A repository accepts external pull requests. Its build runner can also deploy directly into production with a standing credential. Which change best reduces supply-chain impact?

Choose the single best answer.

A.Retain unrestricted deployment rights and add longer log retention
B.Trust all contributors to a familiar repository without separate release controls
C.Isolate untrusted builds from production credentials and grant release authority only through the approved deployment path
D.Encrypt the production credential but let every pull-request job decrypt it

Show the answer and explanation

✓ Correct answer

Isolate untrusted builds from production credentials and grant release authority only through the approved deployment path

Separate trust/execution and scoped release authority restrict attacker-controlled builds. Encryption is insufficient when untrusted jobs can decrypt, retained logs do not remove deployment privilege, and familiar hosting does not establish trustworthy contributions.

Read the source reference

Read and review here, or open the app to practise and save your results on this device.

Practise in the app

Unofficial study material. Not affiliated with or endorsed by Microsoft. These are original learning questions, not actual exam questions. Product capabilities and exam objectives can change; verify current Microsoft documentation. Practice scores do not predict or guarantee an exam result.