AZ-400 Pass AKS creds securely. Practice Question
You are designing a pipeline that deploys to an Azure Kubernetes Service (AKS) cluster. You need to securely pass the Kubernetes cluster credentials to the pipeline without hardcoding them. Which approach should you use?
⚠ Common exam trap
Many exam-takers think a pipeline secret variable is sufficient for security, but Azure DevOps specifically recommends using Key Vault for production-grade secret management to avoid storing secrets in the pipeline's internal database and to enable centralized lifecycle management.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use a variable group linked to Azure Key Vault.
Azure Key Vault provides a secure, centralized store for secrets like Kubernetes cluster credentials, and linking a variable group to Key Vault allows the pipeline to dynamically retrieve those secrets at runtime without exposing them in the pipeline definition or logs. This approach follows the principle of least privilege and ensures credentials are never hardcoded or stored in plaintext within the pipeline.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Store credentials in a pipeline variable with 'secret' type.
Why it's wrong here
Secret pipeline variables are masked in logs and encrypted at rest, but they are stored in Azure DevOps and lack the centralized key management, fine-grained access control, and automatic rotation capabilities of Azure Key Vault, making them a less secure and less manageable choice for AKS credentials.
- ✓
Use a variable group linked to Azure Key Vault.
Why this is correct
A variable group linked to Azure Key Vault securely references secrets stored in Key Vault, so Azure DevOps fetches the current values at pipeline runtime rather than storing them in the pipeline definition. This leverages Key Vault's RBAC, versioning, and rotation, and allows the same service principal to be used across many pipelines without exposing it in YAML.
- ✗
Hardcode the credentials in the pipeline YAML.
Why it's wrong here
Hardcoding credentials directly in the pipeline YAML exposes them to anyone with repository read access and permanently embeds them in source control history. This violates Azure security best practices and offers no built-in encryption, rotation, or access control, so it can never be considered a secure method.
- ✗
Use a secure file in the pipeline library.
Why it's wrong here
Secure files are intended for static artifacts such as certificates or private keys and require pipeline tasks to retrieve and use the file, not to inject credentials as environment variables. Unlike a Key Vault-linked variable group, secure files do not integrate with Azure AD or Key Vault for dynamic secret retrieval, rotation, and centralized access policies, making them awkward for AKS credentials.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-400 exam frequently reuses these exact scenarios with slightly different constraints.
✓Use a variable group linked to Azure Key Vault.Correct answer▾
Why this is correct
A variable group linked to Azure Key Vault securely references secrets stored in Key Vault, so Azure DevOps fetches the current values at pipeline runtime rather than storing them in the pipeline definition. This leverages Key Vault's RBAC, versioning, and rotation, and allows the same service principal to be used across many pipelines without exposing it in YAML.
✗Store credentials in a pipeline variable with 'secret' type.Wrong answer — click to see why▾
Why this is wrong here
While secure, it does not leverage Key Vault for secret management and rotation.
✗Hardcode the credentials in the pipeline YAML.Wrong answer — click to see why▾
Why this is wrong here
This is insecure and violates best practices.
✗Use a secure file in the pipeline library.Wrong answer — click to see why▾
Why this is wrong here
Secure files are for files like certificates, not for credentials; but they can be used for kubeconfig, but variable group with Key Vault is more direct.
Analysis generated from the official AZ-400blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Introduction to DevOps and Azure DevOps
Key term
Anthos
Anthos is a Google Cloud platform that lets you run applications consistently across different computing environments, like on-premises data centers and multiple public clouds.
Key term
Least privilege
Least privilege is a security principle that means giving users, systems, or programs only the minimum permissions they need to do their job and nothing more.
About these practice questions
One of 823 original AZ-400 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-400 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-400 exam.