AZ-400 Question 247
Select 2You maintain a multi-stage Azure DevOps pipeline for a .NET application that needs secure credentials (for example, a database connection string) across build and release stages. You also have a GitHub Actions workflow for a different project that requires similar credentials. You want to ensure that secrets are stored and referenced securely, minimizing exposure in logs or code. Which two approaches should you implement to properly store and reference secrets in this scenario?
- A
Store the secret in your GitHub repository codebase within an .env file and reference it in pipeline definitions.
- B
Leverage Azure Key Vault references within your Azure DevOps Pipeline to retrieve and inject secrets into the build and release stages.
- C
Use GitHub repository secrets for the GitHub Actions workflow and reference them with secrets.<SECRET_NAME> in the workflow file.
- D
Hardcode your secrets as variables directly in the azure-pipelines.yml file for faster access.
Show answer and explanation
Correct answers: B, C
Explanation
The recommended practice is to keep secrets out of source control while ensuring they can be securely injected into pipelines or workflows. In Azure DevOps, Azure Key Vault integration is a best practice for rotating and managing secrets. In GitHub Actions, the built-in Secrets feature securely stores and masks sensitive data. For more information, refer to the official documentation on Azure Key Vault integration (https://learn.microsoft.com/azure/devops/pipelines/tasks/deploy/azure-key-vault) and GitHub repository secrets (https://docs.github.com/actions/security-guides/encrypted-secrets).
- A. Incorrect.
Option 1 is incorrect. Storing secrets in the codebase (e.g., .env file) makes them visible to anyone with access to the repository, which is an insecure practice. Better approaches exist for securely managing secrets.
- B. Correct.
Option 2 is correct. Azure DevOps can securely retrieve secrets from Azure Key Vault during pipeline execution. This approach keeps secrets centralized, allows for easy rotation, and prevents exposure in repository code.
- C. Correct.
Option 3 is correct. GitHub provides a dedicated Secrets feature so that sensitive data is masked in logs and never stored in code. Referencing secrets.<SECRET_NAME> within the GitHub Actions workflow is a recommended practice.
- D. Incorrect.
Option 4 is incorrect. Storing secrets directly in pipeline definitions is unsafe and can expose them in plain text. It also complicates secret rotation and management.