AZ-400 Question 251
Single answerYou are configuring an Azure DevOps pipeline to deploy an application that relies on a private PFX certificate file. The certificate must remain confidential and only be accessible during the deployment stage. Which approach best meets these requirements while using Azure Pipelines features?
- A
Include the PFX certificate file in the repository and rely on repository permissions to limit access
- B
Save the PFX file as a build artifact and download it during the release stage without additional security steps
- C
Store the PFX file in the Secure Files library in Azure Pipelines and reference it in the pipeline using a secure download task
- D
Embed the contents of the PFX file into a pipeline variable and mask the variable in logs
Show answer and explanation
Correct answer: C
Explanation
Azure DevOps allows you to securely store sensitive files like certificates in the Secure Files library. This setup encrypts the file at rest and ensures it can only be downloaded by authorized pipeline tasks, aligning with best practices for protecting secrets during deployment. For more details, refer to Microsoft� documentation on Secure Files (https://learn.microsoft.com/azure/devops/pipelines/library/secure-files).
- A. Incorrect.
Option 1: Incorrect. Storing sensitive files in source control, even with restricted permissions, risks exposure if the repository is ever cloned or if policies change.
- B. Incorrect.
Option 2: Incorrect. Simply placing the file in a build artifact does not guarantee appropriate encryption and secure handling. Artifacts are not specifically designed for secret storage.
- C. Correct.
Option 3: Correct. Using Azure Pipelines Secure Files library ensures the certificate is encrypted at rest and only accessible by authorized pipeline processes. This is the recommended way to store and manage sensitive files in Azure DevOps.
- D. Incorrect.
Option 4: Incorrect. Masking environment variables does not provide full protection because the sensitive file itself could potentially be rebuilt from the variable� content. Sensitive files should be stored in a dedicated secure mechanism like Secure Files or Azure Key Vault.