Why a Variable Group Can't Find a Secret That Exists in Key Vault

• A.Reference the variable as $(VariableName) but only in a script task using 'env' mapping.
• B.Use the 'task.getVariable' method in a PowerShell script.
• ✓ C.Reference the variable as $(VariableName) in the pipeline tasks.
• D.Use the Azure Key Vault task to retrieve the secret and then reference the output variable.

Why C: When a variable group is linked to an Azure Key Vault, secret variables are automatically available in the pipeline. You can reference them directly using the standard $(VariableName) syntax in any pipeline task. No special task or script is required. Option A is incorrect because you do not need to restrict to script tasks or use 'env' mapping; the $(VariableName) works everywhere. Option B is incorrect because 'task.getVariable' is a scripting method used within tasks, not a YAML syntax. Option D is incorrect because the Azure Key Vault task is unnecessary; the variable group handles the retrieval automatically.

• A.Set the variable group to 'Allow access to all pipelines'.
• ✓ B.Store the secrets in Azure Key Vault and reference them in the variable group.
• C.Use 'Write-Host' to output the variable values for debugging.
• ✓ D.Mark the variables as 'secret' in the variable group.
• ✓ E.Configure permissions on the library to restrict which pipelines can use the variable group.

Why B: To keep sensitive variables out of pipeline logs, you should store secrets in Azure Key Vault and reference them in a variable group (B), mark variables as secret in the variable group (D), and configure permissions on the library to restrict which pipelines can use the variable group (E). Key Vault integration and secret marking ensure that values are masked automatically, while restricting access limits the risk of unauthorized pipelines that could expose secrets.

• A.Store the API key in a plain text variable and reference it as $(apiKey)
• ✓ B.Store the API key in Azure Key Vault and use a variable group linked to the vault
• ✓ C.Store the API key in a secret variable
• D.Use the Logging Command to suppress output

Why B: Both secret variables and variable groups linked to Azure Key Vault are masked in pipeline logs. Azure Pipelines automatically masks secret variables, and variables from Key Vault variable groups are also treated as secrets. Therefore, both B and C prevent exposure. The question asks 'what should you do?' without requiring a single best method, so both B and C should be considered correct.

• ✓ A.Use the Azure Key Vault task to download secrets as variables
• ✓ B.Use secret variables in the pipeline that reference Key Vault secrets
• C.Store secrets as plain text variables in the pipeline library
• D.Hardcode secrets in the YAML file and use variables to mask them
• ✓ E.Grant the build agent managed identity access to the Key Vault

Why A: The Azure Key Vault task in Azure Pipelines can download secrets as pipeline variables at runtime, allowing the pipeline to securely reference them without exposing the secret values in logs or configuration. This task authenticates to Key Vault using a service connection or managed identity, ensuring secrets are never stored in the pipeline definition.

• A.Store secrets in a secure file in Azure DevOps.
• ✓ B.Create a variable group linked to Key Vault, mark variables as 'secret', and reference them in pipelines. Update pipeline steps to use the variable group.
• C.Use the 'Azure Key Vault' task to download secrets as pipeline variables.
• D.Add each secret as a pipeline variable with the 'secret' type.

Why B: The correct approach is to create a variable group linked to Azure Key Vault in the Library, mark the variables as 'secret', and reference that variable group in the pipeline. This ensures secrets are stored in Key Vault (not in Azure DevOps) and masked in logs. Option A (secure file) still stores secrets in Azure DevOps and may not prevent log exposure. Option C (Azure Key Vault task) downloads secrets as pipeline variables, which could expose them if not properly masked. Option D (secret pipeline variables) stores secrets in Azure DevOps, not Key Vault, and while masked, they remain in the pipeline definition.

• A.Use Azure App Configuration with Key Vault references
• ✓ B.Create a Variable Group linked to Azure Key Vault
• C.Use Azure Kubernetes Service secrets
• D.Use pipeline variables marked as 'secret'

Why B: Variable Groups linked to Azure Key Vault allow you to securely store secrets in Key Vault and reference them in pipelines without exposing the actual values in logs or output. Option A is incorrect: Azure App Configuration with Key Vault references is designed for application configuration, not for managing pipeline secrets directly. Option C is incorrect: Azure Kubernetes Service (AKS) secrets are specific to Kubernetes workloads and not intended for general pipeline secret management. Option D is incorrect: Pipeline variables marked as 'secret' are masked in logs, but they are still stored in Azure DevOps and lack the centralized security and auditing capabilities of Key Vault.

• ✓ A.Store the secret in a variable group linked to Key Vault and reference it without marking it secret.
• B.Add the secret as a plain text variable in the pipeline YAML.
• C.Use a Key Vault task to fetch the secret and map it to a pipeline variable marked 'secret'.
• D.Add the secret to the repository's .env file and use a script to read it.

Why A: To securely use a secret from Azure Key Vault in an Azure Pipeline without exposing it in logs, the simplest and recommended approach is to create a variable group linked to the Key Vault. When you reference the secret by name, Azure Pipelines automatically masks its value in logs. There is no need to manually mark the variable as secret; the linked variable group handles it. The Azure Key Vault task is an alternative but not the primary method; additionally, the task automatically creates secret variables and does not require manual mapping.

• ✓ A.Create a variable group linked to Key Vault, then reference as $(KeyVaultName.SecretName)
• B.Use the 'Azure Key Vault' task to download secrets and assign to variables
• C.Store the secret as a plain text variable and mark it as 'secret'
• D.Reference the secret directly as $(SecretName) from a library variable group

Why A: To securely reference an Azure Key Vault secret without exposing the value in logs, create a variable group linked to the Key Vault. This automatically maps each secret to a pipeline variable whose name equals the secret name and masks its value. Reference it directly as $(SecretName). Option A identifies the correct variable group type but uses an incorrect reference. Option D uses the correct reference but does not explicitly state that the variable group must be linked to Key Vault. Therefore, none of the options are fully correct.