AZ-400 Question 248
Select 2Your organization needs to store and use an Azure Storage account key for application deployments. The deployment pipelines run both in GitHub Actions and Azure Pipelines. The DevOps team wants to ensure the secret key is never exposed in plain text or committed to source control. Which two methods should you use to securely manage and consume this secret across both pipeline platforms?
- A
Store the secret in the repository� workflow YAML file as a plain-text environment variable.
- B
Use GitHub Actions secrets in the repository settings to store the Azure Storage account key.
- C
Embed the secret in a publicly accessible Key Vault and reference it directly in pipeline scripts.
- D
Integrate Azure Key Vault secrets with Azure Pipelines and retrieve them at runtime.
Show answer and explanation
Correct answers: B, D
Explanation
To keep sensitive data protected in both GitHub Actions and Azure Pipelines, you should avoid storing secrets in plain text or making them publicly accessible. Instead, use GitHub Actions secrets for the GitHub repository and Azure Key Vault integration when running Azure Pipelines. Refer to GitHub documentation on storing secrets securely (https://docs.github.com/en/actions/security-guides/encrypted-secrets) and Microsoft documentation on Azure Key Vault integration with Azure Pipelines (https://docs.microsoft.com/azure/devops/pipelines/release/azure-key-vault) for additional guidance.
- A. Incorrect.
Option 1 is incorrect because storing any secret in plain text within the workflow YAML makes it visible to anyone with access to the repository and logs, violating secure DevOps practices.
- B. Correct.
Option 2 is correct. GitHub Actions secrets allow secure storage of sensitive data in GitHub, preventing direct exposure in the repository or logs.
- C. Incorrect.
Option 3 is incorrect. Using a publicly accessible Key Vault defeats the purpose of secure secret management. Key Vault must be secured with appropriate access policies, not publicly accessible.
- D. Correct.
Option 4 is correct. Azure Key Vault integration with Azure Pipelines is a best practice for securely retrieving secrets at runtime, preventing accidental exposure in source code.