AZ-400 Practice Question: Design and implement build and release pipelines
Which THREE are valid approaches to securely store secrets used in Azure Pipelines? (Choose three.)
⚠ Common exam trap
Candidates often think inline YAML secrets (Option A) are secure because they are marked as 'secret' in the YAML, but they are still stored in plaintext in the repository, which is a common security misconception.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Secret variables defined in the pipeline UI
Secret variables defined in the pipeline UI (B) are encrypted at rest and masked in logs, preventing exposure in source control. The Azure Key Vault task (C) retrieves secrets from Azure Key Vault at runtime, avoiding storage in Azure DevOps. Variable groups linked to Azure Key Vault (D) allow you to reference Key Vault secrets directly as pipeline variables, keeping them out of YAML and providing centralized access control. All three approaches ensure secrets are not stored in plaintext in repositories or pipeline definitions.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Inline secret variables defined in the YAML file
Why it's wrong here
Inline secret variables defined directly in the YAML file are not secure because they appear in plain text in the source code and can be exposed in pipeline logs, defeating the purpose of secret protection. Azure DevOps does not mask values defined inline in the YAML.
- ✓
Secret variables defined in the pipeline UI
Why this is correct
Secret variables defined in the pipeline UI are stored encrypted in Azure DevOps and automatically masked in all logs, ensuring they are never exposed during the build or release execution. They can be scoped to the pipeline run and are the recommended way to handle non-Key Vault secrets.
- ✓
Azure Key Vault task to fetch secrets at runtime
Why this is correct
Using an Azure Key Vault task, such as AzureKeyVault, downloads secrets to pipeline variables at runtime and masks them, allowing the pipeline to access them securely without hardcoding. The task reads from Key Vault and the secret values are available as variables to subsequent tasks.
- ✓
Variable groups linked to Azure Key Vault
Why this is correct
Variable groups can be linked directly to Azure Key Vault, so secrets are stored and managed in Key Vault and referenced in the pipeline as variables, with values fetched at runtime and automatically masked. This provides centralized secret management and allows the pipeline to avoid storing secrets in the pipeline definition.
- ✗
Environment variables set on the build agent
Why it's wrong here
Setting secret values as environment variables on the build agent is not secure because they are stored in plain text on the agent machine and may be exposed via the agent's environment inspection or script logs, and they do not benefit from Azure DevOps secret masking. Additionally, they persist on the agent and are accessible to any job running on that agent.
Go deeper
Related to this question
Learn chapter
Introduction to DevOps and Azure DevOps
Key term
Least privilege
Least privilege is a security principle that means giving users, systems, or programs only the minimum permissions they need to do their job and nothing more.
Key term
Task
A Task in Azure DevOps is a predefined, reusable step that performs a specific action during a build or release pipeline, like compiling code or running tests.
About these practice questions
Courseiva writes every AZ-400 question from scratch — 823 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-400 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-400 exam.