AZ-400 Practice Question: Design and implement build and release pipelines
Your team uses GitHub Actions for CI/CD. You need to ensure that secrets are not exposed in build logs. What should you use?
⚠ Common exam trap
Test-takers frequently confuse environment variables (which can be set in the workflow YAML) with GitHub Secrets, not realizing that environment variables are not automatically masked and can leak in logs, whereas GitHub Secrets are specifically designed for secure injection and automatic log redaction.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
GitHub Secrets
GitHub Secrets (Option C) is the correct choice because GitHub Actions provides a built-in encrypted secrets store that automatically masks secret values in build logs. When you reference a secret using `${{ secrets.MY_SECRET }}`, GitHub ensures the value is never printed or exposed in workflow output, unlike plaintext or environment variables that can be inadvertently logged.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Hardcoded values in the workflow YAML
Why it's wrong here
Hardcoding sensitive values directly in the workflow YAML is insecure because they are stored as plaintext in the repository, making them visible to anyone with read access to the codebase. Such values also appear in version control history and cannot be selectively masked, so they must be rotated if exposed. This approach fails to provide the encryption and log redaction that protected secret handling requires.
- ✗
Environment variables in the workflow
Why it's wrong here
Environment variables defined in the workflow are not automatically masked in build logs, so they can leak through echoed output or step commands. While they can be scoped to jobs or steps, they are still plaintext values that are stored in the workflow definition and may be inadvertently exposed during debugging. Unlike GitHub Secrets, they lack built-in encryption and centralized secret management capabilities.
- ✓
GitHub Secrets
Why this is correct
GitHub Secrets are the correct way to store sensitive data because they are encrypted at rest and only decrypted for the specific actions or workflows that reference them. Secrets are automatically masked in logs, preventing accidental exposure, and they support environment-based scoping for granular access control. This ensures credentials and API tokens remain protected throughout the CI/CD pipeline.
- ✗
Artifact storage
Why it's wrong here
Storing sensitive information in artifact storage is inappropriate because artifacts are plain files that do not provide encryption or secret masking. Any value saved in an artifact remains in its original form and can be downloaded or inspected by anyone with access to the artifact's location. This negates the security controls needed for secrets, as artifacts are intended for build outputs, not credential management.
Go deeper
Related to this question
About these practice questions
One of 823 original AZ-400 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-400 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-400 exam.