Removing a Committed Secret from a Feature Branch Before It Merges
Your team uses Git for source control. A developer accidentally committed a large binary file (500 MB) to the main branch. The push succeeded but other team members are now complaining about slow fetch times. What is the most efficient way to remove the file from the repository history?
⚠ Common exam trap
Many exam-takers confuse 'git revert' (which only adds a new commit to undo changes) with history-rewriting tools like 'git filter-repo' or BFG, not realizing that only history rewriting permanently removes a file from all commits and reduces repository size.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use 'git filter-repo' to remove the file from history
'git filter-repo' is the recommended modern tool for permanently removing large files from Git history. It rewrites the repository's commit graph, eliminating the file from all commits, which reduces repository size and resolves slow fetch times for team members. Unlike BFG Repo-Cleaner, 'git filter-repo' is actively maintained and integrates natively with Git, making it the most efficient and reliable choice for this task.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Use 'git filter-repo' to remove the file from history
Why this is correct
git filter-repo is the official Git tool for history rewriting; it removes the file from every commit in the repository, thereby eliminating the sensitive data from all historical versions. It rewrites commit hashes and requires force-pushing to update remote references, but it is the recommended and safest approach for this task.
- ✗
Add the file to .gitignore and push again
Why it's wrong here
Adding the file to .gitignore only prevents future commits of that path; it does absolutely nothing to the existing commits that already contain the file, so anyone with repository access can still retrieve the sensitive content from the history. The file remains in all prior commits, and a simple checkout or clone will expose it.
- ✗
Use 'git revert' to undo the commit
Why it's wrong here
git revert creates a new commit that undoes the changes introduced by the original commit, effectively removing the file from the current working tree, but it leaves the original commit intact in history. The file can still be accessed from that earlier commit, so the sensitive data is not truly removed.
- ✗
Use BFG Repo-Cleaner
Why it's wrong here
BFG Repo-Cleaner is a third-party tool that can replace or remove files from history, but it is no longer the recommended solution; the official Git project now recommends git filter-repo, which is more maintainable, faster, and avoids the need for separate Java installations. While BFG may work, it is not the official or preferred tool for this scenario.
Visual reference
Go deeper
Related to this question
Learn chapter
Implementing and Managing Source Control
Key term
Task
A Task in Azure DevOps is a predefined, reusable step that performs a specific action during a build or release pipeline, like compiling code or running tests.
Key term
Git
Git is a version control system that tracks changes to files so multiple people can work on the same project without overwriting each other's work.
About these practice questions
Courseiva writes every AZ-400 question from scratch — 696 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on AZ-400
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Your team is using Git with Azure Repos. A developer accidentally committed a large binary file to the main branch. What is the recommended way to permanently remove it from the repository history?
easy- A.Delete the file and commit the deletion
- B.Ignore the file using .gitignore
- C.Revert the commit using 'git revert'
- ✓ D.Use 'git filter-branch' to remove the file from history
Why D: `git filter-branch` (or its modern replacement `git filter-repo`) rewrites the entire repository history to permanently remove a file from all commits. This is the recommended approach when a large binary file has been committed to the main branch and must be expunged from history to reduce repository size and prevent it from being cloned by others.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-400 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-400 exam.