AZ-400 Question 243
Select 2Your development team is creating an Azure DevOps pipeline that automates deployment of a microservices application. The pipeline requires database connection strings and API keys that must remain confidential during build and release stages. The team also wants to simplify secret rotation without exposing any credentials in logs or source code. Which two strategies should you implement to meet these requirements?
- A
Store secrets in Azure Key Vault and use Key Vault references within the pipeline to retrieve them securely.
- B
Use Azure DevOps secret variables in a variable group configured with Key Vault integration for automatic secret rotation.
- C
Embed secrets in the pipeline YAML file via Base64 encoding to avoid storing them as plain text.
- D
Push secrets to a private Git repository so that only authenticated team members can view them.
Show answer and explanation
Correct answers: A, B
Explanation
The most secure and efficient ways to manage sensitive information in Azure DevOps pipelines are to use Azure Key Vault and/or Azure DevOps secret variables. Azure Key Vault provides centralized secret management with rotation capabilities, while Azure DevOps variable groups protect secrets from being exposed as plain text. For more details, refer to Azure DevOps documentation on securely storing secrets and integrating with Azure Key Vault at https://learn.microsoft.com/azure/devops/pipelines/release/azure-key-vault.
- A. Correct.
Correct. Azure Key Vault is designed to securely store secrets, keys, and certificates. Azure DevOps can be configured to access these secrets at runtime, preventing exposure in logs or source code. This also allows easy rotation of secrets without changing the pipeline� code.
- B. Correct.
Correct. Secret variables in Azure DevOps can be stored in variable groups. When you integrate a variable group with Key Vault, secrets can be automatically updated from Key Vault and remain encrypted at rest. This approach avoids embedding secrets directly in source control or pipeline files.
- C. Incorrect.
Incorrect. Base64 encoding is not encryption. A simple decoding step reveals the secrets. Storing secrets in the YAML file�even if encoded�makes them more susceptible to accidental exposure and does not simplify rotation.
- D. Incorrect.
Incorrect. While restricting repository access is important, storing secrets directly in any repository still poses a risk of inadvertent exposure or improper access. It also complicates rotation since you would need to change the secrets in the repository and ensure they are not retained in git history.