AZ-400 Question 249
Select 2Your team is building a Node.js application with continuous integration in both GitHub Actions and Azure Pipelines. You need to securely store sensitive credentials (API keys, service passwords) for use during builds without exposing them in logs or source control. Which two of the following approaches should you implement to ensure proper secret management across both GitHub Actions and Azure Pipelines?
- A
Store secrets in GitHub repository or organization settings under 'Secrets' and reference them via ${{ secrets.SECRET_NAME }} in workflow files
- B
Commit the secrets as base64-encoded text directly into the repository to minimize the risk of accidental disclosure
- C
Use Azure Pipelines variable groups with the 'secret' property set to true and reference them as $(variableName) in YAML pipelines
- D
Store secrets in plaintext variables in Azure Pipelines, ensuring easy access without additional configuration
Show answer and explanation
Correct answers: A, C
Explanation
Storing secrets in GitHub Actions' repository or organization secrets, as well as marking Azure Pipelines variables as 'secret', follows best practices recommended by Microsoft. These methods safely encrypt and mask credentials, preventing accidental exposure in code or build logs. Reference: Microsoft and GitHub documentation on CI/CD best practices for securely managing sensitive information.
- A. Correct.
Option 1 is correct. GitHub Actions provides a secure mechanism for storing secrets in either the repository or organization settings. These secrets are encrypted and can be securely injected into workflows using the ${{ secrets.SECRET_NAME }} syntax. This is the recommended approach for GitHub Actions.
- B. Incorrect.
Option 2 is incorrect. Simply base64-encoding the secrets does not inherently secure them, as base64 is easily decoded. Storing sensitive information in version control in any form is strongly discouraged, even if encoded.
- C. Correct.
Option 3 is correct. Azure Pipelines variable groups can securely store secrets marked as 'secret' properties. They remain hidden from logs, and you can reference them in your YAML definitions. This aligns with best practices for managing secrets in Azure Pipelines.
- D. Incorrect.
Option 4 is incorrect. Storing secrets in plaintext variables makes them visible in the pipeline settings and potentially in logs, which poses a security risk. Always use a secure method (such as secret variables or Azure Key Vault) for sensitive data.