AZ-400 Develop a security and compliance plan Practice Question
Which THREE measures should be implemented to protect secrets in Azure Pipelines? (Choose three.)
⚠ Common exam trap
Many exam-takers think logging secrets is acceptable for debugging or that storing secrets in environment variables is safe, but both practices directly contradict Azure security best practices and can lead to credential leakage.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Restrict which pipelines can access the variable group
Restricting which pipelines can access a variable group ensures that only authorized pipelines can use secrets stored in that group, preventing unauthorized access or accidental exposure. This is a key security measure in Azure Pipelines to enforce the principle of least privilege.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Restrict which pipelines can access the variable group
Why this is correct
Scoping access reduces exposure.
- ✗
Log secret values to pipeline console for debugging
Why it's wrong here
Logging secrets exposes them.
- ✓
Use variable groups with locked variables
Why this is correct
Locked variables prevent accidental changes.
- ✓
Link Azure Key Vault as a variable group
Why this is correct
Key Vault provides secure storage and access control.
- ✗
Store secrets in code as environment variables
Why it's wrong here
Secrets in code are not secure.
Go deeper
Related to this question
Learn chapter
Introduction to DevOps and Azure DevOps
Key term
Variable group
A variable group is a reusable collection of key-value pairs in Azure DevOps that can store configuration settings and secrets, shared across multiple pipelines.
Key term
Azure Pipelines
Azure Pipelines is a cloud-based CI/CD service from Microsoft that automatically builds, tests, and deploys code to any platform or cloud.
About these practice questions
One of 823 original AZ-400 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-400 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-400 exam.