Your GitHub Actions workflow needs to authenticate to Azure to deploy resources. You want to avoid storing any Azure credentials as GitHub secrets. Which configuration should you use?

Set up an Azure AD app registration with a federated credential for the GitHub repository and use the azure/login action with the OIDC token.

Create a service principal and store its password as a GitHub secret.

Use the Azure CLI action with a service principal's certificate stored in the repository.

Use a personal access token from a user account and store it as a GitHub secret.

Your pipeline uses a third-party task that requires an API key. The task logs the input parameters, and you have noticed that the API key appears in the logs. You want to prevent this while still allowing the task to function. What should you do?

Use a secure file to store the API key and reference it in the task.

Store the API key as a secret variable and use the logging command to mask it before passing it to the task.

Use a custom task that does not log the API key.

Set the task's logging level to 'none' to suppress logs.

Your web application uses a TLS certificate that is stored in Azure Key Vault. You want to ensure that the certificate is automatically renewed before it expires and that the application always uses the latest version. What should you configure?

Store the certificate as a secret and update the secret value when the certificate is renewed.

Create a certificate in Key Vault with an issuer that supports auto-renewal, and configure the application to use the certificate's identifier without a version.

Use a self-signed certificate and rely on the application to trust it.

Manually upload a new certificate to Key Vault each time the current one expires.

Your deployment pipeline requires a configuration file that contains secrets. The file is generated during the build and must be available during the release. You want to ensure the file is not stored in the repository and is only accessible to the release pipeline. Which approach should you use?

Store the file in a private Azure Storage container and use a SAS token in the release pipeline.

Commit the file to a private Git repository and clone it in the release pipeline.

Use a pipeline variable to hold the file content and reference it in the release.

Generate the file during the build, upload it as a secure file to Azure Pipelines, and download it in the release pipeline.

Your Azure Pipeline uses a secure file to store a private key. The pipeline runs on a Microsoft-hosted agent. You are concerned that the private key might be accessible to other jobs running on the same agent. What should you do to mitigate this risk?

Use a pipeline variable to store the private key instead of a secure file.

Store the private key in Azure Key Vault and download it during the pipeline.

Rely on the Microsoft-hosted agent's isolation to protect the file.

Use a self-hosted agent that is dedicated to your pipelines and clean up the file after use.

Microsoft Certified:DevOps Engineer Expert

Domain 4Objective 2

Design and Implement a Strategy for Managing Sensitive Information in Automation AZ-400 Practice Questions (Page 3)

Part of the Develop a security and compliance plan domain, which makes up ~19% of our current practice bank. Microsoft does not publish an official question count, but from its 140-minute exam (~55–95 total, ~10–18 in this domain), expect 3–6 from this objective — we provide 45 practice questions to prepare you well beyond it. (estimate)

45questions here

9free pages

10concepts

10 Concepts in This Objective

Azure Key Vault Basics
Managing Secrets in Azure Key Vault
Managing Keys in Azure Key Vault
Managing Certificates in Azure Key Vault
Secrets Management in GitHub Actions
Secrets Management in Azure Pipelines
Secretless Authentication with Workload Identity Federation
Managing Sensitive Files in Deployment
Azure Pipelines Secure Files
Preventing Sensitive Information Leakage

Questions 11–15

11application · medium
Your GitHub Actions workflow needs to authenticate to Azure to deploy resources. You want to avoid storing any Azure credentials as GitHub secrets. Which configuration should you use?
Select an answer first
12expert · hard
Your pipeline uses a third-party task that requires an API key. The task logs the input parameters, and you have noticed that the API key appears in the logs. You want to prevent this while still allowing the task to function. What should you do?
Select an answer first
13application · medium
Your web application uses a TLS certificate that is stored in Azure Key Vault. You want to ensure that the certificate is automatically renewed before it expires and that the application always uses the latest version. What should you configure?
Select an answer first
14expert · hard
Your deployment pipeline requires a configuration file that contains secrets. The file is generated during the build and must be available during the release. You want to ensure the file is not stored in the repository and is only accessible to the release pipeline. Which approach should you use?
Select an answer first
15expert · hard
Your Azure Pipeline uses a secure file to store a private key. The pipeline runs on a Microsoft-hosted agent. You are concerned that the private key might be accessible to other jobs running on the same agent. What should you do to mitigate this risk?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to AZ-400

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “AZ-400” is a trademark of its owner, used for identification only.