Masking Connection Strings with Secret Pipeline Variables
Your team uses Azure Pipelines to deploy a web app to Azure App Service. You need to ensure that secrets (e.g., connection strings) are not exposed in the pipeline logs. What is the recommended approach?
Quick Answer
Marking pipeline variables as Secret and referencing them with $(variableName) syntax is the built-in way to keep connection strings out of logs — secret variables are automatically hidden from pipeline output, so even if a script echoes the variable, the actual value never appears in the run's log.
⚠ Common exam trap
Candidates often think storing secrets in Azure Key Vault automatically prevents log exposure, but the retrieval and subsequent logging of those values in the pipeline still leaks them unless they are explicitly marked as secret variables.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use secret pipeline variables and reference them in the pipeline.
Azure Pipelines supports secret pipeline variables that are masked in logs, preventing exposure of sensitive data like connection strings. When you mark a variable as secret, its value is automatically hidden from pipeline output, and you can reference it securely using $(variableName) syntax. This is the recommended approach for handling secrets directly within the pipeline without additional service dependencies.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Remove all logging from the pipeline.
Why it's wrong here
Logging is needed for debugging.
- ✓
Use secret pipeline variables and reference them in the pipeline.
Why this is correct
Secret variables are masked in logs.
- ✗
Store secrets in Azure Key Vault and retrieve them in the pipeline, then log them for debugging.
Why it's wrong here
Logging secrets defeats the purpose.
- ✗
Store secrets as environment variables in the pipeline.
Why it's wrong here
Environment variables can be printed in logs.
Go deeper
Related to this question
Learn chapter
Introduction to DevOps and Azure DevOps
Key term
Azure Pipelines
Azure Pipelines is a cloud-based CI/CD service from Microsoft that automatically builds, tests, and deploys code to any platform or cloud.
Key term
Pipeline
A pipeline is an automated series of steps that takes code from development to production, ensuring quality and speed.
About these practice questions
Courseiva writes every AZ-400 question from scratch — 823 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on AZ-400
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Your team uses Azure Pipelines with Microsoft-hosted agents. You need to ensure that sensitive variables like API keys are securely passed to build tasks, but not exposed in logs. Which approach should you use?
hard- A.Retrieve the API key from Azure Key Vault at runtime using the Azure Key Vault task, but do not mark the output as secret
- ✓ B.Store the API key as a secret variable in the pipeline library or variable group
- C.Define the API key in a variable template with 'isSecret: false'
- D.Store the API key as a plain text variable in the pipeline and use it as an environment variable
Why B: Secret variables in Azure Pipelines are encrypted at rest and masked in logs, ensuring sensitive values like API keys are never exposed. Storing the API key as a secret in a pipeline library or variable group allows it to be securely referenced by tasks without appearing in output or debug logs.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-400 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-400 exam.