AZ-400 Question 53
Single answerYou want to trigger a third-party build system every time new code is pushed to the main branch of an Azure Repos repository in Azure DevOps. The build system provides an HTTPS endpoint that requires a shared secret to validate incoming requests. Which of the following approaches correctly configures a secure webhook integration in Azure DevOps?
- A
Create a Service Hook subscription in Project Settings → Service Hooks for the 'code pushed' event, limit it to the main branch, and provide the HTTPS endpoint with the shared secret in the subscription settings.
- B
Enable Continuous Deployment (CD) in the repository's Pipeline settings, then configure the Delivery tab to supply the shared secret and target endpoint so the build system is triggered on each push.
- C
Configure GitHooks directly from the Repository Settings page to send push notifications to the external HTTPS endpoint, specifying the shared secret under the repository security controls.
- D
Add the external build system endpoint in Organization Settings → Authentication, then enable 'Automatically trigger external systems' for the main branch in the repository's Branch Policies.
Show answer and explanation
Correct answer: A
Explanation
To securely integrate Azure DevOps with an external service via webhooks, you use the Service Hooks feature in Project Settings. After choosing the 'code pushed' event and filtering on the main branch, you specify the external HTTPS endpoint and embed the shared secret during configuration. This ensures only valid, authenticated push events are received by the external build system. Refer to the official Microsoft documentation on Service Hooks at https://learn.microsoft.com/azure/devops/service-hooks/ for more details and best practices.
- A. Correct.
CORRECT: In Azure DevOps, you set up a webhook by creating a Service Hook subscription for the relevant event�in this case, 'code pushed'�and specifying branch filters. You also include the shared secret in the subscription's configuration so the external system can validate incoming requests.
- B. Incorrect.
INCORRECT: While Continuous Deployment can be enabled for pipelines, it doesn't automatically configure a webhook (Service Hook). CD focuses on automating deployments rather than directly hooking into external systems via a secret token.
- C. Incorrect.
INCORRECT: Azure DevOps does not support configuring GitHooks directly at the repository level for external endpoints and secrets in this manner. Service Hooks or Web Hooks within the Service Hooks framework is the correct approach.
- D. Incorrect.
INCORRECT: Organization Settings → Authentication is not the correct path for creating a webhook or specifying branch-based triggers. Branch Policies do not transmit push events to external services; they enforce code quality and approval checks.