- A
Use GitHub Actions secrets and ensure they are marked as masked
Use GitHub Actions secrets and ensure they are marked as masked. This is correct because secrets are automatically masked in logs when referenced via ${{ secrets.NAME }}.
- B
Store secrets in a YAML file within the repository
Why wrong: Store secrets in a YAML file within the repository. This is insecure because anyone with repo access can see the file, and it increases the risk of log exposure.
- C
Pass secrets as environment variables in the workflow
Why wrong: Pass secrets as environment variables in the workflow. This is not secure because environment variables can be inadvertently printed or logged by workflow steps.
- D
Use a third-party secret management service and fetch secrets at runtime
Why wrong: Use a third-party secret management service and fetch secrets at runtime. This does not directly prevent log exposure; fetched secrets may still appear in logs if not masked.
How to Securely Store and Mask Secrets in GitHub Actions
This AZ-400 practice question tests your understanding of design and implement build and release pipelines. Read the scenario carefully and evaluate each option against the stated constraints before committing to an answer. A key principle to apply: gitHub Actions Secrets. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
Your team uses GitHub Actions for CI/CD. You need to ensure that secrets stored in GitHub repository secrets are not exposed in build logs. Which security practice should you implement?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
Use GitHub Actions secrets and ensure they are marked as masked
Option A is correct because GitHub Actions secrets are automatically masked in logs when used properly via ${{ secrets.SECRET_NAME }}. They are never exposed in plaintext. Option B is wrong because storing secrets in a YAML file within the repository exposes them to anyone with repo access and increases risk of log exposure. Option C is wrong because environment variables can be printed or logged by the workflow steps if not explicitly masked. Option D, while a valid security practice, does not directly prevent exposure in build logs; secrets from third-party services may still appear in logs if not masked.
Key principle: GitHub Actions Secrets
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Use GitHub Actions secrets and ensure they are marked as masked
Why this is correct
Use GitHub Actions secrets and ensure they are marked as masked. This is correct because secrets are automatically masked in logs when referenced via ${{ secrets.NAME }}.
Related concept
GitHub Actions Secrets
- ✗
Store secrets in a YAML file within the repository
Why it's wrong here
Store secrets in a YAML file within the repository. This is insecure because anyone with repo access can see the file, and it increases the risk of log exposure.
- ✗
Pass secrets as environment variables in the workflow
Why it's wrong here
Pass secrets as environment variables in the workflow. This is not secure because environment variables can be inadvertently printed or logged by workflow steps.
- ✗
Use a third-party secret management service and fetch secrets at runtime
Why it's wrong here
Use a third-party secret management service and fetch secrets at runtime. This does not directly prevent log exposure; fetched secrets may still appear in logs if not masked.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap is that even when using GitHub Actions secrets, if you output them to logs using echo or similar commands without proper masking, they can still be exposed. However, if you use the built-in secret syntax (${{ secrets.NAME }}), GitHub automatically masks them.
Detailed technical explanation
How to think about this question
Treat this as a scenario question. Identify the problem, the constraint, and the best action. Then compare each option against those facts.
KKey Concepts to Remember
- GitHub Actions Secrets
- Secret Masking
- Environment Variables vs. Secrets
TExam Day Tips
- Watch for words such as best, first, most likely and least administrative effort.
- Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
GitHub Actions Secrets
Real-world example
How this comes up in practice
A company's IT admin needs to give a contractor read-only access to production logs without sharing account credentials. Using role-based access control (RBAC) and temporary scoped permissions — not a permanent shared password — is the correct pattern. Questions like this test whether you can apply least-privilege access across cloud identity services.
What to study next
Got this wrong? Here's your next step.
Review gitHub Actions Secrets, then practise related AZ-400 questions on the same topic to reinforce the concept.
- →
Design and implement build and release pipelines — study guide chapter
Learn the concepts, then practise the questions
- →
Design and implement build and release pipelines practice questions
Targeted practice on this topic area only
- →
All AZ-400 questions
928 questions across all exam domains
- →
Microsoft Azure DevOps Engineer Expert AZ-400 study guide
Full concept coverage aligned to exam objectives
- →
AZ-400 practice test guide
How to use practice tests most effectively before exam day
Related practice questions
Related AZ-400 practice-question pages
Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.
Configure processes and communications practice questions
Practise AZ-400 questions linked to Configure processes and communications.
Design and implement source control practice questions
Practise AZ-400 questions linked to Design and implement source control.
Design and implement build and release pipelines practice questions
Practise AZ-400 questions linked to Design and implement build and release pipelines.
