AZ-400 Practice Question: Design and implement build and release pipelines
Which THREE steps should you take to implement a secure CI/CD pipeline that uses secrets from Azure Key Vault?
⚠ Common exam trap
Many exam-takers confuse 'masking' secrets in logs (Option D) with true secret isolation, mistakenly thinking that masking alone provides sufficient security, whereas Azure Key Vault integration ensures secrets are never stored in the pipeline definition or source control.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use the Azure Key Vault task to download secrets as variables
The Azure Key Vault task in Azure Pipelines can download secrets as pipeline variables at runtime, allowing the pipeline to securely reference them without exposing the secret values in logs or configuration. This task authenticates to Key Vault using a service connection or managed identity, ensuring secrets are never stored in the pipeline definition.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Use the Azure Key Vault task to download secrets as variables
Why this is correct
The Azure Key Vault task authenticates to the vault and downloads the specified secrets as pipeline variables at runtime, ensuring that secret values are never stored in the pipeline definition or source control. This approach keeps secrets out of the YAML and only exposes them to tasks that need them, and the values are automatically masked if used in logs.
- ✓
Use secret variables in the pipeline that reference Key Vault secrets
Why this is correct
Secret variables that reference Key Vault secrets allow you to bind a pipeline variable to a vault secret, and the value is fetched at runtime. These variables are encrypted in Azure DevOps and automatically masked in build and release logs, preventing accidental exposure while keeping the secret definition centralized in Key Vault.
- ✗
Store secrets as plain text variables in the pipeline library
Why it's wrong here
Storing secrets as plain text variables in the pipeline library is insecure because the values are stored in clear text within Azure DevOps and can be viewed by any user with the appropriate permissions. Moreover, these plain text values may leak into logs or be exposed through build steps that echo them, making them unsuitable for any secure CI/CD pipeline.
- ✗
Hardcode secrets in the YAML file and use variables to mask them
Why it's wrong here
Hardcoding secrets in the YAML file means the secret values are committed to source control and visible to everyone with repository access, which is a direct security risk. Using variables to mask them only hides the value in printed logs after the fact, but does not protect the secret at rest or prevent unauthorized access to the repository.
- ✓
Grant the build agent managed identity access to the Key Vault
Why this is correct
The build agent must authenticate to Azure Key Vault before it can retrieve secrets, and granting the agent a managed identity (system-assigned or user-assigned) is a secure way to provide that authentication without storing service principal credentials. This identity is then assigned an access policy in Key Vault that grants the necessary read permissions for the secrets used in the pipeline.
Go deeper
Related to this question
Learn chapter
Introduction to DevOps and Azure DevOps
Key term
Azure Pipelines
Azure Pipelines is a cloud-based CI/CD service from Microsoft that automatically builds, tests, and deploys code to any platform or cloud.
Key term
Managed identity
A managed identity is an automatically managed service principal in Azure that allows your code to authenticate to any service that supports Azure AD authentication without storing credentials.
About these practice questions
One of 823 original AZ-400 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-400 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-400 exam.