Signing a .NET Assembly Using a Certificate Stored in Key Vault
You are designing a release pipeline for a .NET Core application that must comply with regulatory requirements. The pipeline must sign the assembly with a code-signing certificate stored in Azure Key Vault. Which THREE actions should you perform?
Quick Answer
Three steps make this work end to end: grant the pipeline's service principal access to Key Vault so it can retrieve the certificate, use the AzureKeyVault task to download it, and run a script step with signtool.exe to actually sign the assembly — the certificate itself should stay in Key Vault rather than being extracted into the build artifact.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Add a step to download the certificate from Key Vault using the AzureKeyVault task.
The AzureKeyVault task can download the certificate from Azure Key Vault. Option B is correct because after downloading the certificate, a script task like signtool.exe must be used to sign the assembly. Option C is correct because the Azure Pipelines service principal must be granted access to the Key Vault to retrieve the certificate. Option D is incorrect because the certificate should not be stored in a secure file in the build artifact; it should remain in Key Vault for security. Option E is incorrect because signing should occur before packaging; packaging after signing is typical to avoid corruption.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Add a step to download the certificate from Key Vault using the AzureKeyVault task.
Why this is correct
The task retrieves the certificate securely.
- ✓
Use a script task to invoke the signing tool (e.g., signtool.exe) after the build.
Why this is correct
Signing must occur after the assembly is built.
- ✓
Grant the Azure Pipelines service principal access to the Key Vault.
Why this is correct
Access must be granted to retrieve secrets.
- ✗
Store the certificate in a secure file in the build artifact.
Why it's wrong here
Certificates should not be stored in artifacts.
- ✗
Package the application before signing to avoid signature corruption.
Why it's wrong here
Signing should happen before packaging.
Go deeper
Related to this question
Learn chapter
Introduction to DevOps and Azure DevOps
Key term
Service principal
A service principal is an identity created for an application or automated tool to access cloud resources securely without using a human user account.
Key term
Release pipeline
A Release pipeline is an automated sequence of steps that takes software from code commit to production deployment, ensuring quality and consistency.
About these practice questions
One of 823 original AZ-400 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on AZ-400
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Your team uses Azure Pipelines for CI/CD. You need to enforce that all builds sign the assemblies with a code signing certificate stored in Azure Key Vault. What is the recommended approach?
medium- A.Store the certificate as a secure file in the pipeline library and use the 'Download Secure File' task.
- B.Embed the certificate in the repository and use a script to sign.
- ✓ C.Use the 'Azure Key Vault' task to download secrets and then a 'PowerShell' task to sign.
- D.Use the 'Azure CLI' task to retrieve the certificate and then sign.
Why C: Use the Azure Key Vault task to download the certificate as a secure secret, then use a PowerShell task to sign the assemblies with that certificate.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-400 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-400 exam.