AZ-400 Practice Question: Design and implement build and release pipelines
Which THREE factors should you consider when designing a strategy for managing secrets in Azure Pipelines? (Choose three.)
⚠ Common exam trap
Many exam-takers think storing secrets as plain text variables is acceptable if they are marked as 'secret' in the pipeline UI, but those values are still stored in the pipeline definition and can be exposed in logs or exports, whereas Key Vault provides centralized, audited secret management.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use Azure Key Vault to store secrets.
Azure Key Vault is the recommended service for securely storing and managing secrets, keys, and certificates. By integrating Key Vault with Azure Pipelines, you can avoid exposing sensitive information in YAML files or pipeline logs. This approach ensures secrets are never hardcoded and are dynamically retrieved at runtime.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Hardcode secrets in the pipeline YAML for simplicity.
Why it's wrong here
Hardcoding secrets directly in a pipeline YAML file is insecure because the secrets are stored in plain text within version control, potentially accessible to any user with repository access, and they cannot be rotated without modifying the pipeline definition.
- ✗
Store secrets as plain text variables in YAML pipelines.
Why it's wrong here
Storing secrets as plain text variables in YAML pipelines exposes them in pipeline logs and UI, making them vulnerable to accidental disclosure and circumventing Azure DevOps security features like secret masking and access-controlled variable groups.
- ✓
Use Azure Key Vault to store secrets.
Why this is correct
Use Azure Key Vault to store secrets because it is a centralized, cloud-based secret management service that provides strong encryption, granular access policies with Azure AD authentication, audit logging, and automated secret rotation, ensuring secrets are never exposed in code or logs.
- ✓
Use a library variable group linked to Azure Key Vault.
Why this is correct
A library variable group linked to Azure Key Vault securely references secrets as pipeline variables without embedding them in YAML; it leverages Key Vault access policies to control which pipelines or agents can retrieve specific secrets and automatically masks their values in logs.
- ✓
Reference secrets as secret variables in pipeline tasks.
Why this is correct
Referencing secrets as secret variables in pipeline tasks is best practice because Azure DevOps masks these variable values in all logs, prevents accidental output, and only allows tasks that explicitly reference the variable to access the secret, reducing the risk of exposure during execution.
Go deeper
Related to this question
Learn chapter
Introduction to DevOps and Azure DevOps
Key term
Pipeline
A pipeline is an automated series of steps that takes code from development to production, ensuring quality and speed.
Key term
Azure Key Vault
Azure Key Vault is a cloud service for securely storing and managing sensitive information like passwords, encryption keys, and certificates.
About these practice questions
This AZ-400 question is part of Courseiva's 823-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-400 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-400 exam.