AZ-400 Practice Question: Design and implement build and release pipelines

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Use a custom action to manually mask secrets in the logs.

  Why it's wrong here

  Manual masking in a custom action is fragile and incomplete because it requires anticipating every format a secret might appear in (e.g., URL-encoded, base64, substrings) and cannot retroactively redact values already printed. GitHub's built-in secret masking automatically captures the exact secret value and redacts it across all log outputs, so a custom action adds unnecessary complexity and risk of exposure.

• ✗

  Define secrets as environment variables directly in the workflow YAML.

  Why it's wrong here

  Hardcoding secrets directly in the workflow YAML exposes them to anyone with read access to the repository, and GitHub does not automatically mask values that are literally written in the workflow file. Secrets should be stored in GitHub repository secrets (or environment secrets) and referenced via ${{ secrets.SECRET_NAME }}, which ensures encryption at rest and automatic masking in logs.

• ✓

  Store secrets in GitHub repository secrets and reference them in workflows using ${{ secrets.SECRET_NAME }}. GitHub automatically masks secrets in logs.

  Why this is correct

  This is the recommended approach because GitHub encrypts secrets at rest, restricts access to authorized users/actions, and automatically detects the exact secret value used in the workflow to redact it from all log output. Referencing secrets via ${{ secrets.SECRET_NAME }} keeps the actual value out of the YAML source and ensures that any accidental printing of that value is masked in real time.

• ✗

  After the workflow runs, delete the logs from GitHub.

  Why it's wrong here

  Deleting logs after the fact does not prevent exposure in real time if a secret is printed during the run, and it also does not guarantee removal of any cached or forwarded copies. Additionally, deleting logs is an operational workaround that fails to address the root cause; secret values should be protected during execution, not simply cleaned up afterward.

Go deeper

Related to this question