AZ-400 Question 245
Select 2Your development team uses an Azure DevOps pipeline to build and deploy an ASP.NET Core application to an Azure Web App. The application stores database credentials in Azure Key Vault, and you need to retrieve them securely at build time. Which two actions must you take so the pipeline can pull the database credentials from Key Vault? (Choose two.)
- A
Create an Azure Key Vault reference in the pipeline YAML and configure a service connection or managed identity with 'Get' permissions on the secrets.
- B
Store the credentials in the Azure Web App� Application Settings and reference them from the pipeline instead of Key Vault.
- C
Add a variable group in Azure Pipelines that is linked to the Key Vault, and grant pipeline access to the variable group.
- D
Use the 'Upload Secure File' step in the pipeline to store the credentials and reference them directly during the build.
Show answer and explanation
Correct answers: A, C
Explanation
To securely access secrets from Azure Key Vault in Azure DevOps, the pipeline must have proper permissions (e.g., via a service connection or managed identity) and must reference the secrets either through Key Vault references in YAML or a variable group linked to Key Vault. Refer to Microsoft documentation on 'Azure Pipelines and Key Vault integration' for best practices and step-by-step guidance.
- A. Correct.
Correct. You must ensure the pipeline can authenticate to Key Vault, typically by configuring a service connection or using a managed identity with 'Get' permissions for secrets. Then, you can reference Key Vault secrets in your pipeline YAML (for example, using steps like 'azureKeyVault').
- B. Incorrect.
Incorrect. Storing credentials in Application Settings bypasses Key Vault. While this is technically possible, it is not the recommended secure practice when you already have Azure Key Vault for secrets management.
- C. Correct.
Correct. Creating a variable group linked to Azure Key Vault is another valid way to retrieve secrets securely within Azure Pipelines. You must ensure the pipeline is granted access to this variable group and that the Key Vault is accessible to the configured identity.
- D. Incorrect.
Incorrect. The 'Upload Secure File' step in Azure DevOps is for securely storing files (e.g., certificates or config files), not directly retrieving secrets from Azure Key Vault. It does not dynamically fetch secrets from Key Vault during the build.