hardMultiple SelectObjective-mapped
AZ-400 Practice Question: Which THREE of the following are valid methods to…
Which THREE of the following are valid methods to securely store and use secrets in Azure DevOps pipelines?
⚠ Common exam trap
It's easy for candidates to think Azure App Configuration with Key Vault references is a direct pipeline secret storage method, but it is designed for application configuration at runtime, not for pipeline variable management, and it requires additional configuration to resolve references during pipeline execution.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure Key Vault task in the pipeline
The Azure Key Vault task in a pipeline allows you to fetch secrets directly from an Azure Key Vault instance during pipeline execution. This task retrieves secret values as pipeline variables, ensuring they are never exposed in logs or YAML files, and it supports both Azure Resource Manager and service principal authentication for secure access.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Azure Key Vault task in the pipeline
Why this is correct
The Azure Key Vault task fetches secrets from Azure Key Vault at pipeline runtime, dynamically injecting them as pipeline variables without exposing them in source control or build logs. It supports versioning and access policies, making it a secure, auditable method for handling credentials during execution.
- ✓
Variable Group linked to Azure Key Vault
Why this is correct
A Variable Group linked to Azure Key Vault automatically retrieves secret values from Key Vault and exposes them as pipeline variables, with Azure DevOps masking these values in logs. This integration ensures secrets are never stored in YAML or repository files, and access is controlled via Key Vault permissions.
- ✗
Azure App Configuration with Key Vault references
Why it's wrong here
Azure App Configuration with Key Vault references is designed for application runtime configuration, not for Azure Pipelines secret management. Pipeline tasks cannot directly resolve Key Vault references, and secrets would remain unresolved or require additional custom logic, so it is not a valid method for securely providing secrets to pipelines.
- ✗
Storing secrets in a pipeline YAML file with encryption
Why it's wrong here
Storing secrets in a pipeline YAML file with encryption is invalid because YAML files are plain text and Azure Pipelines does not support encryption of YAML content. Any secret placed in a YAML file is visible in source control, posing a security risk, regardless of any imagined encryption mechanism.
- ✓
Pipeline variables marked as 'secret'
Why this is correct
Pipeline variables marked as 'secret' are encrypted at rest in Azure DevOps and automatically masked in pipeline logs, preventing accidental exposure. They are a valid method for securely storing and using secrets, though they are scoped to the pipeline and require explicit mapping or reference in tasks and scripts.
Go deeper
Related to this question
Learn chapter
Introduction to DevOps and Azure DevOps
Key term
Service principal
A service principal is an identity created for an application or automated tool to access cloud resources securely without using a human user account.
Key term
Azure DevOps
Azure DevOps is a Microsoft service that provides development tools for planning, building, testing, and deploying software applications using automated pipelines and collaboration features.
About these practice questions
One of 823 original AZ-400 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-400 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-400 exam.