Storing a Sensitive Connection String as a Secret Pipeline Variable
Your build pipeline uses a hosted agent. You need to securely pass a connection string to a deployment task. The connection string contains a password. What is the recommended approach to store and use this secret in Azure Pipelines?
Quick Answer
Defining the connection string as a secret variable — in a variable group or directly in the pipeline settings UI — and referencing it as $(connectionString) is the recommended path: secret variables are encrypted at rest and automatically masked in logs, unlike plain pipeline variables or hardcoded values in a script, which are both visible.
⚠ Common exam trap
Candidates may overthink and choose Azure Key Vault for all secrets, but for a single static secret used within a pipeline, secret variables are simpler and equally secure.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Define the connection string as a secret variable in the pipeline's variable group or in the pipeline settings UI, and reference it as `$(connectionString)`.
The recommended approach is to define the connection string as a secret variable in the pipeline's variable group or in the pipeline settings UI, and reference it as $(connectionString). Secret variables are encrypted at rest and never exposed in logs or to other tasks. Option A is incorrect because plain variables are visible in logs and YAML. Option B is incorrect because hardcoding secrets in scripts is insecure and violates best practices. Option D, while secure, is overkill for a simple secret and requires additional configuration and permissions, making it less recommended for this scenario.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Define the connection string as a plain variable in the YAML pipeline.
Why it's wrong here
Plain text variables are exposed in logs and not secure.
- ✗
Hardcode the connection string in the deployment script and set the file as read-only.
Why it's wrong here
Hardcoding is insecure and not recommended.
- ✓
Define the connection string as a secret variable in the pipeline's variable group or in the pipeline settings UI, and reference it as `$(connectionString)`.
Why this is correct
Secret variables are encrypted and masked in logs.
- ✗
Store the connection string in Azure Key Vault and use the 'Azure Key Vault' task to retrieve it at runtime.
Why it's wrong here
Storing the connection string in Azure Key Vault is the correct secure storage mechanism for secrets. However, the 'Azure Key Vault' task retrieves these secrets as regular pipeline variables, which are not automatically masked and can be exposed in pipeline logs if verbose logging is enabled. To securely pass the connection string without logging, the retrieved secret must be explicitly mapped to a secret variable using a specific syntax or passed directly to a task input designed to handle secrets. This option is tempting because Azure Key Vault is the recommended secure secret store for Azure resources, and the task correctly retrieves values from it.
Go deeper
Related to this question
Learn chapter
Introduction to DevOps and Azure DevOps
Key term
Agent
An agent is a software component that runs on a local machine to perform automated tasks, collect data, or execute commands as part of a larger system like CI/CD or monitoring.
Key term
Task
A Task in Azure DevOps is a predefined, reusable step that performs a specific action during a build or release pipeline, like compiling code or running tests.
About these practice questions
Courseiva writes every AZ-400 question from scratch — 823 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on AZ-400
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Your team uses GitHub Actions for CI/CD. You want to securely store a database connection string used in a workflow. Where should you store it?
easy- ✓ A.GitHub Secrets.
- B.Workflow environment variables.
- C.Directly in the workflow YAML.
- D.In a configuration file committed to repo.
Why A: GitHub Secrets is the correct choice because it provides encrypted storage for sensitive data like database connection strings. When you store a value in GitHub Secrets, it is encrypted via libsodium before being stored, and it is only exposed to GitHub Actions workflows as an environment variable or input when explicitly referenced. This prevents the secret from being logged or leaked in the workflow output, unlike other storage methods that risk exposure.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-400 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-400 exam.