need to restrict the production path. Keep the broad federation trust and retain audit events for longer: Evidence is useful but leaves untrusted build execution able to change production. Replace federation with a shared production Owner secret: A standing shared secret does not resolve the broad authority and increases exposure. Add an internet WAF while keeping unrestricted build-to-production access: A web-edge control does not constrain authenticated deployment operations. Permit production access to all pull-request jobs if dependency scanning passes: Dependency findings cannot establish trust in arbitrary workflow code.
Read and review here, or open the app to practise and save your results on this device.
Unofficial study material. Not affiliated with or endorsed by Microsoft. These are original learning questions, not actual exam questions. Product capabilities and exam objectives can change; verify current Microsoft documentation. Practice scores do not predict or guarantee an exam result.