AZ-400 Practice Question: Design and implement build and release pipelines
Your organization uses GitHub Actions for CI/CD. You need to ensure that secrets are securely passed to workflows without being exposed in logs. What should you use?
⚠ Common exam trap
Many exam-takers confuse Azure DevOps encrypted variables with GitHub Secrets, assuming Azure Key Vault integration works identically in GitHub Actions, when in fact GitHub Actions requires a separate action or manual API calls to fetch secrets from Azure Key Vault.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
GitHub Secrets
GitHub Secrets (Option A) is the correct choice because GitHub Actions provides a built-in secrets management system that encrypts sensitive values at rest and masks them in all workflow logs. When you reference a secret using ${{ secrets.MY_SECRET }}, GitHub automatically redacts the value from any log output, ensuring it is never exposed during execution.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
GitHub Secrets
Why this is correct
GitHub Secrets are repository-level encrypted values that are never stored in the workflow file; GitHub encrypts each secret with a public key using the libsodium sealed box algorithm before storing it and exposes it to workflow runs only as the secrets context. During a run, GitHub injects the secret into the runner environment and automatically redacts its value from logs, and secrets are not available to pull requests from forks unless explicitly configured. This provides a secure, native mechanism for storing sensitive data like API tokens with per-environment scoping and rotation through the GitHub UI or API.
- ✗
Environment variables in the workflow YAML
Why it's wrong here
Environment variables defined in a workflow YAML are written as plain text directly in source control, so any user with read access to the repository can see them and they remain permanently in git history. Even though GitHub Actions can read them via the env context, they are not encrypted and are not automatically masked in logs; any step, including third-party actions, can print them. Because they lack encryption and access control, they are appropriate only for non-sensitive configuration values such as build modes or URLs, never for API tokens or credentials.
- ✗
Hardcode the secrets in the workflow file
Why it's wrong here
Hardcoding secrets directly in a workflow file is the opposite of secure: the values are committed into the repository, remain visible in plain text to every collaborator with read access, and become a permanent part of git history that survives branch deletion. Even updating or deleting the value later does not remove the original from history, so the secret must be considered compromised and rotated immediately. Additionally, any action running in the workflow, including untrusted third-party steps, can access and exfiltrate these hardcoded values, and GitHub's secret scanning cannot reliably detect all custom key formats.
- ✗
Azure Key Vault with Azure DevOps encrypted variables
Why it's wrong here
Azure Key Vault can be integrated with GitHub Actions via dedicated actions, but Azure DevOps encrypted variables are a feature of Azure Pipelines, not GitHub Actions, so this combination does not provide the secure secret storage mechanism needed here.
Go deeper
Related to this question
Learn chapter
Managing Infrastructure as Code Using Azure
Key term
Secrets management
Secrets management is the practice of securely storing, controlling access to, and regularly rotating sensitive credentials like passwords, API keys, and certificates used by applications and services.
Key term
GitHub
GitHub is a cloud-based platform for storing, tracking, and collaborating on code using Git version control.
About these practice questions
Courseiva writes every AZ-400 question from scratch — 823 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-400 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-400 exam.