AZ-400 Configure processes and communications Practice Question
Your team uses GitHub Actions for CI/CD. You need to ensure that secrets used in workflows are automatically rotated every 90 days. What is the best approach?
⚠ Common exam trap
Many exam-takers confuse OIDC with secret management, assuming it provides rotation capabilities, when in fact OIDC only handles authentication without any secret lifecycle management.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use a script that calls the GitHub API to update the secret and run it in a scheduled workflow.
It uses the GitHub API within a scheduled workflow to programmatically rotate secrets, ensuring automation without manual intervention. This approach directly addresses the requirement for automatic rotation every 90 days by generating new secret values and updating the repository or organization secrets via the API.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use OpenID Connect (OIDC) to authenticate.
Why it's wrong here
OpenID Connect (OIDC) eliminates the need to store long-lived cloud credentials by using short-lived tokens, but it does not rotate or manage existing secrets already stored in GitHub. It changes the authentication mechanism for workflows, not the lifecycle of existing repository or environment secrets, so it cannot fulfill a requirement to rotate secrets periodically.
- ✓
Use a script that calls the GitHub API to update the secret and run it in a scheduled workflow.
Why this is correct
Automating rotation with a scheduled GitHub Actions workflow that calls the GitHub API is the correct approach: the workflow can generate a new secret value, call the Secrets API (for repository or environment secrets), and update the secret on a defined cadence. This ensures secrets are rotated programmatically without manual intervention, aligning with the requirement for automated periodic rotation.
- ✗
Manually update the secrets every 90 days.
Why it's wrong here
Manually updating secrets every 90 days is not automated and relies on human memory and action, which introduces risk of missed rotations, inconsistency, and potential exposure if the manual step is skipped. While it technically rotates secrets, it fails the requirement for an automated CI/CD-driven rotation process.
- ✗
Store secrets as environment secrets and configure expiration.
Why it's wrong here
GitHub environment secrets do not support an expiration or automatic rotation configuration; they are static key-value pairs unless updated via the API or UI. Merely storing them in environments with a configured expiration is not possible, so this option cannot ensure periodic rotation.
Go deeper
Related to this question
Learn chapter
Implementing a Release Pipeline
Key term
Repository
A repository is a central storage location where software packages, code, or configuration files are kept, managed, and distributed for use by IT systems.
Key term
GitHub
GitHub is a cloud-based platform for storing, tracking, and collaborating on code using Git version control.
About these practice questions
One of 823 original AZ-400 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-400 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-400 exam.