AZ-400 Practice Question: Design and implement build and release pipelines
Which TWO actions should you take to implement a secure build pipeline that uses Azure Key Vault to store secrets? (Choose two.)
⚠ Common exam trap
Many exam-takers think storing secrets as pipeline variables (Option B) is sufficient, but the question specifically requires using Azure Key Vault, so the correct approach is to retrieve secrets from Key Vault at runtime using the dedicated task, not to hardcode them as pipeline variables.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Grant the Azure DevOps service principal 'Get' and 'List' permissions on the Key Vault.
The Azure DevOps service principal (the identity used by Azure Pipelines) must be granted 'Get' and 'List' permissions on the Key Vault's access policy. This allows the pipeline to retrieve secret values securely without storing credentials in the repository or pipeline configuration. Without these permissions, any attempt to read secrets from the vault will fail with an authorization error.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Store the Key Vault name and secret names in a secure file in the repository.
Why it's wrong here
Storing the Key Vault name and secret names in a secure file in the repository is insecure because the repository is a shared, version-controlled surface that can be accessed by many users; secret identifiers should be stored in pipeline variables or the Key Vault task configuration, not committed to source control.
- ✗
Define secrets as pipeline variables and mark them as secret.
Why it's wrong here
Marking secrets as secret pipeline variables obscures them in logs, but the values still reside in pipeline configuration and are managed by Azure DevOps, increasing exposure; best practice is to retrieve secrets at runtime from Azure Key Vault using the Key Vault task, which avoids storing secret values in pipeline settings.
- ✓
Grant the Azure DevOps service principal 'Get' and 'List' permissions on the Key Vault.
Why this is correct
Granting the Azure DevOps service principal 'Get' and 'List' permissions on the Key Vault is a mandatory prerequisite for the pipeline to retrieve secret names and values; without these permissions, the Azure Key Vault task fails, so you must configure an access policy or RBAC role assignment for the service principal.
- ✗
Use the 'Azure CLI' task to run 'az keyvault secret show' for each secret.
Why it's wrong here
Using the Azure CLI task to run 'az keyvault secret show' for each secret is inefficient and error-prone because you must manually capture and export each output, handle failures, and the method does not automatically map secrets to pipeline variables as the Azure Key Vault task does; the dedicated task is the recommended, secure approach.
- ✓
Use the 'Azure Key Vault' task to download secrets as pipeline variables.
Why this is correct
The Azure Key Vault task retrieves secret values at pipeline run time and exposes them as pipeline variables, allowing subsequent tasks to reference the secrets without displaying raw values in logs; this task is the recommended and integrated way to consume Key Vault secrets in an Azure DevOps pipeline.
Go deeper
Related to this question
Learn chapter
Introduction to DevOps and Azure DevOps
Key term
Build pipeline
A build pipeline is an automated sequence of steps that compiles source code into a deployable artifact, running tests and checks along the way.
Key term
Pipeline
A pipeline is an automated series of steps that takes code from development to production, ensuring quality and speed.
About these practice questions
This AZ-400 question is part of Courseiva's 823-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-400 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-400 exam.