AZ-400 Practice Question: Design and implement build and release pipelines
Which TWO actions can you take to improve the security of secrets in Azure Pipelines? (Choose two.)
⚠ Common exam trap
Many candidates think overriding secrets at queue time (Option C) is a valid security feature, but it actually undermines security by allowing users to bypass the approved secret store and inject arbitrary values.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Limit variable group permissions to specific pipelines
Limiting variable group permissions to specific pipelines ensures that only authorized pipelines can access sensitive secrets, reducing the risk of unauthorized exposure. Option D is correct because Azure Key Vault provides a centralized, auditable, and encrypted store for secrets, and mapping them as secret variables in Azure Pipelines prevents the secret values from being exposed in logs or output.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Log secret values for debugging purposes
Why it's wrong here
Logging secret values to pipeline logs or debug output exposes credentials in immutable, queryable logs, allowing anyone with log read access to retrieve them. Azure DevOps masks secret variables in logs, so explicitly writing them to output defeats that protection.
- ✓
Limit variable group permissions to specific pipelines
Why this is correct
Scoping variable group access to only the specific pipelines that require those secrets reduces the attack surface and enforces least privilege. Azure DevOps pipeline permissions on variable groups ensure unauthorized pipelines cannot consume or expose the linked secrets.
- ✗
Allow pipeline users to override secret values at queue time
Why it's wrong here
Allowing users to override secret values at queue time lets unapproved individuals inject arbitrary secrets and observe them via runtime variables, bypassing governance and security controls. This violates the principle of least privilege by granting queue-time users broad control over secret definitions.
- ✓
Use Azure Key Vault to store secrets and map them as secret variables
Why this is correct
Using Azure Key Vault to store secrets and mapping them as secret variables through a linked variable group is the recommended pattern because it keeps secrets out of pipeline YAML and Azure DevOps variable definitions. The pipeline retrieves the secrets at runtime via a service connection or managed identity, and they are then injected as masked secret variables, ensuring they never appear in logs. Key Vault also centralizes access policies, versioning, and audit logging, so you can rotate credentials without modifying pipeline code.
- ✗
Store secrets as plain text variables in the pipeline
Why it's wrong here
Plain text variables are stored in pipeline definition metadata and are visible to users with edit or view permissions, and they may be printed in logs unless explicitly marked as secret. Use Azure Key Vault or Azure DevOps protected variables to mask values and restrict access.
Go deeper
Related to this question
Learn chapter
Introduction to DevOps and Azure DevOps
Key term
Variables
A variable is a named storage location in a computer program that holds a value which can change during execution.
Key term
Variable group
A variable group is a reusable collection of key-value pairs in Azure DevOps that can store configuration settings and secrets, shared across multiple pipelines.
About these practice questions
Courseiva writes every AZ-400 question from scratch — 823 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-400 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-400 exam.