AZ-400 Develop a security and compliance plan Practice Question
Network Topology
Refer to the exhibit. You executed the Azure CLI command to list variable groups. A security audit requires that all variable groups containing secrets are configured to be authorized for all pipelines. Which statement is true based on the output?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The variable group 'ProdVars' contains a secret variable, but the output does not indicate whether it is authorized for all pipelines
The JSON output shows that 'ProdVars' has an 'ApiKey' variable with a null value, indicating it is a secret variable (values are masked). The output does not include any authorization properties, so we cannot determine if it is authorized for all pipelines. Option B is incorrect because the property 'authorized' may exist but is not shown in the list command; you need to use 'az pipelines variable-group show' or check the settings separately. Option C is incorrect because the secret value is masked (null), not exposed. Option D is incorrect because having secret variables does not automatically authorize the group for all pipelines; authorization must be explicitly configured.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The variable group 'ProdVars' contains a secret variable, but the output does not indicate whether it is authorized for all pipelines
Why this is correct
The `az pipelines variable-group show` command returns the variable group's metadata and variable definitions. For a secret variable, the value is returned as null (or an empty string depending on the CLI version), which confirms the variable is secret. However, the output does not include an authorization flag such as `isAuthorized` or `authorizedForAllPipelines`; that is a separate property managed at the pipeline/library level. Therefore, while the output clearly indicates the presence of a secret variable, it provides no information about whether the variable group has been authorized for use in all pipelines.
- ✗
The variable group 'ProdVars' is not authorized for all pipelines because no such property exists
Why it's wrong here
This option incorrectly claims that the authorization property does not exist. In the Azure DevOps REST API and CLI, variable groups have an `isAuthorized` property (sometimes exposed as `authorizedForAllPipelines` or configurable via the `--authorize-all-pipelines` flag when creating or updating a variable group). This property controls whether the variable group is accessible to all YAML pipelines without needing to be added to each pipeline's resources. The fact that this particular CLI output does not display the property means the property is not shown in that output, not that the property is absent from the underlying data model.
- ✗
The variable group 'ProdVars' has exposed the secret value in the output
Why it's wrong here
The output for a secret variable shows the value as null, not as the actual secret string. Azure DevOps deliberately masks secret values in API responses and CLI output to prevent leakage. A null value is a standard indicator that the variable is a secret, and it does not expose the secret content. Therefore, the claim that the secret value has been exposed is factually incorrect—the null value simply signals that the variable is a secret and the real value is stored securely server-side.
- ✗
The variable group 'ProdVars' is authorized for all pipelines because it has secret variables
Why it's wrong here
Having secret variables does not automatically grant authorization for all pipelines. Authorization is an explicit security decision that must be configured by an administrator—for example, by enabling the 'Allow access to all pipelines' toggle in the Azure DevOps UI, using the REST API, or passing the `--authorize-all-pipelines` flag in the Azure CLI. The presence of secret variables might make authorization more impactful (because secrets would then be available to all pipelines), but secret status itself does not confer that permission. Thus, inferring authorization from the existence of secret variables is a logical fallacy and not a valid technical conclusion.
Go deeper
Related to this question
Learn chapter
Introduction to DevOps and Azure DevOps
Key term
Check
A Check in Azure DevOps is a gating mechanism that evaluates predefined conditions before allowing a pipeline deployment to proceed to a specific environment.
Key term
JSON
JSON is a lightweight, text-based format for storing and exchanging data that is easy for humans to read and write and easy for machines to parse and generate.
About these practice questions
One of 823 original AZ-400 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-400 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-400 exam.