Why should sensitive files be excluded from source control repositories?

To prevent unauthorized access and potential leakage of sensitive information.

To reduce the repository size and improve performance.

To make it easier to merge branches without conflicts.

To comply with the requirement that all files in a repository must be publicly accessible.

Your team uses GitHub Actions to deploy to Azure. You want to eliminate the need to store Azure service principal credentials as GitHub secrets. Which approach should you implement?

Configure OpenID Connect (OIDC) federation between GitHub and Azure AD, and use the azure/login action with the federated credential.

Use a personal access token (PAT) from a user account and store it as a GitHub secret.

Store the service principal's client secret in a GitHub secret and reference it in the workflow.

Create a new service principal for each workflow run and store its credentials in Azure Key Vault.

Where are secrets stored in a GitHub repository for use in GitHub Actions workflows?

In the repository's README file for easy access.

In the repository settings under 'Secrets and variables'.

In a separate Azure Key Vault that is automatically linked to the repository.

In the repository's .github/workflows directory as plain text files.

Your CI/CD pipeline uses a third-party task that requires an API token. You want to ensure the token is not exposed in the pipeline logs. What is the best practice?

Store the token in a plain text variable and use it in the task.

Use a personal access token (PAT) and include it in the repository.

Hardcode the token in the task's input parameters.

Store the token as a secret variable in the pipeline and reference it in the task.

Your Azure Pipeline needs to retrieve a database connection string from Azure Key Vault and use it in a deployment task. You want to avoid hardcoding the connection string in the pipeline. What should you do?

Store the connection string in a variable group that is not linked to Key Vault.

Use the REST API to fetch the secret and output it to the console.

Use the Azure CLI to list the secret and pass it as a parameter.

Use the Azure Key Vault task to download secrets and map them to pipeline variables.

Microsoft Certified:DevOps Engineer Expert

Domain 4Objective 2

Design and Implement a Strategy for Managing Sensitive Information in Automation AZ-400 Practice Questions (Page 6)

Part of the Develop a security and compliance plan domain, which makes up ~19% of our current practice bank. Microsoft does not publish an official question count, but from its 140-minute exam (~55–95 total, ~10–18 in this domain), expect 3–6 from this objective — we provide 45 practice questions to prepare you well beyond it. (estimate)

45questions here

9free pages

10concepts

10 Concepts in This Objective

Azure Key Vault Basics
Managing Secrets in Azure Key Vault
Managing Keys in Azure Key Vault
Managing Certificates in Azure Key Vault
Secrets Management in GitHub Actions
Secrets Management in Azure Pipelines
Secretless Authentication with Workload Identity Federation
Managing Sensitive Files in Deployment
Azure Pipelines Secure Files
Preventing Sensitive Information Leakage

Questions 26–30

26foundation · easy
Why should sensitive files be excluded from source control repositories?
Select an answer first
27application · medium
Your team uses GitHub Actions to deploy to Azure. You want to eliminate the need to store Azure service principal credentials as GitHub secrets. Which approach should you implement?
Select an answer first
28foundation · easy
Where are secrets stored in a GitHub repository for use in GitHub Actions workflows?
Select an answer first
29application · medium
Your CI/CD pipeline uses a third-party task that requires an API token. You want to ensure the token is not exposed in the pipeline logs. What is the best practice?
Select an answer first
30application · medium
Your Azure Pipeline needs to retrieve a database connection string from Azure Key Vault and use it in a deployment task. You want to avoid hardcoding the connection string in the pipeline. What should you do?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to AZ-400

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “AZ-400” is a trademark of its owner, used for identification only.