A developer who can change a production app cannot directly read its secrets. The app’s identity can read sensitive data. What risk should the architect assess?

Choose the single best answer.

A.Secret-reader permissions are the only relevant access boundary
B.Private ingress prevents any malicious deployed code from reading data
C.WAF inspection proves the deployment artifact is trusted
D.Deployment rights can let the developer execute code under the app’s identity

Show the answer and explanation

✓ Correct answer

Deployment rights can let the developer execute code under the app’s identity

Deployment authority can become access through code running as the app identity. Direct secret-reading permission is not the only route. Private ingress does not constrain trusted code’s service permissions. WAF does not establish deployment provenance.

Read the source reference

Read and review here, or open the app to practise and save your results on this device.

Practise in the app

Unofficial study material. Not affiliated with or endorsed by Microsoft. These are original learning questions, not actual exam questions. Product capabilities and exam objectives can change; verify current Microsoft documentation. Practice scores do not predict or guarantee an exam result.