AZ-400 Question 93
Select 2Your team has discovered that sensitive information (a password) was inadvertently committed to your Azure DevOps Git repository. This data must be permanently removed from every commit in the repository history. You must ensure no trace of the data remains in the commit history, while preserving all other commits. Which two actions should you take to achieve this goal?
- A
Use Git filter-branch or Git filter-repo to rewrite the repository history by removing references to the file, then force push the modified history to the remote repository.
- B
Delete the file from the latest commit on the main branch and push a normal (non-forced) update to overwrite all historical commits automatically.
- C
Use the BFG Repo Cleaner to eliminate the file from all commits, then force push the rewritten repository to the remote.
- D
Update the .gitignore file to exclude the sensitive file and commit the changes to remove it from the history.
- E
Perform an interactive rebase that drops only the commit introducing the file and push using the --no-ff option.
Show answer and explanation
Correct answers: A, C
Explanation
To permanently remove sensitive data from source control, you must rewrite commit history so that the data never appears in any commit. Tools like Git filter-branch, Git filter-repo, or the BFG Repo Cleaner provide ways to remove specific files from all commits. After modifying the local repository's history, a force push is necessary to overwrite the remote history. Simply deleting or ignoring the file in your latest commit does not remove it from older commits. For more details, consult Microsoft� documentation on rewriting Git history in Azure DevOps or the official Git documentation on removing sensitive data.
- A. Correct.
Correct. Using Git filter-branch or Git filter-repo rewrites commit history to delete references to the sensitive file. A force push is required to overwrite the history on the remote repository. This process is specifically designed to remove unwanted files from all past commits.
- B. Incorrect.
Incorrect. Simply deleting the file from the latest commit and pushing a normal update does not remove the file from prior commits. The file remains accessible if someone checks out earlier commits.
- C. Correct.
Correct. BFG Repo Cleaner is another tool that can remove sensitive files from the commit history and is often simpler to use than filter-branch. A force push is needed to replace the remote history.
- D. Incorrect.
Incorrect. Adding the file to .gitignore prevents future commits from tracking it, but it does not remove the file from past commits already stored in the repository history.
- E. Incorrect.
Incorrect. An interactive rebase removing the single commit that introduced the file does not remove scenarios where the file might have appeared in other commits (like merges). Also, force pushing remains necessary to rewrite the remote history, and interactive rebase alone may not fully scrub the file if it was changed or moved in subsequent commits.