AZ-400 Question 91
Single answerYou have an Azure DevOps Git repository where sensitive information was accidentally committed and pushed several weeks ago. This data is present in multiple historical commits. You must remove every trace of the sensitive file from the entire commit history while minimizing the disruption to your ongoing work. Which approach should you use?
- A
A) Add the file to .gitignore and commit the updated .gitignore to the repository.
- B
B) Use a Git history rewrite tool (such as git filter-branch or BFG Repo-Cleaner) to remove the file from all commits, then force-push the updated repository.
- C
C) Ask all team members to delete and re-clone the repository to ensure the file is no longer present.
- D
D) Use the Revert feature in Azure DevOps to revert the commit that introduced the sensitive file.
Show answer and explanation
Correct answer: B
Explanation
When sensitive data is committed to Git, simply removing or reverting the commit doesn�t remove it from the historical record. Git history rewrite tools (e.g., git filter-branch or the BFG Repo-Cleaner) are designed to remove content from earlier commits and rewrite the repository� history. Once the history is cleaned, you must force-push to permanently update the remote. According to Microsoft� best practices for Azure Repos (and Git� official documentation), this is the recommended method for ensuring sensitive data is fully removed.
- A. Incorrect.
A) Incorrect: Adding the file to .gitignore prevents future commits of that file but doesn't remove it from previous commits. The sensitive data will remain accessible in the repository history.
- B. Correct.
B) Correct: Rewriting the repository history is the recommended way to completely remove a file from all commits. Tools like git filter-branch or BFG Repo-Cleaner can remove the file from every historical commit. Afterward, a force-push is typically required to overwrite the remote history.
- C. Incorrect.
C) Incorrect: While deleting and re-cloning might remove the file from individual local copies, it doesn�t actually remove the sensitive file from the remote repository history. The file would still be accessible in earlier commits on the server.
- D. Incorrect.
D) Incorrect: Reverting undoes the changes from a particular commit, but the original file remains in the commit history. Anyone can still retrieve the file from earlier commits.