AZ-400 Question 242
Single answerYou are designing a new Azure DevOps pipeline to automate deployments for multiple teams. These deployments require sensitive credentials (such as API keys and database passwords) that must be frequently rotated across different environments. The organization mandates that only authorized team members have access to these secrets and that changes in secret values should not disrupt the pipeline. Which solution best meets these requirements?
- A
Store all credentials in an Azure Key Vault and reference them from the pipeline using Azure DevOps Key Vault integration.
- B
Embed credentials in the YAML file as secure variables and rely on Azure DevOps repository permissions for access control.
- C
Store credentials in a version-controlled encrypted file and share the decryption key separately with all team members.
- D
Use a pipeline variable group with non-secret variables and rely on user role assignments in Azure DevOps to control access.
Show answer and explanation
Correct answer: A
Explanation
Azure Key Vault is a recommended, centralized secret store that integrates seamlessly with Azure DevOps, enabling secure retrieval of secrets during pipeline runs. It also facilitates secret rotation and granular access control. Refer to official Microsoft documentation (https://learn.microsoft.com/azure/devops/pipelines/release/key-vault) for details on configuring Azure DevOps to securely consume secrets from Key Vault.
- A. Correct.
Correct. Azure Key Vault allows secure, centralized management of credentials and supports secret rotation. By integrating Key Vault with Azure DevOps, you can reference secrets without exposing them in plain text, and manage access through Key Vault policies.
- B. Incorrect.
Incorrect. While marking variables as secure in YAML hides them in logs, embedding them in code still poses a risk. Access is less granular than policy-based approaches in Key Vault, and rotating secrets frequently is more cumbersome.
- C. Incorrect.
Incorrect. Storing credentials in a version-controlled file, even if encrypted, substantially increases the risk of unauthorized access or key mismanagement. Managing multiple decryption keys also becomes complex and prone to human error.
- D. Incorrect.
Incorrect. Non-secret variables are visible to anyone with access to the pipeline, and rotating these values can be more difficult. They do not provide the same level of security or isolation as a dedicated secret store like Azure Key Vault.