Three Security Best Practices Every Azure Pipelines Setup Should Follow
Which THREE are valid security best practices for Azure Pipelines? (Choose three.)
Quick Answer
Using variable groups with Key Vault integration for secrets, restricting agent pool creation to a small admin team, and applying the principle of least privilege through granular security groups are the security fundamentals that hold up an Azure Pipelines setup — centralizing secret storage while limiting who can create infrastructure that could be abused.
⚠ Common exam trap
It's easy for candidates to think storing secrets in YAML files is acceptable if the repository is private, but Azure Pipelines explicitly warns against this because secrets can be exposed in pipeline logs, build artifacts, or through source control history.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Restrict agent pool permissions to only necessary users
Restricting agent pool permissions to only necessary users follows the principle of least privilege, reducing the attack surface by ensuring only authorized personnel can register, manage, or use build agents. This prevents unauthorized access that could lead to code injection or credential theft.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Restrict agent pool permissions to only necessary users
Why this is correct
Least privilege principle applies to agent pools.
- ✓
Use Microsoft Entra ID to control access to pipelines
Why this is correct
Microsoft Entra ID provides centralized identity management.
- ✗
Store secrets as plain text in YAML files
Why it's wrong here
Plain text secrets are insecure.
- ✓
Use variable groups with Azure Key Vault integration for secrets
Why this is correct
Key Vault integration securely stores and retrieves secrets.
- ✗
Run build agents on domain controllers
Why it's wrong here
Domain controllers should not be used for build agents.
Go deeper
Related to this question
Learn chapter
Introduction to DevOps and Azure DevOps
Key term
Least privilege
Least privilege is a security principle that means giving users, systems, or programs only the minimum permissions they need to do their job and nothing more.
Key term
Agent
An agent is a software component that runs on a local machine to perform automated tasks, collect data, or execute commands as part of a larger system like CI/CD or monitoring.
About these practice questions
One of 823 original AZ-400 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on AZ-400
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Which THREE measures should be implemented to protect secrets in Azure Pipelines? (Choose three.)
medium- ✓ A.Restrict which pipelines can access the variable group
- B.Log secret values to pipeline console for debugging
- ✓ C.Use variable groups with locked variables
- ✓ D.Link Azure Key Vault as a variable group
- E.Store secrets in code as environment variables
Why A: Restricting which pipelines can access a variable group ensures that only authorized pipelines can use secrets stored in that group, preventing unauthorized access or accidental exposure. This is a key security measure in Azure Pipelines to enforce the principle of least privilege.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-400 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-400 exam.