AZ-400 Practice Question: Design and implement build and release pipelines
Which TWO are valid strategies for managing secrets in Azure Pipelines?
⚠ Common exam trap
Many exam-takers think variable groups alone are secure, but only when linked to Key Vault and marked as secret do they provide proper secret management; plain-text variable groups or YAML embedding are common missteps.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use a variable group linked to Azure Key Vault and mark variables as secret.
Linking a variable group to Azure Key Vault allows secrets to be securely referenced without exposing them in plaintext; when variables are marked as secret, Azure Pipelines masks their values in logs. Alternatively, the Azure Key Vault task can fetch secrets at runtime and map them to pipeline variables for use in tasks, which also keeps secrets out of YAML and logs. Both approaches are valid strategies for secret management.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Store secrets in plain text in a variable group.
Why it's wrong here
Storing secrets as plain text in a variable group exposes them in the pipeline logs, the Azure DevOps UI, and any user with read access to the pipeline, offering no encryption or access control. This violates the core security principle of keeping secrets encrypted and restricted to authorized users or services.
- ✓
Use a variable group linked to Azure Key Vault and mark variables as secret.
Why this is correct
A variable group linked to Azure Key Vault securely references secrets stored in Key Vault, allowing pipeline tasks to consume them as secret variables. Marking them as secret ensures they are masked in logs and not exposed, while Key Vault enforces access policies and rotation, making this a recommended, secure strategy.
- ✗
Store secrets in a Git repository and read them during build.
Why it's wrong here
Committing secrets to a Git repository, even a private one, risks exposure through branch history, forks, or compromised developer machines, and they remain in plain text in source control. Azure DevOps cannot enforce secret masking for repository files, so this is an insecure strategy that should never be used for production credentials.
- ✗
Embed secrets directly in the pipeline YAML file.
Why it's wrong here
Embedding secrets directly in a pipeline YAML file stores them in the repository or pipeline definition, where they can be read by anyone with access to the code and may appear in logs or change history. This also prevents centralized secret management and rotation, so secrets should be fetched dynamically from a secure store like Azure Key Vault instead.
- ✓
Use the Azure Key Vault task to fetch secrets and map them to pipeline variables.
Why this is correct
Using the Azure Key Vault task explicitly fetches secrets at runtime and maps them to pipeline variables, preventing them from being stored in code, YAML, or variable groups. This approach leverages Key Vault's centralized access policies, auditing, and rotation, ensuring secrets are never hard-coded and remain protected throughout the pipeline execution.
Go deeper
Related to this question
Learn chapter
Introduction to DevOps and Azure DevOps
Key term
Variable group
A variable group is a reusable collection of key-value pairs in Azure DevOps that can store configuration settings and secrets, shared across multiple pipelines.
Key term
Task
A Task in Azure DevOps is a predefined, reusable step that performs a specific action during a build or release pipeline, like compiling code or running tests.
About these practice questions
This AZ-400 question is part of Courseiva's 823-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-400 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-400 exam.