AZ-400 YAML templates Practice Question
You are designing a security compliance plan for Azure Pipelines. The plan must ensure that no pipeline can use variables containing secrets unless those variables are stored in Azure Key Vault and referenced via a variable group linked to Key Vault. What is the best way to enforce this across all pipelines in an Azure DevOps organization?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a YAML template that mandates the use of Key Vault references.
You can enforce a YAML template at the organization level using required template policies. This ensures all pipelines include a template that mandates Key Vault references for secrets, providing a scalable enforcement mechanism. Option B is incorrect because Azure Policy applies to Azure resources, not Azure DevOps constructs like variable groups. Option C is incorrect because manual approvals do not enforce Key Vault usage. Option D is incorrect because branch policies control code, not variable usage during execution.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Create a YAML template that mandates the use of Key Vault references.
Why this is correct
A YAML template can enforce secure secret management across all pipelines by defining a standard structure that must be extended. Using the Azure DevOps 'required template' feature (under project settings or via pipeline decorators), you can force every pipeline to use a template that injects an AzureKeyVault task or a Key Vault-linked variable group, and optionally includes a script that fails the build if any inline secrets are detected. This gives you a central, versioned mechanism to mandate Key Vault references, which is enforceable at queue time rather than relying on manual review.
- ✗
Implement an Azure Policy that audits variable groups and requires Key Vault integration.
Why it's wrong here
Azure Policy is an Azure Resource Manager service that only evaluates Azure resources within a subscription, such as VMs, storage accounts, and Azure Key Vault instances. Variable groups and pipeline definitions live in the Azure DevOps data plane, outside the scope of Azure Policy, so the service cannot audit or enforce Key Vault integration for them. Even if you could scope Azure Policy to Azure DevOps, it would not be able to inspect the contents of a variable group that references a Key Vault entry; that coupling is managed entirely within the Azure DevOps service.
- ✗
Require manual approval for all pipeline runs that use variables.
Why it's wrong here
Manual approval gates are a process control, not a technical enforcement mechanism. They depend on a human reviewer catching a security issue and do not verify that variables are sourced from a secure store like Key Vault. Moreover, Azure DevOps approvals are bound to environments or stages, not to arbitrary conditions like 'when a variable is used,' so this approach cannot be implemented as stated and would create a false sense of security.
- ✗
Use branch policies to prevent merging code that contains secrets.
Why it's wrong here
Branch policies protect the source code repository at merge time by running checks like pull request validations, but they have no control over the configuration that gets evaluated when a pipeline runs. Once a pipeline executes, it can still consume secrets from variable groups, environment variables, or inline YAML regardless of what was scanned during a PR. Even if a branch policy scans for secrets in committed code, it does not enforce how those secrets are stored or referenced in the pipeline definition, so a malicious or careless pipeline author could bypass it by using a variable group that contains unencrypted values.
Go deeper
Related to this question
Learn chapter
Introduction to DevOps and Azure DevOps
Key term
Branch
A branch is a pointer to a specific commit in a version control system that allows you to work on features or fixes in isolation from the main codebase.
Key term
Azure Policy
Azure Policy is a service in Microsoft Azure that lets you create, assign, and manage rules to ensure your resources stay compliant with your company standards and service-level agreements.
About these practice questions
One of 823 original AZ-400 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-400 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-400 exam.