Removing a Committed Secret from a Feature Branch Before It Merges
Your organization uses GitHub Advanced Security. A developer accidentally committed a file containing production database connection strings to a feature branch. The push was not yet merged into main. What is the best way to remove the secrets from the branch history while minimizing disruption?
Quick Answer
git filter-repo is the modern, recommended tool for rewriting a branch's history to strip out a specific file — in this case, one containing production connection strings — from every commit it ever touched. A force push after the rewrite updates the remote branch with the cleaned history, purging the secret while keeping the rest of the branch's commits intact.
⚠ Common exam trap
Test-takers frequently confuse reverting a commit (which only adds a new commit and does not remove the secret from history) with rewriting history (which actually purges the secret), leading them to choose the revert option despite its failure to address the security concern.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use git filter-repo to remove the file from the branch's history, then force push the branch.
`git filter-repo` is the recommended modern tool for rewriting Git history, including removing a specific file from all commits in a branch. After rewriting the branch's history to exclude the file, a force push (`git push --force`) overwrites the remote branch, effectively purging the secret from the branch's history. This approach minimizes disruption by preserving the branch's other commits and avoiding the need to recreate the branch or lose work.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Use git filter-repo to remove the file from the branch's history, then force push the branch.
Why this is correct
git filter-repo completely removes the file from all commits, and force push updates the remote.
- ✗
Use BFG Repo-Cleaner to delete the file from the branch's history, then force push.
Why it's wrong here
BFG is effective but git filter-repo is the recommended modern tool.
- ✗
Delete the feature branch and have the developer recreate the branch without the secret file.
Why it's wrong here
This loses all commits on the branch, not just the secret.
- ✗
Revert the commit that added the file, then push the revert.
Why it's wrong here
Reverting leaves the secret in the history, accessible via git log.
Go deeper
Related to this question
Learn chapter
Designing a Security and Compliance Plan
Key term
Feature
A feature is a distinct unit of functionality that delivers value to the user, often managed and tracked throughout the software development lifecycle.
Key term
Branch
A branch is a pointer to a specific commit in a version control system that allows you to work on features or fixes in isolation from the main codebase.
About these practice questions
Courseiva writes every AZ-400 question from scratch — 823 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on AZ-400
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Your team is using Git with Azure Repos. A developer accidentally committed a large binary file to the main branch. What is the recommended way to permanently remove it from the repository history?
easy- A.Delete the file and commit the deletion
- B.Ignore the file using .gitignore
- C.Revert the commit using 'git revert'
- ✓ D.Use 'git filter-branch' to remove the file from history
Why D: `git filter-branch` (or its modern replacement `git filter-repo`) rewrites the entire repository history to permanently remove a file from all commits. This is the recommended approach when a large binary file has been committed to the main branch and must be expunged from history to reduce repository size and prevent it from being cloned by others.
Variation 2. Your team uses Git for source control. A developer accidentally committed a large binary file (500 MB) to the main branch. The push succeeded but other team members are now complaining about slow fetch times. What is the most efficient way to remove the file from the repository history?
medium- ✓ A.Use 'git filter-repo' to remove the file from history
- B.Add the file to .gitignore and push again
- C.Use 'git revert' to undo the commit
- D.Use BFG Repo-Cleaner
Why A: 'git filter-repo' is the recommended modern tool for permanently removing large files from Git history. It rewrites the repository's commit graph, eliminating the file from all commits, which reduces repository size and resolves slow fetch times for team members. Unlike BFG Repo-Cleaner, 'git filter-repo' is actively maintained and integrates natively with Git, making it the most efficient and reliable choice for this task.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-400 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-400 exam.