AZ-400 Question 218
Single answerYou have a multi-stage Azure DevOps pipeline that deploys a web application to Azure. The pipeline needs to retrieve secrets from Azure Key Vault but must not be able to modify or delete any secrets. Additionally, you want to minimize credential management overhead. Which approach should you use to configure authentication and authorization for secure access to Azure Key Vault?
- A
Store all necessary secrets directly in the pipeline variables and reference them from your tasks.
- B
Create a service principal with a minimal set of permissions (Get, List) on the Key Vault, store the service principal credentials in an Azure DevOps secure variable, and reference them in your pipeline.
- C
Grant the pipeline identity the Key Vault Contributor role through Azure RBAC, allowing it to manage keys and secrets in the vault.
- D
Use an Azure AD user account with full administrative rights to the Key Vault and store that account� credentials in your pipeline variables.
Show answer and explanation
Correct answer: B
Explanation
In Azure DevOps, creating a service principal with only the necessary Key Vault permissions (Get and List for secrets) is the recommended practice to enforce least privilege. You then store the service principal credentials in a secure variable within your pipeline. This ensures the pipeline can access secrets without the ability to modify or delete them, aligning with Microsoft� best practices for secure credential management. Refer to Azure Key Vault documentation (https://learn.microsoft.com/azure/key-vault/) and Azure DevOps documentation on service connections (https://learn.microsoft.com/azure/devops/pipelines/library/service-endpoints) for more details.
- A. Incorrect.
Option 1 is incorrect because storing secrets in the pipeline variables exposes them to potential accidental disclosure, and it doesn't enforce strong Key Vault access controls.
- B. Correct.
Option 2 is correct. By creating a service principal with only 'Get' and 'List' permissions (via an access policy or minimal RBAC role) and securely storing its credentials in Azure DevOps, you ensure that your pipeline can read secrets but not modify or delete them. This approach also reduces credential sprawl.
- C. Incorrect.
Option 3 is incorrect because granting the Contributor role goes beyond minimal required permissions, enabling modification or deletion of secrets in the vault, which violates the principle of least privilege.
- D. Incorrect.
Option 4 is incorrect because using a full administrative user account is insecure, provides more permissions than needed, and unnecessarily complicates credential management.