Three Best Practices for Managing Secrets in Azure Pipelines
Which THREE of the following are best practices for managing secrets in Azure Pipelines? (Select THREE.)
Quick Answer
Managing secrets safely in Azure Pipelines means keeping them out of source control and out of plain environment variables entirely — instead, store them in Azure Key Vault and pull them into a variable group linked to that vault, mark any pipeline variable holding sensitive data as Secret so it's masked in logs, and authenticate the pipeline to Key Vault with a managed identity rather than long-lived credentials.
⚠ Common exam trap
A common mix-up: candidates think hardcoding secrets with variable substitution (Option A) is acceptable because it avoids storing secrets in plain text in the YAML, but they overlook that the secret value is still exposed in the pipeline logs and source control history, which is a critical security flaw.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use Azure Key Vault to store secrets and link them to variable groups.
Azure Key Vault is the recommended service for securely storing and managing secrets, keys, and certificates. By linking a Key Vault to a variable group in Azure Pipelines, you can reference secrets without exposing them in YAML or logs, and the pipeline retrieves them at runtime using a managed identity or service principal. This approach ensures secrets are never hardcoded and access can be audited and controlled centrally.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Hardcode secrets directly in the YAML file and use variable substitution at runtime.
Why it's wrong here
Hardcoding secrets in YAML is insecure; use secret variables or Key Vault.
- ✓
Use Azure Key Vault to store secrets and link them to variable groups.
Why this is correct
Key Vault provides secure storage and access control.
- ✗
Enable 'Allow scripts to access the OAuth token' for all build pipelines.
Why it's wrong here
This exposes the OAuth token, not secrets directly, but still a security risk.
- ✓
Restrict access to variable groups by using pipeline permissions.
Why this is correct
Pipeline permissions limit which pipelines can use the variable group.
- ✓
Map secret variables as environment variables with a mapping to prevent exposure in logs.
Why this is correct
Mapping secrets to environment variables reduces the chance of accidental exposure.
Go deeper
Related to this question
Learn chapter
Introduction to DevOps and Azure DevOps
Key term
Pipeline
A pipeline is an automated series of steps that takes code from development to production, ensuring quality and speed.
Key term
Managed identity
A managed identity is an automatically managed service principal in Azure that allows your code to authenticate to any service that supports Azure AD authentication without storing credentials.
About these practice questions
This AZ-400 question is part of Courseiva's 823-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on AZ-400
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Which TWO strategies can you use to manage secrets in Azure Pipelines securely?
easy- ✓ A.Use a variable group linked to Azure Key Vault.
- B.Store secrets directly in the YAML pipeline file.
- ✓ C.Use the 'secret' variable type in the pipeline UI.
- D.Use environment variables in the build agent.
- E.Print the secret in a script to verify it is correct.
Why A: Options A and C are correct. Variable groups can be linked to Azure Key Vault to fetch secrets, and you can mark variables as secret in the pipeline UI to prevent them from being displayed in logs. Option B is wrong because storing secrets in YAML files exposes them in source control. Option D is wrong because using environment variables on the build agent is not inherently secure; they can be accessed by other processes and may be logged. Option E is wrong because printing secrets in scripts exposes them in the pipeline logs, which is a security risk.
Variation 2. Which TWO actions should you take to ensure that your Azure DevOps pipeline securely manages secrets?
medium- ✓ A.Use Azure Key Vault variable groups
- B.Enable 'Allow scripts to access the system token' and print secrets in logs for debugging
- C.Store secrets directly in the YAML pipeline file
- ✓ D.Use secret variables set in the pipeline UI or variable groups
- E.Store secrets as plain text in the repository
Why A: Azure Key Vault variable groups securely store and manage secrets outside the pipeline definition, with access control and auditing. Option D is correct because secret variables set in the pipeline UI or variable groups are masked in logs and not exposed in the YAML file. Option B is incorrect: enabling script access to the system token and printing secrets in logs is a security risk. Option C is incorrect: storing secrets directly in the YAML pipeline file exposes them in the repository. Option E is incorrect: storing secrets as plain text in the repository is insecure.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-400 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-400 exam.