Microsoft DevOps Engineer Expert AZ-400 Practice Question

You store all production secrets in a single Azure Key Vault. A GitHub repository contains several workflow files, and an Azure DevOps project contains multiple YAML pipelines. You must allow both GitHub Actions and Azure Pipelines to fetch the same up-to-date secrets at runtime without copying secret values into repository files, pipeline YAML, or library variables. Secret rotation in Key Vault should require no changes to the CI/CD definitions. Which solution meets these requirements?

Export the Key Vault secrets to a .env file during deployment and commit the file to the repository for both systems to consume.
Define the secrets as environment variables in each GitHub workflow and use secure files in the Azure Pipelines Library.
Store each secret as an encrypted repository secret in GitHub and as an encrypted pipeline variable in Azure Pipelines.
In GitHub Actions, authenticate to Azure with OIDC and use an action to pull secrets directly from Key Vault; in Azure Pipelines, link a variable group to the same Key Vault and reference the variables.

Report Issue

Answer Description

Using federated OpenID Connect (OIDC) authentication in GitHub Actions lets the workflow obtain an access token for the Azure AD-backed Key Vault without storing any long-lived credentials. After the workflow has logged in with the azure/login action, the azure/keyvault-secrets (or equivalent Azure CLI) action can retrieve any required secret directly from the vault at job runtime, so new versions are picked up automatically.

In Azure Pipelines, linking a Library variable group to the same Key Vault exposes each vault secret as a pipeline variable (referenced as $(variableName)). Because the variable group is a live link, secret values are resolved on each run; rotating the secret in Key Vault does not require editing the pipeline YAML.

Storing encrypted repository or pipeline secrets (option A) or embedding environment variables or secure files (option C) duplicates secret data and must be updated after rotation. Committing a generated .env file to the repository (option D) violates the requirement to avoid storing secrets in source control.

Ask Bash

Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.