AZ-400 Question 255
Select 2You are designing an Azure DevOps pipeline that requires storing database connection strings for integration testing. The team wants to ensure these secrets are never exposed in the pipeline logs or the code repository. Which two actions should you recommend to prevent leakage of sensitive information?
- A
Add them to a variable group in Azure DevOps as secret variables, and reference them in the pipeline.
- B
Store them in Azure Key Vault and map them as secrets in the pipeline without storing them locally.
- C
Embed them within pipeline scripts as environment variables, ensuring you rotate them regularly.
- D
Base64-encode them and commit them to the repository for easy access.
Show answer and explanation
Correct answers: A, B
Explanation
Securing secrets within Azure DevOps pipelines typically involves using built-in secret variable support or leveraging Azure Key Vault integration. Both approaches keep sensitive information masked and protected from unauthorized access. For more information, refer to Microsoft Azure DevOps documentation on Pipeline Security and best practices: https://learn.microsoft.com/azure/devops/pipelines/security/
- A. Correct.
Correct: Adding secrets to Azure DevOps variable groups and marking them as secret variables ensures they are masked in logs and never exposed in source control. This follows best practices for secret management.
- B. Correct.
Correct: Storing sensitive data in Azure Key Vault and referencing it securely within the pipeline is a recommended practice. It avoids storing secrets locally or in the repository and grants fine-grained access control.
- C. Incorrect.
Incorrect: Embedding secrets as environment variables in scripts can lead to exposure if the logs or scripts are viewed. Merely rotating the credentials does not fundamentally solve the issue of accidental disclosure.
- D. Incorrect.
Incorrect: Base64-encoding is a reversible process and does not adequately protect secrets. Committing them to the repository, even encoded, can easily lead to compromise.