AZ-400 Develop a security and compliance plan Practice Question
Your organization uses Azure DevOps with classic pipelines. Security audit requires that all pipeline variables containing secrets (e.g., API keys) are stored in Azure Key Vault and referenced dynamically. Currently, secrets are stored as plain text in the pipeline UI. You need to migrate to Key Vault with minimal downtime and ensure that secret values are never exposed in logs. What should you do?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a variable group linked to Key Vault, mark variables as 'secret', and reference them in pipelines. Update pipeline steps to use the variable group.
The correct approach is to create a variable group linked to Azure Key Vault in the Library, mark the variables as 'secret', and reference that variable group in the pipeline. This ensures secrets are stored in Key Vault (not in Azure DevOps) and masked in logs. Option A (secure file) still stores secrets in Azure DevOps and may not prevent log exposure. Option C (Azure Key Vault task) downloads secrets as pipeline variables, which could expose them if not properly masked. Option D (secret pipeline variables) stores secrets in Azure DevOps, not Key Vault, and while masked, they remain in the pipeline definition.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Store secrets in a secure file in Azure DevOps.
Why it's wrong here
A secure file in Azure DevOps is downloaded to the agent workspace, but its contents are not automatically masked in pipeline logs. If any step echoes the file path, prints the file, or uses it in a command that writes to output, the secret can leak. Secure files also lack Key Vault's centralized access policies, rotation, and audit trail, so they are not the recommended mechanism for runtime secrets.
- ✓
Create a variable group linked to Key Vault, mark variables as 'secret', and reference them in pipelines. Update pipeline steps to use the variable group.
Why this is correct
Create a variable group linked to an Azure Key Vault and select the secrets to expose. The linked variable group automatically loads those secrets as pipeline variables, and each one is implicitly treated as secret, so Azure DevOps masks its value in every log. Update your pipeline steps to reference $(secret-name) instead of hardcoding values; this also lets you rotate secrets in Key Vault without redeploying pipelines and gives you centralized access control and auditing through the vault.
- ✗
Use the 'Azure Key Vault' task to download secrets as pipeline variables.
Why it's wrong here
The Azure Key Vault task explicitly downloads secrets into pipeline variables, but it requires you to name each secret as an output variable. Unlike a linked variable group, the task does not automatically mask the downloaded values in all subsequent task arguments, and a single echo or DEBUG-enabled step can reveal the secret in plain text. Modern guidance favors the variable group approach because it integrates with the pipeline's secret-handling mechanisms and reduces manual mapping errors.
- ✗
Add each secret as a pipeline variable with the 'secret' type.
Why it's wrong here
Pipeline variables marked as 'secret' are encrypted at rest and masked in logs, but they are still stored in Azure DevOps and managed through the project's pipeline settings. They are not connected to Key Vault, so you cannot enforce centralized rotation, set Key Vault access policies, or easily reuse the same set of secrets across many pipelines without duplicating entries. Users with pipeline edit permissions can also overwrite or read the values, making this less secure than a linked variable group.
Go deeper
Related to this question
Learn chapter
Introduction to DevOps and Azure DevOps
Key term
Pipeline
A pipeline is an automated series of steps that takes code from development to production, ensuring quality and speed.
Key term
Task
A Task in Azure DevOps is a predefined, reusable step that performs a specific action during a build or release pipeline, like compiling code or running tests.
About these practice questions
One of 823 original AZ-400 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-400 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-400 exam.