AZ-400 Practice Question: Design and implement build and release pipelines
Which THREE features are available in GitHub Actions for managing secrets across environments?
⚠ Common exam trap
Candidates often confuse 'secret scanning alerts' (a reactive security feature) with proactive secret management features, or assume 'encrypted variables' is a valid term when GitHub Actions officially uses 'secrets' for encrypted sensitive data.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Organization-level secrets
GitHub Actions supports three types of secrets for managing sensitive data: organization-level secrets, which are encrypted and shared across multiple repositories within an organization; repository-level secrets, which are available to all workflows in a single repository; and environment-specific secrets, which are scoped to a particular environment (e.g., production) within a repository. Together these allow centralized and scoped management of secrets across different environments and repositories. Options A and C are incorrect: 'encrypted variables in workflows' is not the official GitHub Actions secret feature, and secret scanning alerts is a reactive security service, not a secret management feature.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Encrypted variables in workflows
Why it's wrong here
Encrypted variables in workflows is not a separate GitHub Actions feature; this term simply refers to the use of secrets within a workflow file (e.g., via ${{ secrets.NAME }}), and the actual secret management capabilities are delivered through repository, environment, or organization-level secret scopes.
- ✓
Organization-level secrets
Why this is correct
Organization-level secrets are a core GitHub Actions feature that lets administrators define secrets once at the organization level so they are available to all repositories within that organization, enabling centralized management and consistent access across multiple workflows without duplicating sensitive values.
- ✗
Secret scanning alerts
Why it's wrong here
Secret scanning alerts are a security feature that proactively detects exposed secrets (such as API keys or tokens) in a repository's code and dependency definitions, but they do not provide the runtime secret management or scoping capabilities that GitHub Actions secrets offer; therefore they are not a feature for managing secrets in workflows.
- ✓
Environment-specific secrets
Why this is correct
Environment-specific secrets are a GitHub Actions feature that allows you to scope secrets to a named environment (e.g., production, staging), so workflows that deploy to that environment can access these secrets, while other environments or branches cannot—enabling fine-grained access control and protection for sensitive values.
- ✓
Repository-level secrets
Why this is correct
Repository-level secrets are a fundamental GitHub Actions feature that lets you store secrets at the repository level, making them available to all workflows in that repository; they are ideal for values that are shared across workflows but should not be exposed in the codebase, with access controlled by the repository's settings.
Go deeper
Related to this question
Learn chapter
Implementing and Managing Source Control
Key term
Repository
A repository is a central storage location where software packages, code, or configuration files are kept, managed, and distributed for use by IT systems.
Key term
Environment
An environment is a dedicated set of computing resources, configurations, and services used to develop, test, or host software applications in a controlled and repeatable way.
About these practice questions
This AZ-400 question is part of Courseiva's 823-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-400 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-400 exam.