AZ-400 Question 254
Select 2You are creating a new CI/CD pipeline in Azure DevOps for a web application that connects to a secured database. The database credentials must remain confidential, and your security team insists that no secrets are stored in plain text or appear in pipeline logs. Which two actions should you implement to prevent leaking these database credentials?
- A
Store the credentials in the pipeline YAML file and mark the variable as read-only.
- B
Use Azure Key Vault secrets referenced by a variable group, ensuring the secrets are securely injected into the pipeline at runtime.
- C
Export the credentials as environment variables in a pre-build script for visibility during troubleshooting and audits.
- D
Enable secret masking in the pipeline so that any referenced secrets are hidden in log output.
Show answer and explanation
Correct answers: B, D
Explanation
Using secure storage such as Azure Key Vault, along with native secret-handling features like masked variables, is crucial for preventing credential exposure in DevOps pipelines. Refer to official Microsoft documentation on managing secrets in Azure DevOps (https://docs.microsoft.com/azure/devops/pipelines/library/variable-groups) for best practices, including leveraging Azure Key Vault and variable masking to ensure secrets remain confidential.
- A. Incorrect.
Option 1 is incorrect because storing credentials in the pipeline YAML file in plain text, even as �read-only,� exposes them in source control and can lead to leaks.
- B. Correct.
Option 2 is correct. Storing secrets in Azure Key Vault and referencing them in a variable group is a recommended approach that ensures credentials are not stored in plain text and are injected securely during runtime.
- C. Incorrect.
Option 3 is incorrect. Exporting credentials as environment variables in a script often makes them visible in logs, unless additional masking is configured, which is risky and typically disallowed by security guidelines.
- D. Correct.
Option 4 is correct. Secret masking ensures that any secret values are obscured in console output or logs, preventing inadvertent leakage of sensitive information.