Exam AZ-400 topic 4 question 56 discussion

This is incorrect. https://learn.microsoft.com/en-us/azure/devops/pipelines/process/variables?view=azure-devops&tabs=yaml%2Cbatch#variable-naming-restrictions User-defined and environment variables can consist of letters, numbers, ., and _ characters. Don't use variable prefixes reserved by the system. These are: endpoint, input, secret, path, and securefile. Any variable that begins with one of these strings (regardless of capitalization) won't be available to your tasks and scripts.

An even better approach would be to get them from a key vault. Your machine could be compromised and then those environment variables are secrets no more.

While environment variables are not logged by default, they can be accidentally exposed through logs or other sources, and their values can be visible in the running process of the task. Additionally, environment variables are typically accessible to all tasks running in the pipeline, which could potentially increase the attack surface if an attacker gains access to the pipeline. By applying a prefix of "secret" to the name of the pipeline variables, as suggested in option C, the variables are automatically marked as secret variables in Azure Pipelines, and their values are not logged by default during pipeline execution. This provides a more secure approach to handling secrets in pipelines and reduces the risk of accidental exposure. Therefore, while option A is not necessarily incorrect, option C is a better solution for securing secrets in Azure Pipelines.