Two Recommended Ways to Manage Secrets in Azure Pipelines
Which TWO practices are recommended for managing secrets in Azure Pipelines?
Quick Answer
Using Azure Key Vault to store secrets and mapping them into a linked variable group, alongside marking sensitive pipeline variables as Secret so they're masked in logs, are the two practices that actually keep secrets safe in Azure Pipelines — centralizing storage in Key Vault while ensuring nothing sensitive leaks into log output.
⚠ Common exam trap
Candidates often confuse the ability to define variables in YAML with the ability to define secret variables in YAML, not realizing that Azure Pipelines explicitly prohibits storing secret values in YAML files to prevent repository exposure.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Define secret variables in the pipeline UI and mark them as secret
Azure Pipelines allows you to define secret variables in the pipeline UI (or via the Azure DevOps CLI) and mark them as secret. When marked as secret, the value is encrypted at rest, masked in logs, and never exposed to the pipeline YAML or output. This is the recommended practice for managing sensitive data like API keys or passwords directly within the pipeline.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Define secret variables in the pipeline UI and mark them as secret
Why this is correct
This keeps secrets out of the repository.
- ✗
Use environment variables in the build agent
Why it's wrong here
Environment variables are not secure for secrets.
- ✓
Use Azure Key Vault to store secrets and map them as variables
Why this is correct
Key Vault provides secure storage and access control.
- ✗
Set secret variables in the YAML file with the 'secret' keyword
Why it's wrong here
Secrets should not be in YAML; they are set in the pipeline UI or Key Vault.
- ✗
Store secrets as plain text in YAML variables
Why it's wrong here
This exposes secrets in the repository.
Go deeper
Related to this question
Learn chapter
Introduction to DevOps and Azure DevOps
Key term
Azure Pipelines
Azure Pipelines is a cloud-based CI/CD service from Microsoft that automatically builds, tests, and deploys code to any platform or cloud.
Key term
Azure DevOps
Azure DevOps is a Microsoft service that provides development tools for planning, building, testing, and deploying software applications using automated pipelines and collaboration features.
About these practice questions
Courseiva writes every AZ-400 question from scratch — 823 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on AZ-400
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Which THREE practices are recommended for managing secrets in a Git repository? (Select THREE.)
hard- ✓ A.Use tools like GitLeaks to scan for accidentally committed secrets
- B.Store secrets in a separate encrypted file committed to the repository
- ✓ C.Use GitHub Secrets or Azure Pipelines secret variables
- ✓ D.Use Azure Key Vault to store and retrieve secrets at build/release time
- E.Commit a .env file with default values to the repository
Why A: The recommended practices for managing secrets in a Git repository include using tools like GitLeaks to scan for accidentally committed secrets (Option A), using GitHub Secrets or Azure Pipelines secret variables (Option C), and using Azure Key Vault to store and retrieve secrets at build/release time (Option D). These approaches help avoid storing secrets directly in the repository. Option B is incorrect because storing secrets in an encrypted file committed to the repository still exposes them to anyone who can access the repo and the decryption key. Option E is incorrect because committing a .env file with default values risks including sensitive data and is not a secure practice.
Variation 2. You need to implement a strategy to manage secrets for your multi-stage YAML pipeline. The pipeline runs on Microsoft-hosted agents. Which approach should you use to securely pass secrets to pipeline tasks?
hard- A.Define the secrets as environment variables in the pipeline YAML directly.
- B.Use the Azure Key Vault task to download secrets and then pass them as parameters.
- ✓ C.Use pipeline variables with 'secret: true' and reference them as $(variableName).
- D.Store secrets in a file in the repository and read it during the build.
Why C: Azure Pipelines supports secret pipeline variables that are encrypted at rest and never exposed in logs or output. By defining a variable with `secret: true` in the YAML or via the UI, you can reference it securely as `$(variableName)` in tasks, ensuring the secret value is masked during execution.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-400 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-400 exam.