AZ-400 Practice Question: Design and implement build and release pipelines
Your team uses Azure Pipelines with Microsoft-hosted agents. You need to ensure that sensitive variables like API keys are securely passed to build tasks, but not exposed in logs. Which approach should you use?
⚠ Common exam trap
A common mix-up: candidates think retrieving secrets from Key Vault is always secure, but failing to mark the output as secret (Option A) or using non-secret variable templates (Option C) will expose the value in logs, which is a common oversight.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Store the API key as a secret variable in the pipeline library or variable group
Secret variables in Azure Pipelines are encrypted at rest and masked in logs, ensuring sensitive values like API keys are never exposed. Storing the API key as a secret in a pipeline library or variable group allows it to be securely referenced by tasks without appearing in output or debug logs.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Retrieve the API key from Azure Key Vault at runtime using the Azure Key Vault task, but do not mark the output as secret
Why it's wrong here
The Azure Key Vault task can retrieve the API key, but unless its output is explicitly marked as a secret, the retrieved value is treated as plain text and can appear in pipeline logs or be exposed through debug output. Always set the variable as secret in the task's output to ensure masking.
- ✓
Store the API key as a secret variable in the pipeline library or variable group
Why this is correct
Secret variables stored in the pipeline library or a variable group are encrypted at rest with Azure Key Vault-backed encryption and are masked in all pipeline logs and output. This is the recommended approach for handling sensitive values like API keys because it centralizes secure storage and prevents accidental leakage.
- ✗
Define the API key in a variable template with 'isSecret: false'
Why it's wrong here
Variable templates are used for sharing non-sensitive configuration; setting 'isSecret: false' explicitly declares the API key as non-secret, so it is stored in plain text and will be visible in logs and during pipeline execution. Secrets should always use 'isSecret: true' or be stored directly in Azure Key Vault.
- ✗
Store the API key as a plain text variable in the pipeline and use it as an environment variable
Why it's wrong here
Storing the API key as a plain text variable makes it visible in YAML or the variable library and it can be printed in logs, especially if debug mode is enabled. Even when passed as an environment variable, the raw value remains accessible in the pipeline's metadata and logs, so this violates secure secret management.
Go deeper
Related to this question
Learn chapter
Introduction to DevOps and Azure DevOps
Key term
Library
In Azure DevOps, a Library is a central repository for managing reusable content like variable groups and secure files that can be shared across multiple pipelines.
Key term
Variables
A variable is a named storage location in a computer program that holds a value which can change during execution.
About these practice questions
One of 823 original AZ-400 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-400 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-400 exam.