Design and Implement a Strategy for Managing Sensitive Information in Automation AZ-400 Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   Your organization wants to centralize the management of secrets, keys, and certificates used across multiple applications and pipelines. You also need to control access and audit usage. What should you implement?

   • AGitHub repository secrets for all secrets.
   • BA shared configuration file in a central repository.
   • CAzure Key Vault with role-based access control and diagnostic logging.
   • DAzure Pipelines variable groups for all secrets.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   Your application needs to perform encryption and decryption using a key stored in Azure Key Vault. You want to ensure that the key never leaves Key Vault. What should you do?

   • AStore the key in a secure file and use it in your application.
   • BUse Key Vault's cryptographic operations (encrypt/decrypt) via the SDK or REST API.
   • CDownload the key and use it in your application.
   • DUse a customer-managed key in Azure Storage and access it directly.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   Your GitHub Actions workflow needs to authenticate to Azure to deploy resources. You want to avoid storing any long-lived credentials in GitHub secrets. What is the recommended approach?

   • AUse OpenID Connect with a federated credential on an Azure AD app registration.
   • BCreate a service principal and store its password as a GitHub secret.
   • CUse a personal access token (PAT) from Azure DevOps to authenticate.
   • DUse a managed identity from an Azure VM to authenticate from GitHub.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   Your organization stores API keys for multiple internal services in Azure Key Vault. Developers need to retrieve these keys during local development, but you want to minimize the risk of keys being exposed in code or logs. What should you implement?

   • ADownload the keys to a shared network drive for developers to copy into their code.
   • BUse Azure Key Vault references in application configuration and ensure developers have appropriate RBAC permissions to access the vault.
   • CCreate a public API that returns the keys to any authenticated user.
   • DEmail the keys to developers and ask them to store them in environment variables.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   What is a best practice to prevent sensitive information from leaking into pipeline logs?

   • APrint all variables at the start of the pipeline for debugging.
   • BStore secrets in plain text in the repository and reference them directly.
   • CUse secret variables and avoid echoing them in script steps.
   • DUse base64 encoding to hide secrets in logs.
   Reveal Solution Discussion Select an answer first