AZ-400 Configure processes and communications Practice Question
Which TWO actions should you take to ensure that your Azure DevOps pipeline securely manages secrets?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use Azure Key Vault variable groups
Azure Key Vault variable groups securely store and manage secrets outside the pipeline definition, with access control and auditing. Option D is correct because secret variables set in the pipeline UI or variable groups are masked in logs and not exposed in the YAML file. Option B is incorrect: enabling script access to the system token and printing secrets in logs is a security risk. Option C is incorrect: storing secrets directly in the YAML pipeline file exposes them in the repository. Option E is incorrect: storing secrets as plain text in the repository is insecure.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Use Azure Key Vault variable groups
Why this is correct
Azure Key Vault variable groups securely store secrets in Azure Key Vault and link them to pipelines via variable group metadata, enabling pipelines to fetch secrets at runtime without writing them into YAML or repository files; access is governed by Azure RBAC and Key Vault access policies.
- ✗
Enable 'Allow scripts to access the system token' and print secrets in logs for debugging
Why it's wrong here
Enabling 'Allow scripts to access the system token' and printing secrets in logs is insecure because it exposes credentials, tokens, or other sensitive values in pipeline logs, which are often retained for audit or debugging and may be accessible to unauthorized users; this violates secret-management best practices.
- ✗
Store secrets directly in the YAML pipeline file
Why it's wrong here
Storing secrets directly in the YAML pipeline file is a critical security flaw because YAML files live in your version control repository (e.g., Azure Repos, GitHub) and are visible to anyone with read access to that repo, including contractors, external collaborators, or through forks and mirrors. Unlike Azure Key Vault or secret variables, once a secret is committed to YAML, it becomes part of the repository history and cannot be fully purged without rewriting history, leaving an indefinite exposure window. Furthermore, secrets in YAML are injected as plain text into build logs if any task echoes variables or fails with verbose output, defeating Azure DevOps' secret-masking protections that only apply to variables explicitly marked as secret.
- ✓
Use secret variables set in the pipeline UI or variable groups
Why this is correct
Secret variables set in the pipeline UI or variable groups are masked in logs by Azure DevOps, preventing accidental exposure; they are stored encrypted and injected only into pipeline tasks that explicitly reference them, but they do not provide the centralized management and rotation features of Key Vault.
- ✗
Store secrets as plain text in the repository
Why it's wrong here
Storing secrets as plain text in the repository is highly insecure because any user or service with read access to the repository (including forks, mirrors, or external contractors) can see them, and secrets in version control persist in history even after deletion, creating a long-term security leak.
Go deeper
Related to this question
Learn chapter
Introduction to DevOps and Azure DevOps
Key term
Least privilege
Least privilege is a security principle that means giving users, systems, or programs only the minimum permissions they need to do their job and nothing more.
Key term
DevOps
DevOps is a set of practices that combines software development (Dev) and IT operations (Ops) to shorten the development lifecycle and deliver high-quality software continuously.
About these practice questions
One of 823 original AZ-400 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-400 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-400 exam.