How to Securely Store and Rotate Secrets in Azure DevOps CI/CD
Your organization uses Azure DevOps for CI/CD. You need to ensure that secrets (e.g., API keys) used in pipeline tasks are securely stored and accessed. The security requirements are: secrets must be encrypted at rest, access must be audited, and secrets must be automatically rotated. Which THREE services or features should you use? (Choose three.)
Quick Answer
The answer is Azure Key Vault, Managed Identities, and Key Vault key rotation policy. This combination meets all three security requirements because Key Vault encrypts secrets at rest and provides full audit logging via diagnostic settings, Managed Identities enable Azure DevOps pipeline tasks to authenticate to Key Vault without ever storing credentials in variables or code, and a Key Vault key rotation policy automates secret renewal for supported types like storage account keys or certificates. On the Microsoft Cybersecurity Architect exam, this scenario tests your understanding of how to integrate Azure DevOps with Azure security services rather than relying on pipeline-level secrets or Azure AD, which are common traps—pipeline secrets lack centralized management and rotation, while Azure AD is an identity provider, not a secret store. A useful memory tip is “KVM: Key Vault, Managed Identity, rotation” to recall the three pillars of secure secret lifecycle management in CI/CD.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure Key Vault access policy to grant permissions.
Azure Key Vault (C) securely stores secrets with encryption at rest and supports auditing via access logs. Access policies (A) grant granular permissions to users or applications, enabling audited access. Key rotation policy (E) allows automatic rotation of secrets, meeting the rotation requirement. While Azure DevOps Variable Groups can store secrets, they lack built-in encryption at rest and rotation capabilities, so B is incorrect. Azure AD service principals are identities, not a secret store, so D is incorrect. Therefore, the three correct choices are A, C, and E.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Azure Key Vault access policy to grant permissions.
Why this is correct
Access policies control who can read secrets, with auditing.
- ✗
Azure DevOps Variable Groups to store secrets.
Why it's wrong here
Variable groups store secrets but do not provide rotation or centralized auditing.
- ✓
Azure Key Vault to store secrets.
Why this is correct
Key Vault encrypts secrets at rest and provides access logs.
- ✗
Azure Active Directory service principal to access secrets.
Why it's wrong here
Service principals are identities, not secret storage; managed identity is better for auditing.
- ✓
Azure Key Vault key rotation policy.
Why this is correct
Key Vault supports automatic rotation for keys and secrets.
Go deeper
Related to this question
About these practice questions
One of 208 original SC-100 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SC-100
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Your organization is implementing a secure DevOps pipeline for Azure. You need to ensure that secrets (e.g., API keys) are not stored in source code and that access to production resources is controlled. Which THREE practices should you implement?
hard- A.Store secrets in Azure DevOps pipeline variables with encryption enabled
- ✓ B.Use Azure Key Vault to store secrets and retrieve them at deployment time
- ✓ C.Use Azure DevOps variable groups linked to Azure Key Vault
- D.Store secrets in a configuration file in a private Git repository
- ✓ E.Use managed identities for Azure resources to authenticate to Key Vault
Why B: The correct answers are B, C, and E. Azure Key Vault is the recommended service for storing secrets securely. Using Azure DevOps variable groups linked to Key Vault allows secrets to be referenced without exposing them in pipeline code. Managed identities provide a secure way for Azure resources to authenticate to Key Vault without storing credentials. Option A is incorrect because storing secrets in Azure DevOps pipeline variables with encryption is less secure than using Key Vault, as secrets may still be exposed in logs or exportable. Option D is incorrect because storing secrets in a configuration file in a private Git repository is insecure; even if encrypted, the key management is challenging and secrets can be accidentally exposed.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-100 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-100 exam.