BenchMark Quizzes by MDFT Pro

Recommend A Solution To Protect Infrastructure Credentials

MDFT Pro, a well-known training agency, has a project in Azure DevOps for developing a new web application that will be used to deliver online training courses.

The academy’s security team has identified credential protection as one of the highest priorities for the project. Recent security audits have shown that infrastructure credentials have been inadvertently exposed in previous deployments.

You are working as a DevOps engineer for MDFT Pro and have been asked to recommend a solution that will minimize the likelihood that infrastructure credentials will be leaked during the deployment process. The solution should integrate with their existing Azure-based infrastructure and DevOps practices.

What should you recommend?

Choose the correct answer from the options below.

Explanations for each answer:

Add a Run Inline Azure PowerShell task to the pipeline is incorrect. Running inline PowerShell does not inherently provide secure handling of credentials. Scripts could potentially expose credentials in logs or to unauthorized users.
Add a PowerShell task to the pipeline and run Set-AzureKeyVaultSecret is incorrect. Using Set-AzureKeyVaultSecret is for setting secrets in Key Vault, not retrieving them securely for deployment. This would not protect infrastructure credentials during deployment.
Add an Azure Key Vault task to the pipeline is incorrect. While Azure Key Vault tasks can retrieve secrets during pipeline execution, they may still expose credentials in pipeline variables. This is not as secure as referencing Key Vault directly in ARM templates.
Add Azure Key Vault references to Azure Resource Manager templates is correct.

Learn more about referencing Key Vault secrets in ARM templates:

Secrets In ARM Templates

Exam Preparation Quiz

Recommend A Solution To Protect Infrastructure Credentials