AZ-400 Develop a security and compliance plan Practice Question
A company's Azure DevOps project uses a custom agent pool with self-hosted agents. The security team discovers that pipeline runs can access secrets stored in Azure Key Vault, but the team wants to ensure that secrets are only accessible to approved pipelines. Which configuration should the team implement?
⚠ Common exam trap
The real trap is confusing Azure RBAC on the Key Vault with Azure DevOps pipeline permissions. RBAC controls access to the key vault itself, while pipeline permissions control which pipelines can read the variable group. Note that variable groups do not support approval checks or branch filters; those are features of other protected resources.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use a library variable group linked to Key Vault and configure pipeline permissions with branch control.
The correct configuration is to create a library variable group linked to Azure Key Vault and then use pipeline permissions to grant access only to approved pipelines. This restricts secret access at the pipeline level. Branch-specific restrictions are not available on variable groups; to limit access by branch, the pipeline YAML must conditionally include the variable group (e.g., using an `if` expression based on the source branch) or separate pipelines must be used.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Use a library variable group linked to Key Vault and configure pipeline permissions with branch control.
Why this is correct
A library variable group linked to Azure Key Vault centralizes secret storage, and configuring pipeline permissions with branch controls and approval checks ensures only approved pipelines on specific branches can retrieve those secrets. This provides granular, auditable, and policy-driven secret governance, making it the correct security approach.
- ✗
Store secrets directly in pipeline variables and use 'Make secrets available to all pipelines' setting.
Why it's wrong here
Storing secrets directly in pipeline variables and enabling 'Make secrets available to all pipelines' exposes them to every pipeline in the project, eliminating any per-pipeline or branch-level approvals. This widens the attack surface and bypasses the centralized Key Vault integration that enforces controlled secret access.
- ✗
Assign pipeline-level permissions to the Key Vault using Azure RBAC.
Why it's wrong here
Azure RBAC does not support assigning permissions directly to a pipeline; it applies to security principals such as users, groups, service principals, or managed identities. Pipeline secret access is mediated through variable groups or service connections, so this option is technically invalid and does not protect the Key Vault contents.
- ✗
Limit the number of agents in the custom agent pool.
Why it's wrong here
Limiting the number of agents in the custom agent pool only affects parallelism and job scheduling capacity; it does not influence identity or authorization for secret access. Agent pool size is unrelated to the pipeline-level permissions and branch controls that govern access to variable groups and secrets.
Go deeper
Related to this question
Learn chapter
Introduction to DevOps and Azure DevOps
Key term
Agent
An agent is a software component that runs on a local machine to perform automated tasks, collect data, or execute commands as part of a larger system like CI/CD or monitoring.
Key term
Variable group
A variable group is a reusable collection of key-value pairs in Azure DevOps that can store configuration settings and secrets, shared across multiple pipelines.
About these practice questions
This AZ-400 question is part of Courseiva's 823-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-400 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-400 exam.