AZ-400 Practice Question: Design and implement build and release pipelines
Your Azure DevOps pipeline uses a variable group to store secrets. The variable group is linked to a Key Vault. You need to use a secret variable in a pipeline task. How should you reference the secret in the YAML pipeline?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Reference the variable as $(VariableName) in the pipeline tasks.
When a variable group is linked to an Azure Key Vault, secret variables are automatically available in the pipeline. You can reference them directly using the standard $(VariableName) syntax in any pipeline task. No special task or script is required. Option A is incorrect because you do not need to restrict to script tasks or use 'env' mapping; the $(VariableName) works everywhere. Option B is incorrect because 'task.getVariable' is a scripting method used within tasks, not a YAML syntax. Option D is incorrect because the Azure Key Vault task is unnecessary; the variable group handles the retrieval automatically.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Reference the variable as $(VariableName) but only in a script task using 'env' mapping.
Why it's wrong here
You can map a secret to an environment variable in a script task using 'env', but this is an optional runtime transformation, not a requirement. The standard YAML macro syntax $(VariableName) works directly in task inputs and script arguments without needing an 'env' mapping, so restricting usage to that pattern is unnecessarily limited and incorrect.
- ✗
Use the 'task.getVariable' method in a PowerShell script.
Why it's wrong here
The 'task.getVariable' method is a runtime API available inside an Azure Pipelines task (for example, in an inline PowerShell script via the agent's task context). However, this is not a YAML syntax and does not represent how you reference a variable group secret in pipeline definitions; the correct declarative approach is the macro syntax in the YAML itself, not a script method.
- ✓
Reference the variable as $(VariableName) in the pipeline tasks.
Why this is correct
Once an Azure Key Vault variable group is linked, its secrets are automatically surfaced as pipeline variables, so you can reference them directly in any task using the macro syntax $(VariableName). This works because Azure Pipelines resolves the macro during runtime, injecting the secret's value into the task before it executes, without needing a separate Key Vault task or explicit service connection in each task.
- ✗
Use the Azure Key Vault task to retrieve the secret and then reference the output variable.
Why it's wrong here
The Azure Key Vault task is redundant when a variable group is already linked to a key vault, because Azure Pipelines automatically resolves each secret as a pipeline variable using the macro syntax in any task. Adding the Key Vault task forces you to manually map its output variables and re-specify the vault and secret filter, which duplicates the linked variable group's functionality and complicates the pipeline. Instead, the secret is available directly as $(VariableName) without any extra task, so this option misunderstands the purpose of the variable group binding.
Go deeper
Related to this question
Learn chapter
Introduction to DevOps and Azure DevOps
Key term
DevOps
DevOps is a set of practices that combines software development (Dev) and IT operations (Ops) to shorten the development lifecycle and deliver high-quality software continuously.
Key term
YAML pipeline
A YAML pipeline is a text-based file written in YAML format that defines an automated series of steps for building, testing, and deploying software in a continuous integration and continuous delivery (CI/CD) system.
About these practice questions
This AZ-400 question is part of Courseiva's 823-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-400 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-400 exam.