Keeping Service Principal Credentials Out of GitHub Actions Logs
Your team uses GitHub Actions for CI/CD and needs to ensure that secrets such as Azure service principal credentials are not exposed in logs. What is the best practice to prevent secret exposure?
Quick Answer
Storing credentials as GitHub Actions secrets and referencing them via ${{ secrets.SECRET_NAME }} is the built-in safeguard here — GitHub automatically masks any value matching a stored secret whenever it would otherwise appear in workflow logs, so the actual service principal credentials never show up in log output even if a step happens to print them.
⚠ Common exam trap
Many candidates confuse environment protection rules (which control deployment gates and approvals) with the built-in secret masking feature of GitHub Actions secrets, leading them to incorrectly select option C.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Store secrets as GitHub Actions secrets and reference them in workflows
GitHub Actions secrets are encrypted environment variables that are automatically masked in workflow logs when referenced. By storing Azure service principal credentials as GitHub Actions secrets and using the `${{ secrets.SECRET_NAME }}` syntax in workflows, the actual secret values are never written to logs, preventing exposure. This is the recommended approach for handling sensitive data in GitHub Actions CI/CD pipelines.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Store secrets as GitHub Actions secrets and reference them in workflows
Why this is correct
GitHub automatically redacts secrets in logs when referenced correctly.
- ✗
Store secrets in the workflow YAML file
Why it's wrong here
Storing secrets in plaintext in YAML is insecure and not recommended.
- ✗
Use environment protection rules to mask secrets
Why it's wrong here
Environment protection rules control deployments but do not mask secrets in logs.
- ✗
Encrypt workflow logs after the run completes
Why it's wrong here
Encryption after the fact does not prevent exposure during the run.
Go deeper
Related to this question
Learn chapter
Introduction to DevOps and Azure DevOps
Key term
Service principal
A service principal is an identity created for an application or automated tool to access cloud resources securely without using a human user account.
Key term
Variables
A variable is a named storage location in a computer program that holds a value which can change during execution.
About these practice questions
This AZ-400 question is part of Courseiva's 823-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on AZ-400
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Which THREE are best practices for managing secrets in GitHub Actions workflows?
hard- A.Pass secrets as environment variables to actions.
- B.Use environment secrets to restrict access to specific workflows.
- C.Store the same secret in multiple repositories for consistency.
- ✓ D.Enable secret scanning and push protection in the repository settings.
- ✓ E.Store secrets as GitHub Actions secrets instead of hardcoding them in the workflow file.
Why D: Environment secrets are scoped to environments, not workflows. They provide fine-grained control by allowing secrets to be used only by jobs that reference a specific environment. Option D is correct because enabling secret scanning and push protection helps prevent accidental exposure of secrets. Option E is correct because storing secrets as GitHub Actions secrets ensures they are encrypted and masked in logs. Option A is incorrect because passing secrets as environment variables can expose them in logs or to other actions. Option C is incorrect because storing the same secret in multiple repositories increases the risk of exposure.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-400 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-400 exam.