Exam AZ-400 topic 4 question 7 discussion

D is correct and needed, so the correct answer should be D

Correct answer is C. This is the task to retreive Keyvault secrets to use in following tasks

Adding a keyVault step in the pipeline doesn't necessarily eliminate the risk of credentials leaking, while adding references for key Vault in the deployment template would do

the question talks about ADO and there is pipeline word in 3/4 options so it has to be C rather than D

can be C and D to be frank, they both are good solutions to "minimize the likelihood that infrastructure credentials will be leaked". Going with C because it's more general and it seems that the initial building of the infrastructure has been done.

I would say D

Option C is better when secrets are needed inside the pipeline execution (e.g., during deployment). Option D is better for ARM templates or app configurations that need to reference secrets without pipeline interaction.

The given answer is correct

Going with C assuming adding kv task in ado pipeline

I am going with C assuming I am adding keyvault task in the ado pipeline.

Option D, adding Azure Key Vault references to Azure Resource Manager templates, is a valid approach for securely accessing credentials and other sensitive information in your infrastructure deployment. However, it is more focused on managing secrets within your infrastructure code rather than in your CI/CD pipeline. For the specific scenario of minimizing the likelihood of infrastructure credentials being leaked in an Azure DevOps pipeline, using an Azure Key Vault task directly in the pipeline (Option C) is a more direct and secure approach. This allows you to retrieve secrets from Azure Key Vault at runtime without exposing them in your pipeline configuration. So the ANS is C

By using an Azure Key Vault task in your pipeline, you can retrieve secrets during runtime without exposing them in your code or configuration files.

The question is referring to infrastructure credentials. Instead of putting a secure value (like a password) directly in your template or parameter file, you can retrieve the value from an Azure Key Vault during a deployment. You retrieve the value by referencing the key vault and secret in your parameter file. The value is never exposed because you only reference its key vault ID. https://learn.microsoft.com/en-us/azure/azure-resource-manager/templates/key-vault-parameter?tabs=azure-cli

https://learn.microsoft.com/en-us/azure/azure-resource-manager/templates/key-vault-parameter?tabs=azure-cli

C. Add an Azure Key Vault task to the pipeline.

C. Add an Azure Key Vault task to the pipeline. By using Azure Key Vault tasks, you can securely store and retrieve secrets in Azure Key Vault during your build or release process, reducing the exposure of sensitive information like credentials in your pipelines. Option D (Add Azure Key Vault references to Azure Resource Manager templates) is also a good practice, but it may not directly address the concern of credentials leaking during the pipeline execution. It's more about securely referencing secrets during infrastructure deployment. Therefore, the correct answer is C

I think C as this task is only for reteiving passwords securly. Can be done with D as well but for C is better choice