AZ-400 Practice Question: Design and implement build and release pipelines
Which TWO actions should you take to protect sensitive information (e.g., API keys, passwords) in Azure Pipelines? (Choose two.)
⚠ Common exam trap
Test-takers frequently think masking secrets in logs (Option D) is sufficient, but masking does not protect the secret from being stored in plaintext in the pipeline definition or from being exposed in other output channels.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Define secrets as pipeline secret variables and reference them as $(secretName).
Azure Pipelines allows you to define secret variables in the pipeline UI or YAML, which are encrypted at rest and never exposed in logs. Referencing them as $(secretName) ensures they are securely injected at runtime without being stored in plaintext. Option E is correct because Azure Key Vault provides a centralized, audited, and encrypted store for secrets, and variable groups linked to Key Vault allow pipelines to fetch secrets dynamically without embedding them in pipeline definitions.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Store secrets in environment variables on the agent machine.
Why it's wrong here
Environment variables on the agent machine are process-level and are visible to any process running in the same session, including other jobs or tools. They are not encrypted, not masked in logs, and provide no access control, making them unsafe for storing sensitive information.
- ✓
Define secrets as pipeline secret variables and reference them as $(secretName).
Why this is correct
Pipeline secret variables are encrypted at rest by Azure DevOps and are masked in pipeline logs when referenced as $(secretName). Only tasks that explicitly reference the variable receive its value, and it is never exposed in the pipeline definition or logs, making this a secure method.
- ✗
Store secrets in a YAML file and include the file in the repository.
Why it's wrong here
Storing secrets in a YAML file committed to the repository exposes them to anyone with read access to the repo, and the secret remains in version history even if deleted. There is no encryption or access control, and it violates the principle of not storing secrets in source control.
- ✗
Use plain text variables in the pipeline and mask them using the 'Logging Command' feature.
Why it's wrong here
Using plain text variables with the 'Logging Command' feature only masks the value in the console output; the variable itself is stored in plain text in the pipeline definition and is visible to users who can edit the pipeline. Masking logs does not protect the secret from being read, copied, or exposed through other channels.
- ✓
Use Azure Key Vault to store secrets and reference them via variable groups linked to Key Vault.
Why this is correct
Azure Key Vault provides centralized, encrypted storage for secrets with fine-grained access control via Azure RBAC. By linking a Key Vault to a variable group in Azure DevOps, secrets are fetched at runtime without being stored in the repository, and you benefit from features like secret rotation and auditing.
Go deeper
Related to this question
Learn chapter
Introduction to DevOps and Azure DevOps
Key term
Pipeline
A pipeline is an automated series of steps that takes code from development to production, ensuring quality and speed.
Key term
Azure Pipelines
Azure Pipelines is a cloud-based CI/CD service from Microsoft that automatically builds, tests, and deploys code to any platform or cloud.
About these practice questions
This AZ-400 question is part of Courseiva's 823-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-400 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-400 exam.