AZ-400 Practice Question: Design and implement build and release pipelines
Your organization uses GitHub Actions for CI/CD. You need to ensure that secrets stored in GitHub are not exposed in build logs. A developer accidentally printed a secret to the console in a workflow step. What built-in feature of GitHub Actions automatically prevents this?
⚠ Common exam trap
Test-takers frequently confuse secret scanning (which detects secrets in source code) with log redaction (which prevents secrets from appearing in CI/CD output), leading them to choose Option B instead of D.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Automatic log redaction
GitHub Actions includes a built-in feature that automatically redacts secrets from workflow run logs. When a secret is printed to the console, GitHub detects the secret value and replaces it with '***' in the log output, preventing accidental exposure. This redaction happens at the log rendering layer, not in the workflow execution, so the secret is never visible to users viewing the logs.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Audit log monitoring
Why it's wrong here
Audit logs record organizational events such as who triggered a workflow or changed repository settings, but they do not analyze or mask the log output of executed jobs, so they cannot prevent secrets from being displayed in run logs.
- ✗
Secret scanning alerts
Why it's wrong here
Secret scanning alerts detect known secret patterns in source code and commit history across the repository, but they do not process the runtime output of workflow jobs, so they offer no protection against secrets leaked during an actual execution.
- ✗
Required reviewers on workflows
Why it's wrong here
Required reviewers on workflows enforce a manual approval gate before a workflow can run or be modified, yet approval happens before execution and has no capability to inspect or redact the log output generated by the job at runtime.
- ✓
Automatic log redaction
Why this is correct
Automatic log redaction is the correct answer because GitHub Actions detects values of configured secrets in a job's output and replaces them with '***' in real time across all workflow run logs, effectively preventing secrets from appearing.
Go deeper
Related to this question
Learn chapter
Designing a Build Pipeline
Key term
Feature
A feature is a distinct unit of functionality that delivers value to the user, often managed and tracked throughout the software development lifecycle.
Key term
GitHub
GitHub is a cloud-based platform for storing, tracking, and collaborating on code using Git version control.
About these practice questions
This AZ-400 question is part of Courseiva's 823-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-400 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-400 exam.