AZ-400 Question 250
Select 2Your organization needs to securely store and use an SSL certificate during an Azure Pipelines build and release process. The certificate must not be exposed in logs or source control, and only authorized individuals should have access to it. Which two actions should you take to manage this sensitive file effectively?
- A
Upload the SSL certificate as a secure file in Azure Pipelines, and control access via pipeline permissions
- B
Commit the SSL certificate to the main branch of the source repository for easy reference by the pipeline
- C
Use the Azure Key Vault task in the pipeline to retrieve the certificate securely at runtime
- D
Store the SSL certificate content directly in a pipeline secret variable, even if it exceeds recommended size limits
Show answer and explanation
Correct answers: A, C
Explanation
To protect sensitive files such as SSL certificates, you should either use Azure Pipelines secure files or integrate with external secret stores like Azure Key Vault. Both approaches encrypt the file at rest, limit visibility, and offer fine-grained access control. Refer to Microsoft� official documentation on Azure Pipelines secure files (https://learn.microsoft.com/azure/devops/pipelines/library/secure-files) and on using Azure Key Vault for secrets management (https://learn.microsoft.com/azure/devops/pipelines/operations/azure-key-vault) for detailed instructions and best practices.
- A. Correct.
Option 1 is correct. Uploading the certificate as a secure file in Azure Pipelines ensures it is encrypted and only accessible to authorized users and pipelines. This is one of the recommended ways to handle sensitive files.
- B. Incorrect.
Option 2 is incorrect. Storing a certificate in source control, especially in the main branch, can expose it to unintended access and is against best practices for managing sensitive data.
- C. Correct.
Option 3 is correct. Using Azure Key Vault integration with Azure Pipelines is a reliable way to store and retrieve certificates (and other secrets) securely at runtime without persisting them in code or logs.
- D. Incorrect.
Option 4 is incorrect. While Azure Pipelines secret variables are great for smaller secrets (like passwords or tokens), storing entire SSL certificates�especially larger ones�in pipeline variables is not recommended and can be cumbersome to manage.