🔐 AZ-400 Exam Prep | Question 12 of 50

Key Takeaways

This is the AZ400 certification prep question 12 of 50. Your team wants to authenticate Azure pipelines to Azure services, such as Azure Key Vault, without storing secrets in the pipeline configuration. Which identity option should you use? A, personal access tokens or PATs stored in pipeline variables. B, service connections [music] using Azure Resource Manager with service principles. C, hard-coded credentials in the YAML file. Or D, GitHub app secrets stored in GitHub. Now, A is incorrect because storing PATs in pipeline variables exposes secrets and it's strongly discouraged. C is incorrect because hard-coded credentials in YAML violate least privileges and auditing requirements. And D is incorrect because GitHub secrets are only available in GitHub actions, not in Azure DevOps pipelines. [music] The correct answer is B. Azure DevOps service connections allow pipelines to authenticate to Azure resources. For example, Azure Key Vault, using Azure Resource Manager with service principles or managed identities. Now, this avoids storing secrets in pipeline variables or YAML, aligning with Azure DevOps security best practices. Check out our AZ400 course on codecloud.com.