AZ400-Q: separate pipeline configuration from secrets
A reusable pipeline needs a region name, an environment name, and Azure deployment access. Which design best separates concerns?
- A) Put all values, including long-lived cloud credentials, in the YAML file.
- B) Hard-code each environment in a separate copied pipeline.
- C) Put secrets in application source so local testing matches CI.
- D) Pass reviewed non-secret parameters/variables, protect sensitive values in the appropriate secret store, and prefer federated Azure access where possible. ✓
Answer: D. Non-secret configuration, reusable logic, secret handling, and deployment identity are separate responsibilities with different controls.
Why not the others: Hard-coded and copied pipelines drift; source/YAML secrets are exposed credentials.
Related
variables-groups · pipeline-templates · secretless-pipeline-authentication