AZ-400 Practice Question: Design and implement build and release pipelines
Your team uses GitHub Actions for CI/CD. You want to securely store a database connection string used in a workflow. Where should you store it?
⚠ Common exam trap
A common mix-up: candidates confuse environment variables (which are plain text and visible in logs) with secrets (which are encrypted and masked), leading them to choose workflow environment variables as a simpler but insecure alternative.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
GitHub Secrets.
GitHub Secrets is the correct choice because it provides encrypted storage for sensitive data like database connection strings. When you store a value in GitHub Secrets, it is encrypted via libsodium before being stored, and it is only exposed to GitHub Actions workflows as an environment variable or input when explicitly referenced. This prevents the secret from being logged or leaked in the workflow output, unlike other storage methods that risk exposure.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
GitHub Secrets.
Why this is correct
GitHub Secrets are encrypted at rest and by default are masked in workflow logs, making them the recommended way to store sensitive values like API tokens or connection strings. They can be scoped to a repository, environment, or organization and are only exposed to workflows that explicitly reference them via ${{ secrets.NAME }}.
- ✗
Workflow environment variables.
Why it's wrong here
Workflow environment variables are stored in plain text and are visible in the workflow logs if echoed or used in a step, so they are not suitable for secrets. They are meant for non-sensitive configuration values that can be safely displayed, and putting credentials there risks leakage to anyone with read access to logs.
- ✗
Directly in the workflow YAML.
Why it's wrong here
Hardcoding secrets directly into the workflow YAML embeds sensitive values in the source repository, exposing them to anyone with read access and in git history. Even if the file is later deleted, the secret remains in version control history, making this a dangerous anti-pattern for CI/CD pipelines.
- ✗
In a configuration file committed to repo.
Why it's wrong here
Committing a configuration file that contains secrets to the repository exposes the credentials to anyone with access to the repo, including in pull requests and forks, and the secrets persist in git history. This violates the principle of least privilege and can lead to immediate account compromise if the repo is public.
Go deeper
Related to this question
Learn chapter
Implementing Deployment Patterns and Strategies
Key term
GitHub
GitHub is a cloud-based platform for storing, tracking, and collaborating on code using Git version control.
Key term
Environment
An environment is a dedicated set of computing resources, configurations, and services used to develop, test, or host software applications in a controlled and repeatable way.
About these practice questions
One of 823 original AZ-400 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-400 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-400 exam.