Combining App Service Settings, Variable Groups, and Token Replacement
Your team deploys a web application to Azure App Service using Azure Pipelines. The application requires a configuration file that contains connection strings and app settings. You need to ensure that the configuration is environment-specific and that sensitive values are not exposed in the pipeline logs. The configuration file is stored in a Git repository with different branches for each environment. You also need to support local development with the same configuration approach. Which strategy should you use?
Quick Answer
Splitting configuration by sensitivity is the right approach: non-secret, environment-specific settings live in Azure App Service configuration, secrets go into Azure Pipelines variable groups, and token replacement swaps placeholders in the config file at deployment time — keeping secrets out of the repo and logs while still supporting the same pattern for local development.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Store environment-specific settings in Azure App Service configuration, and use variable groups in Azure Pipelines for secrets. Use token replacement in the config file during deployment.
The recommended approach is to store environment-specific settings (non-secret) in Azure App Service configuration settings, and store secrets in Azure Pipelines variable groups. During deployment, use token replacement in the config file to replace placeholders with actual values. This ensures secrets are not exposed in logs or stored in the repository, and supports local development by using config transforms. Option A exposes secrets by storing them in the repository. Option B uses a single config file and sticky settings, which does not address environment-specific configurations and can be insecure. Option D relies on branch-based pipeline variables, which may not support local development and can lead to secrets exposure in logs if not properly handled.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Store all settings, including secrets, in the config file in each branch. Use a script to replace tokens.
Why it's wrong here
Secrets would be in the repository and logs.
- ✗
Use Azure App Service slots with sticky settings and store all settings in a single config file committed to the repository.
Why it's wrong here
Single config file doesn't differentiate environments.
- ✓
Store environment-specific settings in Azure App Service configuration, and use variable groups in Azure Pipelines for secrets. Use token replacement in the config file during deployment.
Why this is correct
App Service configuration handles non-secrets, variable groups for secrets, and token replacement for environment values.
- ✗
Use the same config file for all environments and override settings using pipeline variables based on branch name.
Why it's wrong here
Branch-based logic is inflexible and not recommended.
Go deeper
Related to this question
Learn chapter
Introduction to DevOps and Azure DevOps
Key term
Repository
A repository is a central storage location where software packages, code, or configuration files are kept, managed, and distributed for use by IT systems.
Key term
Variables
A variable is a named storage location in a computer program that holds a value which can change during execution.
About these practice questions
One of 823 original AZ-400 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on AZ-400
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Your team is using Azure Pipelines to deploy a web application to Azure App Service. The application uses a configuration file (appsettings.json) that contains environment-specific settings. You need to manage these settings across development, staging, and production environments without exposing secrets in the source code. The pipeline should automatically replace the settings during deployment. What should you configure?
medium- ✓ A.Use the 'File Transform' task in the release pipeline to replace tokens in the configuration file with variables defined in pipeline variable groups.
- B.Create separate build configurations for each environment and use the 'Transform Web.config' task.
- C.Use the 'Azure App Service Deploy' task with the 'Use Web Deploy' option and configure parameterization.
- D.Set environment variables in the Azure App Service and read them in the application code.
Why A: Use the 'File Transform' task to substitute variables from pipeline variables or variable groups. Option B is incorrect because build configuration transforms are for .NET projects and require specific setup. Option C is incorrect because environment variables are not directly used for file transforms. Option D is incorrect because Azure App Service application settings are for the runtime, not for transforming configuration files during deployment.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-400 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-400 exam.