Using the Azure Key Vault Task to Pull Secrets Just Before Deployment
You are deploying a web app to Azure App Service using Azure Pipelines. The security team requires that all secrets are stored in Azure Key Vault and retrieved at deployment time. What is the best approach?
Quick Answer
Adding an Azure Key Vault task to the pipeline that downloads secrets at deployment time is the approach that satisfies the security team's requirement directly — secrets are pulled fresh from Key Vault during the run and never stored in the pipeline definition, source control, or build artifacts.
⚠ Common exam trap
The trap is that candidates may mistakenly believe that Variable Groups linked to Key Vault (Option C) do not retrieve secrets at deployment time, but they do; however, the Azure Key Vault task is the best approach because it provides explicit control over secret retrieval timing and minimizes exposure as pipeline variables.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Add an Azure Key Vault task in the pipeline to download secrets
The Azure Key Vault task in Azure Pipelines directly downloads secrets from Key Vault as pipeline variables at deployment time, ensuring secrets are never stored in the pipeline definition or source control. This meets the security team's requirement for retrieving secrets at deployment time without exposing them in logs or build artifacts.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Add an Azure Key Vault task in the pipeline to download secrets
Why this is correct
This retrieves secrets directly from Key Vault during the pipeline run.
- ✗
Store secrets in pipeline variables and mark them as secret
Why it's wrong here
This stores secrets in Azure DevOps, not Key Vault.
- ✗
Use Variable Groups linked to Key Vault
Why it's wrong here
Variable Groups linked to Key Vault do retrieve secrets at deployment time, but they are not the best approach because the Azure Key Vault task is more direct and recommended for downloading secrets during deployment. Option C is incorrect because the question asks for the best approach.
- ✗
Reference Key Vault secrets directly in App Service configuration
Why it's wrong here
This is for runtime, not deployment time retrieval.
Go deeper
Related to this question
Learn chapter
Introduction to DevOps and Azure DevOps
Key term
Azure Pipelines
Azure Pipelines is a cloud-based CI/CD service from Microsoft that automatically builds, tests, and deploys code to any platform or cloud.
Key term
Task
A Task in Azure DevOps is a predefined, reusable step that performs a specific action during a build or release pipeline, like compiling code or running tests.
About these practice questions
This AZ-400 question is part of Courseiva's 823-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on AZ-400
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. You are designing a security compliance plan for Azure Pipelines. The plan must ensure that no pipeline can use variables containing secrets unless those variables are stored in Azure Key Vault and referenced via a variable group linked to Key Vault. What is the best way to enforce this across all pipelines in an Azure DevOps organization?
medium- ✓ A.Create a YAML template that mandates the use of Key Vault references.
- B.Implement an Azure Policy that audits variable groups and requires Key Vault integration.
- C.Require manual approval for all pipeline runs that use variables.
- D.Use branch policies to prevent merging code that contains secrets.
Why A: You can enforce a YAML template at the organization level using required template policies. This ensures all pipelines include a template that mandates Key Vault references for secrets, providing a scalable enforcement mechanism. Option B is incorrect because Azure Policy applies to Azure resources, not Azure DevOps constructs like variable groups. Option C is incorrect because manual approvals do not enforce Key Vault usage. Option D is incorrect because branch policies control code, not variable usage during execution.
Variation 2. Which THREE of the following are valid methods to securely store and use secrets in Azure DevOps pipelines?
hard- ✓ A.Azure Key Vault task in the pipeline
- ✓ B.Variable Group linked to Azure Key Vault
- C.Azure App Configuration with Key Vault references
- D.Storing secrets in a pipeline YAML file with encryption
- ✓ E.Pipeline variables marked as 'secret'
Why A: The Azure Key Vault task in a pipeline allows you to fetch secrets directly from an Azure Key Vault instance during pipeline execution. This task retrieves secret values as pipeline variables, ensuring they are never exposed in logs or YAML files, and it supports both Azure Resource Manager and service principal authentication for secure access.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-400 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-400 exam.