AZ-400 Question 252
Single answerYou are a DevOps engineer for a company that needs to deploy a microservice to production. The microservice relies on a sensitive configuration file containing API keys, database credentials, and private certificates. The team requires a secure method to include this file in the Azure Pipelines deployment without storing it in source control. Which approach should you use to safely manage and deploy the sensitive file?
- A
Store the file in source control and apply base64 encoding before checking it in.
- B
Upload the file to Azure Pipelines Secure Files and reference it within your pipeline.
- C
Include the file directly as a variable group definition to pass it as an environment variable.
- D
Rely on repository permissions and store the file unencrypted in the same folder as other configurations.
Show answer and explanation
Correct answer: B
Explanation
Azure Pipelines Secure Files is designed specifically to handle sensitive artifacts (certificates, configuration files, etc.) that need controlled access. By storing the file in the Secure Files library, you ensure that only authorized pipelines and users can retrieve it during deployment. More information can be found in Microsoft� documentation at: https://docs.microsoft.com/azure/devops/pipelines/library/secure-files.
- A. Incorrect.
Option 1: Storing the file in source control, even with base64 encoding, does not provide true encryption or prevent unauthorized access. Base64 is easily decoded, making this approach insecure for sensitive data.
- B. Correct.
Option 2: This is the correct answer. By uploading the file to Azure Pipelines Secure Files, you can protect sensitive artifacts with Azure DevOps security measures. The file can then be downloaded securely during the pipeline run, ensuring only authorized pipelines and users can access it.
- C. Incorrect.
Option 3: Variable groups are useful for secrets at the key-value level (like passwords or tokens), but not ideal for files. Embedding a large sensitive file as a variable group is both cumbersome and less secure compared to Azure Pipelines Secure Files.
- D. Incorrect.
Option 4: Relying on repository permissions is risky because if someone gains read access to the repository, they can retrieve the file. Storing the file unencrypted poses a significant security threat.