Two Recommended Ways to Manage Secrets in Azure Pipelines
Which TWO practices are recommended for managing secrets in Azure Pipelines?
Quick Answer
Using Azure Key Vault to store secrets and mapping them into a linked variable group, alongside marking sensitive pipeline variables as Secret so they're masked in logs, are the two practices that actually keep secrets safe in Azure Pipelines — centralizing storage in Key Vault while ensuring nothing sensitive leaks into log output.
⚠ Common exam trap
Candidates often confuse the ability to define variables in YAML with the ability to define secret variables in YAML, not realizing that Azure Pipelines explicitly prohibits storing secret values in YAML files to prevent repository exposure.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Define secret variables in the pipeline UI and mark them as secret
Option A is correct because defining variables in the pipeline UI (Library variable groups or pipeline variables) and marking them as secret encrypts them at rest and masks their values in logs, which is the built-in Azure Pipelines mechanism for handling sensitive values. Option C is correct because Azure Key Vault is the recommended centralized secret store, and Azure Pipelines can link a Key Vault as a variable group so secrets are fetched at runtime and never persisted in the pipeline definition. Option B is not recommended because plain environment variables on the build agent are not encrypted or masked and can leak into logs or be read by other processes. Option D is wrong because there is no 'secret' keyword for variables in YAML; secrets must come from the UI, variable groups, or Key Vault. Option E is wrong because storing secrets as plain text in YAML exposes them in source control and build logs.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Define secret variables in the pipeline UI and mark them as secret
Why this is correct
Defining variables in the pipeline UI and marking them secret encrypts the value at rest in Azure DevOps and masks it in logs, satisfying the requirement to keep credentials out of plain-text YAML. Secret variables are not automatically exposed to scripts, so tasks must map them explicitly via environment variables.
- ✗
Use environment variables in the build agent
Why it's wrong here
Agent environment variables are visible to every task and process on the agent, including untrusted build scripts, and are not masked in logs. They suit non-sensitive configuration; secrets belong in variable groups backed by Azure Key Vault, linked to the pipeline.
- ✓
Use Azure Key Vault to store secrets and map them as variables
Why this is correct
Azure Key Vault centralises secret storage with access policies, auditing and rotation, satisfying the requirement to keep credentials out of pipeline definitions. Mapping vault secrets to pipeline variables lets tasks consume them at runtime without exposing plaintext in YAML or logs, which directly meets the recommended-practice constraint in the stem.
- ✗
Set secret variables in the YAML file with the 'secret' keyword
Why it's wrong here
YAML has no 'secret' keyword; variables declared there are plain text and committed to source control, exposing credentials. Secrets should instead be stored in Azure Key Vault and surfaced through a variable group, or defined as secret variables in the pipeline UI.
- ✗
Store secrets as plain text in YAML variables
Why it's wrong here
Plain-text YAML variables are readable by anyone with repository access and persist in commit history, so credentials leak. Secrets require Azure Key Vault-backed variable groups or pipeline-defined secret variables, which are encrypted and masked in logs.
Go deeper
Related to this question
Learn chapter
Designing a Build Pipeline
Key term
Pipeline
A pipeline is an automated series of steps that takes code from development to production, ensuring quality and speed.
Key term
Variable group
A variable group is a reusable collection of key-value pairs in Azure DevOps that can store configuration settings and secrets, shared across multiple pipelines.
About these practice questions
Courseiva writes every AZ-400 question from scratch — 696 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on AZ-400
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Which THREE practices are recommended for managing secrets in a Git repository? (Select THREE.)
hard- ✓ A.Use tools like GitLeaks to scan for accidentally committed secrets
- B.Store secrets in a separate encrypted file committed to the repository
- ✓ C.Use GitHub Secrets or Azure Pipelines secret variables
- ✓ D.Use Azure Key Vault to store and retrieve secrets at build/release time
- E.Commit a .env file with default values to the repository
Why A: The recommended practices for managing secrets in a Git repository include using tools like GitLeaks to scan for accidentally committed secrets (Option A), using GitHub Secrets or Azure Pipelines secret variables (Option C), and using Azure Key Vault to store and retrieve secrets at build/release time (Option D). These approaches help avoid storing secrets directly in the repository. Option B is incorrect because storing secrets in an encrypted file committed to the repository still exposes them to anyone who can access the repo and the decryption key. Option E is incorrect because committing a .env file with default values risks including sensitive data and is not a secure practice.
Variation 2. You need to implement a strategy to manage secrets for your multi-stage YAML pipeline. The pipeline runs on Microsoft-hosted agents. Which approach should you use to securely pass secrets to pipeline tasks?
hard- A.Define the secrets as environment variables in the pipeline YAML directly.
- B.Use the Azure Key Vault task to download secrets and then pass them as parameters.
- ✓ C.Use pipeline variables with 'secret: true' and reference them as $(variableName).
- D.Store secrets in a file in the repository and read it during the build.
Why C: Azure Pipelines supports secret pipeline variables that are encrypted at rest and never exposed in logs or output. By defining a variable with `secret: true` in the YAML or via the UI, you can reference it securely as `$(variableName)` in tasks, ensuring the secret value is masked during execution.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-400 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-400 exam.