AZ-400 A company uses Azure DevOps for CI/CD Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Use Azure App Configuration with Key Vault references

  Why it's wrong here

  Azure App Configuration with Key Vault references is designed for application runtime configuration, not for Azure Pipelines variable resolution. While it can reference Key Vault secrets, the pipeline itself cannot natively consume those references as pipeline variables without custom tasks or API calls, adding overhead and an external dependency that does not integrate with the pipeline's variable model. In contrast, a Variable Group linked to Key Vault is a first-class Azure Pipelines construct that makes secrets available directly to tasks at runtime.

• ✓

  Create a Variable Group linked to Azure Key Vault

  Why this is correct

  Creating a Variable Group linked to Azure Key Vault is the recommended approach because the Variable Group stores only references to secret names in Key Vault, not the secret values themselves. At pipeline runtime, Azure Pipelines fetches the actual secret values from Key Vault using a service connection, ensuring secrets never reside in pipeline definitions, logs, or the Azure DevOps database. This also provides centralized access control via Key Vault permissions, supports secret rotation, and integrates natively with pipeline consumers.

• ✗

  Use Azure Kubernetes Service secrets

  Why it's wrong here

  Azure Kubernetes Service (AKS) secrets are designed to store sensitive configuration for workloads running inside a Kubernetes cluster, not for Azure DevOps pipeline execution. Pipeline tasks that need to authenticate to external services or deploy to AKS must retrieve secrets from Azure DevOps constructs like Variable Groups or service connections, so using AKS secrets would not make the secrets available to the pipeline at runtime and would create an unnecessary dependency on cluster access.

• ✗

  Use pipeline variables marked as 'secret'

  Why it's wrong here

  Pipeline variables marked as 'secret' are masked in logs, but the underlying values are still stored in plaintext within the pipeline definition, whether in YAML or the classic UI. Anyone with edit permissions to the pipeline can read the actual secret value from the pipeline settings, and it remains at rest in Azure DevOps storage. This violates the principle of least privilege and increases exposure risk, whereas Key Vault-linked Variable Groups keep the secret value entirely out of the pipeline system.

Go deeper

Related to this question