SC-100 Azure Key Vault Practice Question
Your organization is implementing a secure DevOps pipeline for Azure. You need to ensure that secrets (e.g., API keys) are not stored in source code and that access to production resources is controlled. Which THREE practices should you implement?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use Azure Key Vault to store secrets and retrieve them at deployment time
The correct answers are B, C, and E. Azure Key Vault is the recommended service for storing secrets securely. Using Azure DevOps variable groups linked to Key Vault allows secrets to be referenced without exposing them in pipeline code. Managed identities provide a secure way for Azure resources to authenticate to Key Vault without storing credentials. Option A is incorrect because storing secrets in Azure DevOps pipeline variables with encryption is less secure than using Key Vault, as secrets may still be exposed in logs or exportable. Option D is incorrect because storing secrets in a configuration file in a private Git repository is insecure; even if encrypted, the key management is challenging and secrets can be accidentally exposed.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Store secrets in Azure DevOps pipeline variables with encryption enabled
Why it's wrong here
Encrypted variables in Azure DevOps are stored encrypted at rest, but once a pipeline runs, they are decrypted and injected as plaintext environment variables that any script or task can read or output to logs, and they can also be exported through the REST API by any user with pipeline edit permissions. They do not support per-secret access control, rotation schedules, or independent auditing the way Key Vault does, and they remain tied to the pipeline project's security model. Thus they are neither a replacement for nor equal to Key Vault.
- ✓
Use Azure Key Vault to store secrets and retrieve them at deployment time
Why this is correct
Azure Key Vault is the centralized, hardware-backed secret store that offers fine-grained access policies, automated certificate/secret rotation, and comprehensive audit logs. Retrieving secrets at deployment time—via tasks like the Azure Key Vault task or by referencing Key Vault in ARM templates—ensures releases always use the current secret version and never hardcode credentials in code or config files. This pattern also enables legitimate emergency credential rollover without pipeline modifications.
- ✓
Use Azure DevOps variable groups linked to Azure Key Vault
Why this is correct
Azure DevOps variable groups linked to Key Vault create a secure indirection: pipeline definitions reference variable names, and at queue time Azure DevOps retrieves the actual secret values from Key Vault using a configured service connection. This approach keeps secrets out of the repository and YAML, supports centralized secret rotation, and provides access control and auditing at the Key Vault level. It is the recommended way to consume secrets in classic and YAML pipelines.
- ✗
Store secrets in a configuration file in a private Git repository
Why it's wrong here
Storing secrets in a configuration file under a private Git repository is dangerous because repositories are often cloned to local workstations, shared with multiple developers, and persist every historical state in git history—so a secret deleted later remains recoverable. Even with private access, there are no secret-level permissions, no rotation, and no audit trail, and a single compromised developer account exposes all secrets. This violates the principle of least privilege and is why Azure Key Vault is preferred.
- ✓
Use managed identities for Azure resources to authenticate to Key Vault
Why this is correct
Managed identities give an Azure resource (for example, an Azure VM, App Service, or Azure Container Instance) an automatic, Azure AD-backed identity, allowing it to authenticate to Key Vault via the Azure Instance Metadata Service without storing any credentials in code or configuration. The identity is granted only the specific Key Vault access policies needed (such as GET on secrets), enabling zero-trust, read-only access. This approach eliminates service-principal password management and credentials rotation, making it the most secure authentication method for Azure workloads consuming Key Vault.
Go deeper
Related to this question
About these practice questions
One of 208 original SC-100 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-100 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-100 exam.