AZ-400 Question 219
Select 2Your organization is setting up a new Azure DevOps pipeline to deploy multiple microservices to Azure. The pipeline must authenticate securely to Azure, retrieve secrets for database connections, and ensure that privileges granted to the pipeline are minimized. Which two actions should you implement to achieve secure and least-privileged authentication to Azure resources?
- A
Use an Azure Resource Manager (ARM) service connection with a service principal assigned the Contributor role at the subscription level for all microservices.
- B
Store pipeline secrets securely in Azure DevOps variable groups or integrate Azure Key Vault with the pipeline to retrieve secrets at runtime.
- C
Assign the service principal only the minimal roles required (e.g., Key Vault Secrets User and Reader) at the resource group or resource level.
- D
Include the necessary credentials directly in the pipeline YAML file for easy deployment and troubleshooting.
Show answer and explanation
Correct answers: B, C
Explanation
In Azure DevOps, the recommended approach is to combine a secure service connection (using a service principal) with minimal role assignments to specific resources (e.g., resource groups or Key Vault). This ensures the pipeline only has the permissions it needs to deploy and retrieve secrets, following least-privileged principles. Storing or retrieving secrets through Azure DevOps variable groups or Azure Key Vault is also recommended to avoid embedding credentials directly in source code. Refer to Microsoft documentation on Azure DevOps service connections (https://learn.microsoft.com/azure/devops/pipelines/library/service-endpoints) and Azure RBAC (https://learn.microsoft.com/azure/role-based-access-control/overview) for more details on best practices.
- A. Incorrect.
Option 1 is incorrect. While creating an ARM service connection with a service principal is generally correct, granting the Contributor role at the entire subscription level goes against the principle of least privilege. It's better to limit the scope to only what's required for the microservices (such as a resource group).
- B. Correct.
Option 2 is correct. Storing secrets in Azure DevOps variable groups (marked as secret) or using Azure Key Vault integration is a secure way to handle sensitive information. Azure DevOps variable groups encrypt these values, and Key Vault further centralizes secret management and provides better lifecycle management.
- C. Correct.
Option 3 is correct. Assigning roles such as Reader or Key Vault Secrets User at the resource group or resource level follows least-privileged access. This approach prevents granting unnecessary permissions that could affect other unrelated resources in the subscription.
- D. Incorrect.
Option 4 is incorrect. Hardcoding credentials in the pipeline YAML is a security risk and violates best practices. It exposes sensitive data in source control, making it easier for unauthorized individuals to access those credentials.