AZ-400 Practice Question: Design and implement build and release pipelines
Your team uses Azure Pipelines for CI/CD. You need to enforce that all builds sign the assemblies with a code signing certificate stored in Azure Key Vault. What is the recommended approach?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use the 'Azure Key Vault' task to download secrets and then a 'PowerShell' task to sign.
Use the Azure Key Vault task to download the certificate as a secure secret, then use a PowerShell task to sign the assemblies with that certificate.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Store the certificate as a secure file in the pipeline library and use the 'Download Secure File' task.
Why it's wrong here
Secure files in the pipeline library are encrypted at rest, but they are intended for non-secret artifacts like provisioning scripts; a certificate with a private key is a high-value secret that requires centralized access control, auditability, and rotation. Downloading it as a secure file places the raw certificate on the agent and bypasses Azure Key Vault's integration with Azure AD and managed key lifecycle, making it a less secure and more operationally cumbersome approach.
- ✗
Embed the certificate in the repository and use a script to sign.
Why it's wrong here
Embedding the certificate in the repository is a severe security anti-pattern because it exposes the private key to anyone with repository read access, including potential attackers if the repo is made public or credentials are leaked. It also prevents proper secret rotation since the certificate remains permanently in version history, violating the principle that secrets should never be stored in source control.
- ✓
Use the 'Azure Key Vault' task to download secrets and then a 'PowerShell' task to sign.
Why this is correct
The Key Vault task downloads secrets (including certificates) and makes them available as pipeline variables.
- ✗
Use the 'Azure CLI' task to retrieve the certificate and then sign.
Why it's wrong here
While possible, the dedicated Key Vault task is the recommended approach for simplicity and security.
Go deeper
Related to this question
Learn chapter
Introduction to DevOps and Azure DevOps
Key term
Azure Pipelines
Azure Pipelines is a cloud-based CI/CD service from Microsoft that automatically builds, tests, and deploys code to any platform or cloud.
Key term
Azure Key Vault
Azure Key Vault is a cloud service for securely storing and managing sensitive information like passwords, encryption keys, and certificates.
About these practice questions
Courseiva writes every AZ-400 question from scratch — 823 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-400 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-400 exam.