AZ-400 Practice Question: Design and implement build and release pipelines
Which TWO actions are required to securely use Azure Key Vault secrets in an Azure Pipelines build? (Choose 2)
⚠ Common exam trap
Candidates often think they can directly reference the secret identifier in YAML (Option D) or use environment variables (Option C) to securely retrieve secrets, but these approaches bypass the secure authentication and masking provided by the dedicated Azure Key Vault task.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use the 'Azure Key Vault' task to download secrets as pipeline variables.
The Azure Key Vault task in Azure Pipelines is the recommended way to securely download secrets from a Key Vault and expose them as pipeline variables. This task automatically handles authentication and ensures that secret values are masked in logs, preventing accidental exposure. It eliminates the need to manually manage secret retrieval and mapping in YAML. For the task to succeed, the Azure DevOps service principal (from the Azure Resource Manager service connection) must have 'Get' and 'List' permissions on the Key Vault. Without these permissions, the task cannot retrieve the secrets. Therefore, both using the Azure Key Vault task and granting the appropriate permissions are required actions.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Set the 'secrets' output variable to 'true' in the pipeline.
Why it's wrong here
There is no 'secrets' output variable in Azure Pipelines; secret variables are marked as secrets in the UI or via the 'isSecret' property in YAML, not by a pipeline-level setting. Configuring a non-existent output variable does nothing to securely retrieve Key Vault secrets.
- ✓
Use the 'Azure Key Vault' task to download secrets as pipeline variables.
Why this is correct
The Azure Key Vault task authenticates to the Key Vault using the Azure DevOps service principal, retrieves the specified secrets, and injects them as pipeline variables, automatically marking them as secret and masked in logs. This is the recommended, supported method for consuming Key Vault secrets in a pipeline.
- ✗
Use the 'Environment Variables' section in the pipeline to map secrets.
Why it's wrong here
While environment variables can be set for a pipeline job, Azure Pipelines does not automatically map Key Vault secrets to environment variables; secrets must first be retrieved via the Key Vault task or referenced from a variable group. Simply adding them to the Environment Variables section does not securely or automatically fetch them from Key Vault.
- ✗
Reference the secret identifier directly in the pipeline YAML.
Why it's wrong here
Hard-coding a secret identifier (e.g., a full URI to a secret version) in a YAML pipeline does not grant any access to the secret, and the YAML might expose the identifier in source control. Secure access requires an Azure service connection with appropriate permissions and a retrieval task or variable group, not a direct reference.
- ✓
Grant the Azure DevOps service principal 'Get' and 'List' permissions on the Key Vault.
Why this is correct
The Azure DevOps service principal must have 'Get' and 'List' permissions on the Key Vault to allow the Azure Key Vault task (or variable group) to read secret names and values. Without these permissions, any attempt to retrieve secrets will fail with an authorization error, so granting them is a mandatory prerequisite for secure access.
Go deeper
Related to this question
Learn chapter
Introduction to DevOps and Azure DevOps
Key term
Task
A Task in Azure DevOps is a predefined, reusable step that performs a specific action during a build or release pipeline, like compiling code or running tests.
Key term
Azure DevOps
Azure DevOps is a Microsoft service that provides development tools for planning, building, testing, and deploying software applications using automated pipelines and collaboration features.
About these practice questions
Courseiva writes every AZ-400 question from scratch — 823 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-400 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-400 exam.