Develop a security and compliance plan practice questions
Practise AZ-400 questions linked to Develop a security and compliance plan.
Implement an instrumentation strategy practice questions
Practise AZ-400 questions linked to Implement an instrumentation strategy.
Design and implement a DevOps infrastructure practice questions
Practise AZ-400 questions linked to Design and implement a DevOps infrastructure.
Design and implement a source control strategy practice questions
Practise AZ-400 questions linked to Design and implement a source control strategy.
AZ-400 fundamentals practice questions
Practise AZ-400 questions linked to AZ-400 fundamentals.
AZ-400 scenario practice questions
Practise AZ-400 questions linked to AZ-400 scenario.
AZ-400 troubleshooting practice questions
Practise AZ-400 questions linked to AZ-400 troubleshooting.
Practice this exam
Start a free AZ-400 practice session
Short sessions build daily habit. Longer sessions build exam-day stamina. Try a timed session to simulate real conditions.
FAQ
Questions learners often ask
What does this AZ-400 question test?
Design and implement build and release pipelines — This question tests Design and implement build and release pipelines — GitHub Actions Secrets.
What is the correct answer to this question?
The correct answer is: Use GitHub Actions secrets and ensure they are marked as masked — Option A is correct because GitHub Actions secrets are automatically masked in logs when used properly via ${{ secrets.SECRET_NAME }}. They are never exposed in plaintext. Option B is wrong because storing secrets in a YAML file within the repository exposes them to anyone with repo access and increases risk of log exposure. Option C is wrong because environment variables can be printed or logged by the workflow steps if not explicitly masked. Option D, while a valid security practice, does not directly prevent exposure in build logs; secrets from third-party services may still appear in logs if not masked.
What should I do if I get this AZ-400 question wrong?
Review gitHub Actions Secrets, then practise related AZ-400 questions on the same topic to reinforce the concept.
What is the key concept behind this question?
GitHub Actions Secrets
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
3 more ways this is tested on AZ-400
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Your organization uses GitHub Actions for CI/CD. You need to ensure that secrets are securely passed to workflows without being exposed in logs. What should you use?
easy- ✓ A.GitHub Secrets
- B.Environment variables in the workflow YAML
- C.Hardcode the secrets in the workflow file
- D.Azure Key Vault with Azure DevOps encrypted variables
Why A: GitHub Secrets (Option A) is the correct choice because GitHub Actions provides a built-in secrets management system that encrypts sensitive values at rest and masks them in all workflow logs. When you reference a secret using ${{ secrets.MY_SECRET }}, GitHub automatically redacts the value from any log output, ensuring it is never exposed during execution.
Variation 2. Your team uses GitHub Actions for CI/CD. You need to ensure that secrets are not exposed in build logs. What should you use?
easy- A.Hardcoded values in the workflow YAML
- B.Environment variables in the workflow
- ✓ C.GitHub Secrets
- D.Artifact storage
Why C: GitHub Secrets (Option C) is the correct choice because GitHub Actions provides a built-in encrypted secrets store that automatically masks secret values in build logs. When you reference a secret using `${{ secrets.MY_SECRET }}`, GitHub ensures the value is never printed or exposed in workflow output, unlike plaintext or environment variables that can be inadvertently logged.
Variation 3. Your team uses GitHub Actions for CI/CD. You want to securely store a database connection string used in a workflow. Where should you store it?
easy- ✓ A.GitHub Secrets.
- B.Workflow environment variables.
- C.Directly in the workflow YAML.
- D.In a configuration file committed to repo.
Why A: GitHub Secrets is the correct choice because it provides encrypted storage for sensitive data like database connection strings. When you store a value in GitHub Secrets, it is encrypted via libsodium before being stored, and it is only exposed to GitHub Actions workflows as an environment variable or input when explicitly referenced. This prevents the secret from being logged or leaked in the workflow output, unlike other storage methods that risk exposure.
Keep practising
More AZ-400 practice questions
- You are configuring a release pipeline that deploys to multiple environments. You want to automate the deployment to the…
- You have a multi-stage YAML pipeline that deploys to a Linux-based Azure App Service. The pipeline uses a 'Deploy to Azu…
- Your Azure DevOps pipeline deploys a web app to Azure App Service using a YAML pipeline. The deployment fails intermitte…
- A team is migrating from TFVC to Git. They have a large codebase with many branches. What is the recommended approach to…
- A development team is transitioning from a centralized version control system to Git in Azure Repos. The team lead wants…
- A team uses Azure Boards to manage work items. They want to automatically update the state of a work item when a related…
Last reviewed: Jun 20, 2026
This AZ-400 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-400 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.