AZ400-Q: prevent secret exposure in logs
A pipeline stores a database password as a secret variable, but a debug script prints all environment variables. What should the team do?
- A) Assume masking always makes arbitrary debug output safe.
- B) Convert the password to a normal variable.
- C) Remove/redact secret-printing diagnostics, minimize secret injection, and use approved secret retrieval with log review. ✓
- D) Commit the password encrypted in the repository.
Answer: C. Secret masking is helpful but not a license to emit credentials. Pipelines should avoid exposing sensitive values in commands, environment dumps, artifacts, or logs.
Why not the others: Normal variables and repository commits expose secrets; blind masking assumptions are unsafe.