AZ-400 Question 92
Single answerYou are a DevOps engineer at a company where a sensitive file containing API credentials was accidentally committed to a Git repository. You have removed the file from the current commit, but the credentials still appear in previous commits. What is the recommended way to remove all traces of the sensitive data from the entire commit history before pushing the changes to your remote repository?
- A
Use Git's 'revert' command on the commit containing the credential file and push normally
- B
Use Git's 'filter-branch' or the BFG Repo-Cleaner to rewrite the repository history and force push
- C
Use Git's 'log --remove' command to remove references to the file in previous commits
- D
Remove the file from local history only, then merge the changes into the remote repository
Show answer and explanation
Correct answer: B
Explanation
When sensitive information has been committed to a Git repository, simply deleting the file from the latest commit is insufficient because it remains in earlier commits. The correct procedure is to rewrite commit history using tools like 'git filter-branch' or the BFG Repo-Cleaner to irreversibly remove the file from past commits. After rewriting history, a force push is usually required to replace the remote history with the cleaned local version. Microsoft� documentation and Git best practices recommend these approaches to ensure the data is fully removed from source control.
- A. Incorrect.
Option 1: 'revert' creates a new commit that undoes changes but does not remove the file from older commits. The sensitive file remains accessible in the commit history.
- B. Correct.
Option 2: Using 'filter-branch' or the BFG Repo-Cleaner is the recommended method to rewrite commit history and remove sensitive data. This approach cleans the file from previous commits. A force push is typically required to replace the remote history.
- C. Incorrect.
Option 3: There is no 'log --remove' command in Git to purge files from commit history. Git log merely displays commits and cannot remove data from past commits.
- D. Incorrect.
Option 4: Removing the file only in your local history and then merging does not remove the file from the remote repository's commit history. Sensitive data would still be accessible through the remote's original commits.