AZ-400 Question 229
Single answerYou are configuring permissions for a new DevOps engineer in your GitHub repository. This engineer� responsibilities include creating and pushing new branches, reviewing and merging pull requests, managing issues, and configuring secrets for continuous integration/continuous delivery (CI/CD). However, your organization wants to follow the principle of least privilege and avoid granting full administrative control. Which GitHub role should you assign to this engineer?
- A
Triage
- B
Write
- C
Maintain
- D
Admin
Show answer and explanation
Correct answer: C
Explanation
In GitHub, the Maintain role allows repository-level configuration (such as secrets and branch protection) while still supporting coding activities like pushing branches and merging pull requests. It provides the necessary privileges for DevOps tasks without granting full administrative control. Refer to GitHub� documentation on repository roles (https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/about-repository-roles) for more details.
- A. Incorrect.
Option 1 (Triage) is incorrect. The Triage role can manage issues and pull requests but cannot push new branches or configure secrets. It� too limited for the tasks required.
- B. Incorrect.
Option 2 (Write) is incorrect. Although the Write role allows pushing code and merging pull requests, it does not allow configuring repository settings such as secrets, which is needed by the new DevOps engineer.
- C. Correct.
Option 3 (Maintain) is correct. The Maintain role covers pushing and merging code, managing issues, and configuring repository-level settings like secrets, without providing the full administrative access of the Admin role.
- D. Incorrect.
Option 4 (Admin) is incorrect. While it allows all required tasks, it grants significantly more control than necessary, contradicting the principle of least privilege.