You have a web app named App1 that is deployed by using a GitHub Actions workflow.The workflow generates a token named token1 as part of the deployment of App1.You need to prevent token1 from being written to the workflow logs.Which workflow command should you run?
Answer(s): C
Workflow commands for GitHub ActionsYou can use workflow commands when running shell commands in a workflow or in an action's code.Masking a value in a log::add-mask::{value}Masking a value prevents a string or variable from being printed in the log. Each masked word separated by whitespace is replaced with the * character. You can use an environment variable or string for the mask's value. When you mask a value, it is treated as a secret and will be redacted on the runner. For example, after you mask a value, you won't be able to set that value as an output.Example: Masking a stringWhen you print "Mona The Octocat" in the log, you'll see "***".
https://docs.github.com/en/actions/writing-workflows/choosing-what-your-workflow-does/workflow-commands- for-github-actions
You have an existing project in Azure DevOps.You plan to integrate GitHub as the repository for the project.You need to ensure that Azure Pipelines runs under the Azure Pipelines identity.Which authentication mechanism should you use?
Azure Pipelines must be granted access to your repositories to trigger their builds, and fetch their code during builds.There are three authentication types for granting Azure Pipelines access to your GitHub repositories while creating a pipeline.GitHub app authenticationThe Azure Pipelines GitHub App is the recommended authentication type for continuous integration pipelines.After you install the GitHub App in your GitHub account or organization, your pipeline will run without using your personal GitHub identity. Builds and GitHub status updates will be performed using the Azure Pipelines identity.The app works with GitHub Checks to display build, test, and code coverage results in GitHub.
https://learn.microsoft.com/en-us/azure/devops/pipelines/repos/github
You have an Azure subscription that contains four Azure virtual machines.You need to configure the virtual machines to use a single identity. The solution must meet the following requirements:Ensure that the credentials for the identity are managed automatically.Support granting privileges to the identity.Which type of identity should you use?
Answer(s): A
Managed Service Identities are automatically managed by Azure. They enable authentication to services that support Microsoft Entra authentication, without needing to embed credentials into your code.Managed identity typesThere are two types of managed identities:* System-assigned. Some Azure resources, such as virtual machines allow you to enable a managed identity directly on the resource. When you enable a system-assigned managed identity:- A service principal of a special type is created in Microsoft Entra ID for the identity. The service principal is tied to the lifecycle of that Azure resource. When the Azure resource is deleted, Azure automatically deletes the service principal for you.* User-assigned. You may also create a managed identity as a standalone Azure resource. You can create a user-assigned managed identity and assign it to one or more Azure Resources. When you enable a user- assigned managed identity:A service principal of a special type is created in Microsoft Entra ID for the identity. The service principal is managed separately from the resources that use it.*-> User-assigned identities can be used by multiple resources.You authorize the managed identity to have access to one or more services.
https://learn.microsoft.com/en-us/entra/identity/managed-identities-azure-resources/overview
You plan to create a GitHub workflow that will use GitHub Actions. The actions will require a 256-KB secret.You need to recommend a solution to store and encrypt the secret. The secret value must be accessible only to the workflow. The solution must minimize administrative effort.What should you recommend?
Using secrets in GitHub ActionsStoring large secretsTo use secrets that are larger than 48 KB, you can use a workaround to store secrets in your repository and save the decryption passphrase as a secret on GitHub. For example, you can use gpg to encrypt a file containing your secret locally before checking the encrypted file in to your repository on GitHub.
https://docs.github.com/en/actions/security-guides/encrypted-secrets
Your company uses Azure DevOps and has a Microsoft Entra tenant.Only users who have accounts in Microsoft Entra can access the Azure DevOps environment.You need to ensure that only devices that are connected to the on-premises network can access the Azure DevOps environment.What should you do?
Answer(s): B
You can configure On-Premises Conditional Access using registered devicesEnable Microsoft Entra Device RegistrationTo configure this scenario, you must configure the device registration capability in Microsoft Entra ID.
https://learn.microsoft.com/en-us/windows-server/identity/ad-fs/operations/configure-device-based-conditional- access-on-premises
Post your Comments and Discuss Microsoft AZ-400 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the AZ-400 content, but please register or login to continue.