Question 463 of 823
AZ-400 Design and implement source control Practice Question
A developer accidentally committed a sensitive password to a Git repository. The commit has already been pushed to the remote. What is the first step to remediate the situation?
⚠ Common exam trap
The trap is that candidates may focus on removing the secret from history rather than recognizing that the secret is already exposed. The correct first action is always to limit the damage by revoking or rotating the compromised credential.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Immediately notify the security team and rotate the password
Once a secret is pushed to a remote Git repository, it must be considered compromised because the commit may already be fetched by others, and old commits remain in reflogs and other clones. The first step is to immediately notify the security team and rotate/revoke the password to prevent unauthorized use. Only after the credential is invalidated should you attempt to remove it from Git history (e.g., by amending, rebasing, or using filter-repo) and force push, understanding that history rewriting may not fully eliminate all copies.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Delete the file from the repository and commit the deletion
Why it's wrong here
Deleting the file from the repository and committing the deletion only removes the file from the latest commit; the password remains in all earlier commits in Git history, so anyone with repository access can still retrieve it. Git history is immutable unless rewritten, making this approach ineffective for secret removal.
- ✗
Remove the password from the file, amend the commit, and force push
Why it's wrong here
Amending the commit rewrites the latest commit by replacing it with a new one that no longer contains the password, and force pushing updates the remote branch to discard the old commit. This effectively removes the sensitive data from the visible history, provided you act before the commit is widely shared and you coordinate with any collaborators who may have pulled it.
- ✗
Revert the commit that introduced the password
Why it's wrong here
Reverting the commit creates a new commit that reverses the changes, but the original commit remains intact in the repository's history, meaning the password is still accessible to anyone who clones or browses the history. The secret must be considered compromised, so this alone does not solve the problem.
- ✓
Immediately notify the security team and rotate the password
Why this is correct
Rotating/revoking the password is a critical remediation step to prevent unauthorized use, but it does not remove the secret from source control. You must also purge the secret from Git history using tools like git filter-branch or git filter-repo, or by amending the commit as described, to fully eliminate the exposure.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Last reviewed: Jun 11, 2026
This AZ-400 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-400 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.