Question 741 of 823
AZ-400 Practice Question: Design and implement build and release pipelines
Your team is using GitHub Actions to deploy a containerized application to Azure Kubernetes Service (AKS). You need to securely authenticate the workflow to AKS without storing credentials in the repository. What should you use?
⚠ Common exam trap
Many candidates confuse the GITHUB_TOKEN (which is for GitHub API calls) with an Azure authentication token, or they assume that storing a service principal password as a secret is acceptable, missing the security and compliance benefits of OIDC-based federated identity.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use OpenID Connect (OIDC) with a federated identity credential.
OpenID Connect (OIDC) allows GitHub Actions to exchange a short-lived token for Azure credentials using a federated identity credential, eliminating the need to store any long-lived secrets in the repository. This is the recommended approach for secure, passwordless authentication to Azure services, including AKS, because it uses token-based authentication that automatically rotates and is scoped to specific workflows.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Use OpenID Connect (OIDC) with a federated identity credential.
Why this is correct
OpenID Connect (OIDC) with a federated identity credential is the recommended approach because it eliminates static secrets: GitHub Actions exchanges a short-lived token with Azure AD, and Azure trusts the federated identity without requiring you to store any passwords or client secrets. This provides passwordless, rotation-free authentication that is more secure and easier to manage.
- ✗
Use the GITHUB_TOKEN to authenticate to Azure.
Why it's wrong here
The GITHUB_TOKEN is specifically scoped to GitHub API operations such as creating issues, pull requests, or releases; it carries no permissions on Azure resources. Attempting to use it for Azure authentication will fail because Azure AD does not recognize it, and it cannot be used to obtain an Azure access token.
- ✗
Use an SSH deploy key to authenticate to AKS.
Why it's wrong here
An SSH deploy key is designed for authenticating to GitHub repositories to clone or push code, not for authentication to Azure or AKS. AKS cluster authentication requires either a kubeconfig with Kubernetes credentials or Azure AD/RBAC integration, so an SSH key does not provide any access to cluster resources.
- ✗
Store an Azure service principal password as a GitHub secret.
Why it's wrong here
Storing an Azure service principal password as a GitHub secret is technically possible and will authenticate, but it introduces a long-lived static credential that must be stored, rotated, and protected. In contrast, OIDC avoids this by using short-lived tokens, making it the more secure option for GitHub Actions deployments.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Last reviewed: Jul 4, 2026
This AZ-400 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-400 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.