AZ-400 Practice Question: Design and implement build and release pipelines
Your organization uses GitHub Actions for CI/CD. You need to ensure that secrets stored in GitHub Actions are not exposed in logs. A developer accidentally logs a secret using 'echo ${{ secrets.API_KEY }}' in a workflow step. What is the default behavior?
⚠ Common exam trap
Many candidates confuse GitHub Actions' automatic log masking with a workflow failure or pre-execution redaction, but the key is that masking happens at runtime in the log output without stopping the workflow.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The secret value is masked with asterisks in the log output
GitHub Actions automatically masks secrets in workflow logs. When a secret is used in a step (e.g., via `${{ secrets.API_KEY }}`), GitHub replaces any occurrence of the secret's value in the log output with `***`. This redaction happens at runtime, so even if a developer accidentally echoes the secret, the log will show asterisks instead of the actual value.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The secret value is replaced with an empty string in the log
Why it's wrong here
GitHub Actions never replaces a secret's value with an empty string in logs; instead, the logging system detects the known secret value and substitutes every occurrence with `***` while the original value remains available to the running step. Thus, the log shows asterisks, not a blank, and the secret is still usable.
- ✗
The workflow run fails with an error about secret exposure
Why it's wrong here
GitHub Actions does not treat secret logging as a workflow failure; the run continues normally because the secret is proactively masked in the log output. Failing the run would require an explicit step or policy, and secret-masking behavior is designed to avoid interrupting pipelines while still protecting the value.
- ✗
The secret is redacted before the step runs, and the step fails if it tries to use the secret
Why it's wrong here
Secret values are injected into the job environment and are fully usable by the step; they are not redacted or removed before execution. Masking applies only to the log output, not to the runtime environment, so a step that uses the secret succeeds normally and only its printed representation is sanitized.
- ✓
The secret value is masked with asterisks in the log output
Why this is correct
When a configured secret appears in the workflow log, GitHub Actions automatically scans the output and replaces every occurrence of the secret's value with `***` to prevent exposure. This masking occurs at the log-upload stage, so even indirect leakage via environment variables or command outputs is redacted in the displayed logs.
Go deeper
Related to this question
About these practice questions
This AZ-400 question is part of Courseiva's 823-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-400 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-400 exam.