Three Practices That Prevent Secret Exposure in Azure Pipelines Logs
Your team uses Azure DevOps and needs to ensure that secrets are not exposed in pipeline logs. Which THREE practices should you implement?
Quick Answer
The ##vso[task.setvariable variable=mySecret;isSecret=true]value logging command is what actually masks a variable's value in Azure Pipelines logs — even if a script accidentally echoes the secret, the output gets replaced with asterisks, which is a direct, built-in safeguard against accidental exposure during a run.
⚠ Common exam trap
It's easy for candidates to confuse log masking with encryption, assuming that enabling 'pipeline log encryption' is a real Azure DevOps feature, when in fact the platform relies on secret variable masking and Azure Key Vault integration for secret management.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use logging commands to mask secrets in scripts
Azure DevOps provides a logging command, `##vso[task.setvariable variable=mySecret;isSecret=true]value`, which masks the variable's value in pipeline logs. This ensures that even if a script echoes the secret, it is replaced with asterisks, preventing accidental exposure during execution.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Use logging commands to mask secrets in scripts
Why this is correct
Logging commands like '##vso[task.setvariable]' can mask output.
- ✗
Enable pipeline log encryption
Why it's wrong here
Pipeline logs are not encrypted by default.
- ✓
Mark variables as 'secret' in pipeline variables
Why this is correct
Secret variables are masked in logs.
- ✗
Store secrets in YAML variable files
Why it's wrong here
YAML files can be exposed in source control.
- ✓
Use Azure Key Vault to store secrets
Why this is correct
Key Vault provides secure secret storage.
Go deeper
Related to this question
Learn chapter
Introduction to DevOps and Azure DevOps
Key term
Pipeline
A pipeline is an automated series of steps that takes code from development to production, ensuring quality and speed.
Key term
Azure DevOps
Azure DevOps is a Microsoft service that provides development tools for planning, building, testing, and deploying software applications using automated pipelines and collaboration features.
About these practice questions
One of 823 original AZ-400 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on AZ-400
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Which TWO actions should be taken to secure secrets in Azure Pipelines? (Choose two.)
medium- ✓ A.Use secret variables with the 'secret' input type to mask them in logs.
- B.Use a variable group without Key Vault integration for easier management.
- C.Store secrets directly in the YAML pipeline file.
- ✓ D.Store secrets in a variable group linked to Azure Key Vault.
- E.Disable CI triggers to reduce exposure.
Why A: Azure Pipelines allows you to mark variables as secret by using the 'secret' input type in the pipeline settings UI or by setting `secret: true` in YAML. This ensures the variable's value is masked with asterisks in all logs and output, preventing accidental exposure during build or release execution. Additionally, storing secrets in a variable group linked to Azure Key Vault provides a secure, centralized way to manage secrets, with access control, versioning, and auditability, making it a best practice for protecting sensitive data.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-400 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-400 exam.