Two Valid Strategies for Secure Secrets in Azure Pipelines
Which TWO of the following are valid strategies to securely store and use secrets in Azure Pipelines?
Quick Answer
Linking a variable group to Azure Key Vault so secrets are retrieved as pipeline variables — via managed identity or service principal authentication — keeps secrets out of the YAML entirely and out of pipeline logs, which is exactly the kind of secure retrieval Azure Pipelines is built to support natively.
⚠ Common exam trap
Candidates often confuse the 'secret' variable type in YAML as a secure storage mechanism, not realizing it still requires the value to be defined in the pipeline file or library, whereas true security comes from external secret stores like Key Vault.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Link a variable group to Azure Key Vault and reference variables in the pipeline.
Azure Pipelines allows you to link a variable group to Azure Key Vault, enabling secure retrieval of secrets as pipeline variables without exposing them in YAML or logs. This integration uses Azure Key Vault's access policies and managed identities to authenticate, ensuring secrets are never stored in the pipeline definition.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Link a variable group to Azure Key Vault and reference variables in the pipeline.
Why this is correct
This securely stores secrets in Key Vault.
- ✓
Use the 'AzureKeyVault' task to download secrets during the pipeline run.
Why this is correct
This retrieves secrets from Key Vault at runtime.
- ✗
Use the 'secret' variable type in YAML and hardcode the value.
Why it's wrong here
Hardcoding secrets in YAML is insecure.
- ✗
Store secrets in a text file in the repository and use a script to read them.
Why it's wrong here
Storing secrets in the repo is insecure.
- ✗
Use encrypted environment variables in GitHub Actions.
Why it's wrong here
This is for GitHub Actions, not Azure Pipelines.
Go deeper
Related to this question
Learn chapter
Introduction to DevOps and Azure DevOps
Key term
Variables
A variable is a named storage location in a computer program that holds a value which can change during execution.
Key term
Pipeline
A pipeline is an automated series of steps that takes code from development to production, ensuring quality and speed.
About these practice questions
This AZ-400 question is part of Courseiva's 823-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on AZ-400
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Your company is migrating to Microsoft Entra ID and needs to manage secrets used in Azure Pipelines. Which service should you use to securely store and rotate secrets?
easy- ✓ A.Azure Key Vault
- B.GitHub Secrets
- C.Azure App Configuration
- D.Microsoft Purview
Why A: Azure Key Vault is the correct service to securely store and rotate secrets used in Azure Pipelines. It is natively integrated with Azure Pipelines via library variable groups, allowing secrets to be referenced in pipelines without exposing them. Option B, GitHub Secrets, is designed for GitHub Actions, not Azure Pipelines. Option C, Azure App Configuration, manages feature flags and configuration settings, not secrets. Option D, Microsoft Purview, is for data governance and compliance, not secret management.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-400 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-400 exam.