AZ-400 Practice Question: Design and implement build and release pipelines
Your organization uses Azure DevOps and GitHub. You need to ensure that secrets such as API keys are not exposed in pipeline logs. What should you do?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Store the API key in Azure Key Vault and use a variable group linked to the vault
Both secret variables and variable groups linked to Azure Key Vault are masked in pipeline logs. Azure Pipelines automatically masks secret variables, and variables from Key Vault variable groups are also treated as secrets. Therefore, both B and C prevent exposure. The question asks 'what should you do?' without requiring a single best method, so both B and C should be considered correct.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Store the API key in a plain text variable and reference it as $(apiKey)
Why it's wrong here
Plain text variables are stored and injected as clear text in Azure Pipelines, so when referenced via $(apiKey) the value can be echoed by tasks, included in debug logs, or captured in script output without any masking. Anyone with access to the pipeline's logs or run details could recover the API key, making this an insecure practice.
- ✓
Store the API key in Azure Key Vault and use a variable group linked to the vault
Why this is correct
Azure Key Vault integration is a valid way to store secrets, but it requires creating a variable group, linking it to the vault, and configuring a service connection with appropriate Key Vault access policies. This approach works but is heavier-weight than a simple secret variable and still requires the pipeline to reference the secret explicitly, so it is not the most direct secure option.
- ✓
Store the API key in a secret variable
Why this is correct
Secret variables in Azure Pipelines are encrypted at rest, decrypted only for the scope of a single run, and automatically masked in all logs, including task output and debug logs. Referencing the value with $(apiKey) or through the environment variable mapping ensures the API key is not exposed in plain text, making this the simplest and most secure method.
- ✗
Use the Logging Command to suppress output
Why it's wrong here
Logging commands such as ##vso[task.setvariable] or ##vso[task.logissue] control the agent's output stream but do not redact or suppress secret values. If a secret is passed as an argument to a logging command, it can still be logged, and other tasks or scripts can output the value, so this is not a security control for protecting secrets.
Go deeper
Related to this question
Learn chapter
Introduction to DevOps and Azure DevOps
Key term
GitHub
GitHub is a cloud-based platform for storing, tracking, and collaborating on code using Git version control.
Key term
Azure Pipelines
Azure Pipelines is a cloud-based CI/CD service from Microsoft that automatically builds, tests, and deploys code to any platform or cloud.
About these practice questions
One of 823 original AZ-400 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-400 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-400 exam.