AZ-400 Practice Question: Design and implement build and release pipelines
Your organization uses GitHub Actions for CI/CD. You need to ensure that secrets used in workflows are not exposed in logs. What should you do?
⚠ Common exam trap
Test-takers frequently think disabling logging or manually encrypting secrets is sufficient, but GitHub Actions already provides automatic log masking via GitHub Secrets, making those workarounds unnecessary and insecure.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Store the secret in GitHub Secrets and reference it as ${{ secrets.SECRET_NAME }}.
GitHub Secrets are encrypted environment variables that are automatically masked in workflow logs. When you reference a secret using the `${{ secrets.SECRET_NAME }}` syntax, GitHub Actions ensures the value is never printed in plain text, even if the workflow attempts to echo it. This is the built-in, secure method for handling sensitive data in CI/CD pipelines.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Encrypt the secret with a password before using it.
Why it's wrong here
Encrypting the secret with a password before using it does not prevent the plaintext value from being printed to workflow logs; the decrypted secret is still exposed when the step executes, and the encryption key/password itself would need to be stored or passed, creating a key-management risk.
- ✗
Use the 'echo' command to output the secret and then delete the log.
Why it's wrong here
Using 'echo' to output the secret and then deleting the log is ineffective because the log entry is written before deletion and may be persisted or replicated in archives, and GitHub Actions does not retroactively mask values that were already printed, leaving the secret exposed.
- ✓
Store the secret in GitHub Secrets and reference it as ${{ secrets.SECRET_NAME }}.
Why this is correct
Storing the secret in GitHub Secrets and referencing it as ${{ secrets.SECRET_NAME }} is the correct approach because GitHub Actions automatically masks the secret's value in all logs, and the secret is only injected into the workflow at runtime without being visible in the workflow definition.
- ✗
Disable logging on the self-hosted runner.
Why it's wrong here
Disabling logging on the self-hosted runner does not prevent the secret from being exposed; runner logs are still generated and stored by the runner service, and disabling or redirecting logs can mask other critical diagnostics while failing to scrub the secret from the underlying log files.
Go deeper
Related to this question
Learn chapter
Managing Infrastructure as Code Using Azure
Key term
Variables
A variable is a named storage location in a computer program that holds a value which can change during execution.
Key term
GitHub
GitHub is a cloud-based platform for storing, tracking, and collaborating on code using Git version control.
About these practice questions
One of 823 original AZ-400 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-400 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-400 exam.