AZ-400 Question 228
Single answerAn engineering team is setting up an Azure DevOps pipeline to deploy containerized applications to an Azure Kubernetes Service (AKS) cluster. The pipeline must follow the principle of least privilege by having only the necessary permissions to the resource group containing the AKS cluster. The team also wants to ensure that credentials and sensitive information are not stored in source control. Which approach should the team implement to meet these requirements?
- A
Use an Azure Resource Manager service connection with a service principal that has restricted permissions on the AKS resource group.
- B
Use a personal access token (PAT) with full read/write scope in Azure DevOps, stored in a pipeline variable group.
- C
Embed administrator credentials for the Azure subscription directly in the pipeline YAML file.
- D
Grant the release pipeline Project Collection Administrator rights within Azure DevOps to ensure it can access the cluster automatically.
Show answer and explanation
Correct answer: A
Explanation
When deploying to Azure from Azure DevOps, the recommended approach is to create a service principal with only the necessary permissions for the target resources and configure an Azure Resource Manager service connection. This method securely stores authentication details in Azure DevOps and provides access only to the required resource group, reducing security risks and adhering to best practices. For more information, refer to the Microsoft documentation on 'Create an Azure Resource Manager service connection in Azure DevOps.'
- A. Correct.
Correct. An Azure Resource Manager service connection configured with a service principal that� granted only the required role for the AKS resource group follows the principle of least privilege. Using the service connection ensures credentials are stored securely in Azure DevOps, rather than in source code.
- B. Incorrect.
Incorrect. Although personal access tokens are helpful for authenticating with Azure DevOps or Git repositories, using a full-scope PAT for Azure deployments can violate least-privilege principles and create unnecessary risk. A dedicated service principal with limited permissions is more secure.
- C. Incorrect.
Incorrect. Embedding credentials in a pipeline YAML file is highly discouraged as it exposes sensitive details in source control, which significantly increases the risk of credential compromise.
- D. Incorrect.
Incorrect. Granting Project Collection Administrator rights is excessive. This role has broad permissions over the entire Azure DevOps project collection and does not follow the principle of least privilege.