AZ-400 Practice Question: Design and implement build and release pipelines
Your build pipeline uses a YAML template that references variables from a variable group. The variable group is linked to a library. You need to ensure that sensitive variables are not exposed in logs. Which THREE actions should you take?
⚠ Common exam trap
Candidates may incorrectly think that allowing access to all pipelines is harmless or that explicitly writing secret values to logs with Write-Host is safe. In reality, both actions can expose sensitive data. Restricting library permissions is a key security measure to prevent unauthorized pipeline access.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Store the secrets in Azure Key Vault and reference them in the variable group.
To keep sensitive variables out of pipeline logs, you should store secrets in Azure Key Vault and reference them in a variable group (B), mark variables as secret in the variable group (D), and configure permissions on the library to restrict which pipelines can use the variable group (E). Key Vault integration and secret marking ensure that values are masked automatically, while restricting access limits the risk of unauthorized pipelines that could expose secrets.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Set the variable group to 'Allow access to all pipelines'.
Why it's wrong here
Setting 'Allow access to all pipelines' makes the variable group available to every pipeline in the project, significantly increasing the attack surface and risking accidental or malicious exposure of sensitive values. This setting does not provide any secret protection nor does it replace Azure Key Vault or secret variables.
- ✓
Store the secrets in Azure Key Vault and reference them in the variable group.
Why this is correct
Storing secrets in Azure Key Vault and referencing them via a variable group is the recommended secure approach, as Azure DevOps retrieves these values at runtime and automatically masks them in logs. It enables centralized secret rotation, access policies, and auditing without storing sensitive data in the pipeline definition itself.
- ✗
Use 'Write-Host' to output the variable values for debugging.
Why it's wrong here
Using Write-Host to output variable values writes them to the pipeline console, which is persisted in build logs and visible to anyone with read access. Even if the values are secret, this action forcefully leaks them, defeating the masking that Azure DevOps applies to secret variables.
- ✓
Mark the variables as 'secret' in the variable group.
Why this is correct
Marking variables as 'secret' in a variable group instructs Azure DevOps to mask their values in all logs and to prevent them from being exposed to downstream tasks unless explicitly mapped. This ensures the secret is still available to the pipeline at runtime without appearing in output.
- ✓
Configure permissions on the library to restrict which pipelines can use the variable group.
Why this is correct
Configuring permissions on the library allows you to restrict a variable group to specific pipelines, ensuring that only approved builds or releases can access its contents. This reduces the risk of unauthorized or unintended use of the secrets and is an important security control in Azure DevOps.
Go deeper
Related to this question
Learn chapter
Introduction to DevOps and Azure DevOps
Key term
Variable group
A variable group is a reusable collection of key-value pairs in Azure DevOps that can store configuration settings and secrets, shared across multiple pipelines.
Key term
Variables
A variable is a named storage location in a computer program that holds a value which can change during execution.
About these practice questions
Courseiva writes every AZ-400 question from scratch — 823 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-400 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-400 exam.