AZ-400 Practice Question: Design and implement build and release pipelines
Which TWO practices should you adopt to improve the security of your Azure DevOps pipeline? (Choose two.)
⚠ Common exam trap
Many exam-takers think using default hosted agents is secure because Microsoft manages them, but they overlook the risk of unpatched vulnerabilities or unnecessary software in the default image, and they may also mistakenly believe that storing secrets as pipeline variables is acceptable if they are marked as 'secret' in the UI, when in fact they are still stored in the pipeline's metadata and can be exposed in logs.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Grant the least privilege to service connections
Granting the least privilege to service connections (Option A) is a core security principle that limits the permissions of automated processes to only what is strictly necessary, reducing the blast radius of a compromised connection. Using Azure Key Vault to store secrets and fetch them at runtime (Option B) ensures that sensitive values like API keys and passwords are never exposed in pipeline definitions or logs, and are securely retrieved via managed identities or service principals at execution time.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Grant the least privilege to service connections
Why this is correct
Granting least privilege to service connections means configuring each Azure Pipelines service connection with only the minimum permissions required for its intended tasks, limiting the blast radius if credentials are compromised and preventing accidental or malicious overreach to unrelated Azure resources.
- ✓
Use Azure Key Vault to store secrets and fetch them at runtime
Why this is correct
Using Azure Key Vault to store secrets and fetching them at runtime—via variable groups or task inputs linked to Key Vault—keeps sensitive values out of pipeline definitions and logs, ensuring secrets are encrypted at rest and access is centrally auditable and revocable.
- ✗
Use the default hosted agent for all builds
Why it's wrong here
Using the default hosted agent for all builds is insecure because it provides a broad, shared environment with many preinstalled tools and elevated access to Microsoft-hosted resources, reducing control over the attack surface and making it harder to enforce custom security hardening.
- ✗
Store secrets as plain text in pipeline variables
Why it's wrong here
Storing secrets as plain text in pipeline variables is insecure because they are exposed in the pipeline definition, can be viewed by anyone with edit access, and risk being printed in logs or exported in artifacts, providing no encryption or access control at rest.
- ✗
Allow contributors to bypass the required reviewer policy
Why it's wrong here
Allowing contributors to bypass the required reviewer policy undermines security by removing mandatory human approval for pipeline changes, enabling unauthorized or malicious modifications to build and release definitions to go undetected and reducing traceability and accountability.
Quick reference
AAA Protocol Comparison
| Protocol | Port(s) | Encryption | Transport | Primary Use |
|---|---|---|---|---|
| RADIUS | 1812 / 1813 | Password only | UDP | Network access control |
| TACACS+ | 49 | Full packet | TCP | Device administration |
| Diameter | 3868 | Full session | TCP / SCTP | Carrier / mobile networks |
| 802.1X | — | EAP-based | Layer 2 | Port-based access control |
TACACS+ encrypts the entire packet; RADIUS only encrypts the password field — a key exam distinction.
Go deeper
Related to this question
Learn chapter
Introduction to DevOps and Azure DevOps
Key term
Azure Key Vault
Azure Key Vault is a cloud service for securely storing and managing sensitive information like passwords, encryption keys, and certificates.
Key term
Azure DevOps
Azure DevOps is a Microsoft service that provides development tools for planning, building, testing, and deploying software applications using automated pipelines and collaboration features.
About these practice questions
One of 823 original AZ-400 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-400 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-400 exam.