AZ-400 GitHub Actions Secrets Practice Question
Your team uses GitHub Actions for CI/CD. You need to ensure that secrets stored in GitHub repository secrets are not exposed in build logs. Which security practice should you implement?
⚠ Common exam trap
The trap is that even when using GitHub Actions secrets, if you output them to logs using echo or similar commands without proper masking, they can still be exposed. However, if you use the built-in secret syntax (${{ secrets.NAME }}), GitHub automatically masks them.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use GitHub Actions secrets and ensure they are marked as masked
GitHub Actions automatically masks secret values in build logs when referenced via the secrets context, such as ${{ secrets.SECRET_NAME }}. Option B is wrong because storing secrets in a repository YAML file exposes them to anyone with repo access. Option C is wrong not because environment variables are unsecurely logged, but because it is not the recommended practice; secrets should be referenced directly through the secrets context to avoid risk of unintended exposure (e.g., if the value is modified or used outside GitHub's masking). Option D, while a valid security practice, does not directly address preventing log exposure unless the fetched secrets are also masked.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Use GitHub Actions secrets and ensure they are marked as masked
Why this is correct
Use GitHub Actions secrets and ensure they are marked as masked. This is correct because secrets are automatically masked in logs when referenced via ${{ secrets.NAME }}.
- ✗
Store secrets in a YAML file within the repository
Why it's wrong here
Store secrets in a YAML file within the repository. This is insecure because anyone with repo access can see the file, and it increases the risk of log exposure.
- ✗
Pass secrets as environment variables in the workflow
Why it's wrong here
Pass secrets as environment variables in the workflow. This is not secure because environment variables can be inadvertently printed or logged by workflow steps.
- ✗
Use a third-party secret management service and fetch secrets at runtime
Why it's wrong here
Use a third-party secret management service and fetch secrets at runtime. This does not directly prevent log exposure; fetched secrets may still appear in logs if not masked.
Go deeper
Related to this question
Learn chapter
Designing a Build Pipeline
Key term
Variables
A variable is a named storage location in a computer program that holds a value which can change during execution.
Key term
Environment
An environment is a dedicated set of computing resources, configurations, and services used to develop, test, or host software applications in a controlled and repeatable way.
About these practice questions
One of 823 original AZ-400 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-400 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-400 exam.