AZ-400 Question 241
Select 2Your development team is configuring an Azure DevOps pipeline that deploys a containerized application to Azure Kubernetes Service (AKS). The pipeline must contact a third-party REST API that requires a confidential API key. You want to ensure that the API key remains secret throughout the automation process and is never visible in code or pipeline logs. Which two solutions should you implement to securely store and retrieve this sensitive key in your pipeline?
- A
Store the API key in an Azure DevOps library variable group, mark it as secret, and limit pipeline access to that variable group.
- B
Hardcode the API key in your pipeline YAML file and rely on the built-in masking feature to hide it from logs.
- C
Use Azure Key Vault to securely store the API key and reference it directly from your pipeline tasks.
- D
Commit the API key as a Base64-encoded string to your repository, then decode it at runtime in the pipeline.
Show answer and explanation
Correct answers: A, C
Explanation
In Azure DevOps, correctly managing secrets involves storing them in secure locations like Azure Key Vault or secret variables within variable groups, rather than embedding them in code or repositories. Azure DevOps offers built-in integrations with Azure Key Vault (https://learn.microsoft.com/azure/devops/pipelines/tasks/reference/azure-key-vault-task) and secret variable groups (https://learn.microsoft.com/azure/devops/pipelines/library/variable-groups) to help protect sensitive information. Encoding or masking alone does not provide genuine protection, since secrets may still be exposed to unauthorized users.
- A. Correct.
Correct. Using an Azure DevOps variable group and marking the value as secret ensures that sensitive data is not exposed in logs or source code. Additionally, restricting access to that variable group allows only authorized pipelines or team members to use it.
- B. Incorrect.
Incorrect. Although masking hides secret values in logs, hardcoding secrets in YAML files is not considered secure. Anyone with access to the repository can view the pipeline YAML and extract the secret.
- C. Correct.
Correct. Azure Key Vault is a best-practice solution for managing secrets, keys, and certificates. Integrating Key Vault with Azure DevOps allows pipelines to pull the required secret securely without human intervention or exposure in logs.
- D. Incorrect.
Incorrect. Encoding the API key (e.g., Base64) does not provide real security. If someone gains access to the repository, they can easily decode the secret. This approach violates best practices for managing sensitive information.