Develop a security and compliance plan →mediumMultiple ChoiceObjective-mapped

AZ-400 Develop a security and compliance plan Practice Question

Exhibit

Refer to the exhibit.

```yaml
# azure-pipelines.yml
variables:
- group: 'prod-variables'
- name: 'DB_PASSWORD'
  value: $(prod-db-password)
```

You are reviewing a pipeline YAML file. The variable 'prod-db-password' is stored in a variable group linked to Azure Key Vault. However, the pipeline fails with an error that the secret cannot be accessed. What is the most likely cause?

⚠ Common exam trap

Candidates often assume the variable group link automatically grants access to Key Vault secrets, overlooking the separate requirement to configure Key Vault access policies for the pipeline's service principal.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The pipeline's authorized service principal lacks 'Get' permission on the Key Vault.

The most likely cause is that the pipeline's authorized service principal lacks 'Get' permission on the Key Vault. When a variable group is linked to Azure Key Vault, Azure Pipelines uses a service principal (the pipeline's identity) to retrieve secrets. Even if the variable group and secret name are correct, the pipeline will fail if the service principal does not have the 'Get' secret permission in the Key Vault access policy. This is a common misconfiguration because the variable group link only establishes the mapping, not the actual access rights.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The YAML syntax for referencing the variable is incorrect.
Why it's wrong here
In Azure Pipelines, variables defined in variable groups are correctly referenced using the macro syntax $(variable-name). The syntax $(prod-db-password) is valid for both YAML and classic pipelines, so a syntax error would be a different issue (e.g., malformed YAML or an unescaped character).
✓
The pipeline's authorized service principal lacks 'Get' permission on the Key Vault.
Why this is correct
When a variable group is linked to an Azure Key Vault, the Azure DevOps task attempts to retrieve secrets using the service principal associated with the pipeline's service connection. If that service principal lacks the 'Get' permission in the Key Vault's access policy for the secret, the task will fail specifically with an authorization error, making this the likely root cause.
✗
The variable group 'prod-variables' does not exist.
Why it's wrong here
If the variable group 'prod-variables' did not exist, the pipeline would fail during compilation with an error like 'The variable group ... was not found.' The error described is a runtime secret retrieval failure, so the variable group itself must exist and be linked correctly to the Key Vault.
✗
The secret name in Key Vault does not match 'prod-db-password'.
Why it's wrong here
If the secret name did not match the key 'prod-db-password', the Key Vault task would return a 'Secret not found' or 'ResourceNotFound' error. The error for a missing secret is distinct from an access-denied or insufficient-permissions error, so a naming mismatch would present differently than the described scenario.

Go deeper

AZ-400 Develop a security and compliance plan Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question