AZ-400 Question 246
Select 2You have an Azure DevOps pipeline that needs to retrieve application secrets stored in Azure Key Vault at runtime. You want to ensure that the pipeline can securely access the secrets without putting them directly in the pipeline configuration. Which two actions should you take to accomplish this?
- A
Create a variable group in Azure DevOps that references the Azure Key Vault, and link it to your pipeline.
- B
Grant the pipeline� service principal or managed identity 'Get' and 'List' secret permissions using a Key Vault access policy.
- C
Disable the Soft Delete feature in Azure Key Vault to simplify access for the pipeline.
- D
Store secrets in plain text within the Azure DevOps pipeline variables to ensure easy retrieval.
Show answer and explanation
Correct answers: A, B
Explanation
To securely retrieve secrets from Azure Key Vault in an Azure DevOps pipeline, you must ensure your pipeline identity has appropriate Access Policies or Azure RBAC roles to access Key Vault, and then configure references to Key Vault in DevOps (for example, using a variable group or Key Vault task). The official Microsoft documentation (https://learn.microsoft.com/azure/devops/pipelines/library/variable-groups?view=azure-devops and https://learn.microsoft.com/azure/key-vault/general/how-it-works) provides guidance on setting up variable groups with Key Vault and granting permissions so that DevOps pipelines can properly and securely access stored secrets.
- A. Correct.
Correct. Referencing the Key Vault from a variable group in Azure DevOps is one common way to securely pull secrets without exposing them in the code or pipeline settings. This action ensures that the pipeline tasks can request the secrets during runtime.
- B. Correct.
Correct. Granting the pipeline� identity the necessary permissions via a Key Vault access policy is critical. Without proper permissions, the pipeline can't access the secrets. The 'Get' and 'List' permissions allow the pipeline to retrieve secret values when needed.
- C. Incorrect.
Incorrect. Soft Delete protects keys and secrets from accidental deletion, but enabling or disabling it does not affect the pipeline� ability to retrieve secrets. Soft Delete is a safety net for recovery and does not simplify or complicate pipeline secret access.
- D. Incorrect.
Incorrect. Storing secrets in plain text within pipeline variables is a security risk and bypasses the main benefit of using Key Vault. Azure Key Vault prevents exposing secrets in code or logs, which is essential for secure DevOps practices.