AZ-400 Question 253
Select 2You are designing an Azure DevOps build pipeline for a web application that must securely handle database credentials and API keys. The team is concerned about preventing any potential leaks of these secrets during the build and deployment process. Which two actions should you implement in your pipeline design to ensure that sensitive information is not inadvertently exposed?
- A
Use secret variables in a variable group to mask values in logs
- B
Pass secrets as plain text environment variables directly to pipeline tasks
- C
Store credentials in Azure Key Vault and reference them using the Key Vault task in the pipeline
- D
Check secrets into the source code repository so they can be tracked and versioned
Show answer and explanation
Correct answers: A, C
Explanation
The recommended patterns for preventing leakage of sensitive information in Azure DevOps pipelines include using secret variables (masked in logs) and integrating with a secure external secret store like Azure Key Vault. These approaches help avoid exposing credentials in version control, pipeline scripts, or logs. Refer to Microsoft� DevOps documentation on Variable Groups and Azure Key Vault integration for detailed guidance on restricting access and securely transmitting secrets in pipelines.
- A. Correct.
Correct. When using Azure DevOps, creating a variable group and marking certain variables as 'secret' ensures they are masked in logs and cannot be read in plain text. Best practices recommend managing sensitive data in variable groups with secret variables to reduce the risk of exposure.
- B. Incorrect.
Incorrect. Passing secrets in plain text environment variables makes them visible in build logs and potentially available to anyone with access to the pipeline, leading to possible credential leakage.
- C. Correct.
Correct. Storing secrets in Azure Key Vault and referencing them in your pipeline via the Key Vault task is a recommended approach. It keeps credentials in a secure central location and avoids hardcoding secrets in code or exposing them in logs.
- D. Incorrect.
Incorrect. Storing secrets in the source code repository is a direct violation of best practices. Anyone with repository access, including forks or backups, could see these credentials, posing a serious security risk.