AZ-400 Practice Question: Design and implement build and release pipelines

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Use a variable group linked to Azure Key Vault.

  Why this is correct

  A variable group linked to Azure Key Vault enables pipelines to reference secrets stored in Key Vault without never copying them into the pipeline definition. Access is governed by Azure RBAC, and secret values are dynamically retrieved at run time, keeping them out of source control and logs.

• ✗

  Store secrets directly in the YAML pipeline file.

  Why it's wrong here

  Storing secrets directly in a YAML pipeline file puts them into source control, where anyone with repository access can read them, and they persist in version history. This violates the principle of least privilege and makes rotation and auditing difficult, so secrets must never be committed to YAML.

• ✓

  Use the 'secret' variable type in the pipeline UI.

  Why this is correct

  Declaring a variable with the 'secret' type in the pipeline UI encrypts its value at rest and masks it in logs, preventing accidental disclosure during execution. The secret is not stored in the YAML file and must be explicitly mapped into script tasks to be used, keeping it hidden from casual inspection.

• ✗

  Use environment variables in the build agent.

  Why it's wrong here

  Using environment variables on the build agent is not inherently secure because the variable can be exposed in logs or accessed by other processes unless specifically marked as secret. Simply setting an environment variable does not provide the protections of Azure Pipelines secret variables.

• ✗

  Print the secret in a script to verify it is correct.

  Why it's wrong here

  Printing a secret to the console in a script task writes the plaintext value directly into the pipeline's live output and persisted logs, where anyone with log access can read it and where log aggregation tools may store it indefinitely. Azure Pipelines can mask secret values only when they are correctly referenced as task inputs or mapped environment variables; once you dereference the secret into a script variable and explicitly output it, the system cannot reliably intercept and redact the data. There is no legitimate need to print a secret for verification—you should validate its use implicitly, such as attempting an authenticated call or comparing a non-sensitive derived value (e.g., a fingerprint), keeping the secret itself out of stdout.

Go deeper

Related to this question