AZ-400 Practice Question: Design and implement build and release pipelines
Your team uses Azure Pipelines to build a .NET application. You need to implement a secure build pipeline that meets the following requirements: - Secrets must be injected at build time without being exposed in logs or YAML files. - The build must use Microsoft-hosted agents. - All builds must be auditable. Which TWO actions should you take? (Choose two.)
⚠ Common exam trap
The trap is confusing the OAuth token (System.AccessToken) with secret management. Although the OAuth token is masked, it is not a secret injection mechanism; it provides API access only. The correct approach combines Key Vault variable groups with token replacement tasks.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use a variable group linked to Azure Key Vault to store secrets, and reference the variable group in the pipeline.
To securely inject secrets without exposing them in logs or YAML, use a variable group linked to Azure Key Vault (B) to store secrets, and then use a token replacement task like Replace Tokens (D) to inject those secret variables into configuration files during the build. This avoids putting secrets in YAML, masks them in logs, and is auditable via Azure Key Vault and Azure DevOps audit logs. Option A, while the token is masked, is for Azure DevOps API access, not secret injection, and enabling it increases exposure risk.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable 'Allow scripts to access the OAuth token' on the agent job and use the token in scripts.
Why it's wrong here
Enabling 'Allow scripts to access the OAuth token' on the agent job grants your scripts an ephemeral, scoped access token (the System.AccessToken) without requiring a stored PAT or secret. This token lets scripts call Azure DevOps REST APIs securely, with permissions limited to the pipeline run, and all usage is auditable in the pipeline logs and Azure DevOps activity records.
- ✓
Use a variable group linked to Azure Key Vault to store secrets, and reference the variable group in the pipeline.
Why this is correct
A variable group linked to Azure Key Vault securely stores secrets outside the pipeline definition and injects them at runtime as masked variables. This approach avoids hardcoding secrets in YAML, leverages Key Vault's access policies and audit logs, and simplifies secret rotation by updating the vault without editing the pipeline.
- ✗
Store secrets as plain-text environment variables in the pipeline YAML file.
Why it's wrong here
Storing secrets as plain-text environment variables in the pipeline YAML file exposes them in version control history and to anyone with repository read access. Additionally, they can appear in build logs or debug output, directly violating security best practices and potentially compromising the application's credentials.
- ✓
Use the 'Replace Tokens' task to substitute secrets from pipeline variables into configuration files.
Why this is correct
Secrets in variables are masked but cannot be directly used in file transforms without exposing them.
- ✗
Deploy a self-hosted agent on-premises to keep secrets within the corporate network.
Why it's wrong here
Self-hosted agents are not required and may not be compliant with the Microsoft-hosted agent requirement.
Go deeper
Related to this question
Learn chapter
Introduction to DevOps and Azure DevOps
Key term
DevOps
DevOps is a set of practices that combines software development (Dev) and IT operations (Ops) to shorten the development lifecycle and deliver high-quality software continuously.
Key term
Azure Key Vault
Azure Key Vault is a cloud service for securely storing and managing sensitive information like passwords, encryption keys, and certificates.
About these practice questions
This AZ-400 question is part of Courseiva's 823-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-400 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-400 exam.