Task 4.2: Design and implement a strategy for managing sensitive information in automation

• AThe AzureKeyVault task with SecretsFilter '*', and Key Vault Secrets Officer for the identity

  Incorrect

  '*' downloads every secret, and Secrets Officer can change and delete secrets.

• BA vault access policy granting Get and List to the identity

  Incorrect

  With the Azure RBAC permission model, access policies aren't used.

• CKey Vault Administrator on the vault for the pipeline's identity

  Incorrect

  Administrator grants full data plane control, far beyond reading two secrets.

• DThe AzureKeyVault task with SecretsFilter listing the two names, and Key Vault Secrets User for the connection's identity

  Correct

  The filter downloads only the named secrets, and Secrets User can read secret contents without managing them.

The Azure Key Vault task downloads secrets as pipeline variables; its SecretsFilter takes * or a list of names. Under the Azure RBAC model, Key Vault Secrets User reads secret contents, while Secrets Officer and Administrator can manage them; enabling RBAC invalidates access policies.

• AA federated credential with entity type Branch and the pattern release/*

  Incorrect

  Pattern matching isn't supported for the Branch entity type, and a branch credential would also trust every other job on those branches.

• BA federated credential with entity type Environment and the value production

  Correct

  The subject then matches only jobs that target the production environment.

• CThe id-token write permission on the deployment job

  Correct

  The job needs id-token write to request the OIDC token that azure/login exchanges.

• DA federated credential with entity type Pull request, so pull requests can deploy

  Incorrect

  That trusts pull request runs, not the production job.

• EA client secret stored as a production environment secret

  Incorrect

  That stores the secret the design forbids.

A federated identity credential trusts tokens whose subject matches exactly; for GitHub, the entity type is Environment, Branch, Pull request or Tag, and pattern matching isn't supported for branches and tags. The workflow needs id-token: write to request the token for azure/login.

• ABase64 strings in pipeline variables decoded by a script

  Incorrect

  Variables aren't meant for files, and decoded content can leak into logs.

• BA private Azure Storage container with a SAS token in the YAML file

  Incorrect

  A SAS token in the YAML file is a secret in source control.

• CSecure files in the pipeline library, authorized for the release pipeline and downloaded with DownloadSecureFile

  Correct

  Secure files are encrypted at rest, are a protected resource with pipeline permissions, and are downloaded only by the task.

• DA Universal Package in the team's feed

  Incorrect

  Feed packages are readable by anyone with feed access, not just the release pipeline.

Secure files store sensitive files such as certificates, keystores and provisioning profiles encrypted on the server. They're protected resources with pipeline permissions, approvals and checks, and the Download Secure File task places them on the agent.

• AUse ##vso[task.setvariable variable=token;issecret=true]

  Correct

  issecret=true marks the variable as secret so it's masked.

• BWrite the token to a file in the artifact staging folder

  Incorrect

  A file can be published with the artifact.

• CExport it as a plain environment variable in the script

  Incorrect

  Exports don't carry to later steps and aren't masked.

• DEcho it so later steps can read the log

  Incorrect

  Echoing prints the secret.

A script can set a variable with the task.setvariable logging command; adding issecret=true makes it a secret variable that's masked in logs.

• AIt's stored and encrypted like any other secure file in the library

  Incorrect

  Secure files have a size limit.

• BIt's split into four files automatically

  Incorrect

  Files aren't split.

• CIt's rejected, because each secure file is limited to 10 MB

  Correct

  The size limit for each secure file is 10 MB.

• DIt's stored unencrypted because it's large

  Incorrect

  Secure files are always encrypted; large ones aren't accepted.

Secure files hold sensitive files such as certificates and keys, encrypted at rest; each secure file can be up to 10 MB.

• AThe workflow runs faster

  Incorrect

  Speed isn't the purpose.

• BNo Azure credential secret has to be stored in GitHub

  Correct

  The workflow exchanges a GitHub-issued token for an Azure token.

• CWorkflows no longer need any permissions

  Incorrect

  The job still needs a permission to request the token.

• DAny repository in the organization can deploy to the subscription

  Incorrect

  The federated credential limits which workflows are trusted.

With OpenID Connect, a federated identity credential trusts tokens that GitHub issues to specific workflows, so no client secret has to be stored.

• AOne vault for all environments, with role assignments on each secret

  Incorrect

  Per-secret assignments are discouraged except in special cases.

• BOne vault for the whole company

  Incorrect

  A shared vault widens access across apps and environments.

• CA vault per environment, with roles assigned at vault scope

  Correct

  A vault per application per environment is the recommendation.

• DSecrets in pipeline variables only

  Incorrect

  That drops Key Vault's central management.

The recommendation is a vault per application per environment (development, pre-production and production) with roles assigned at the vault scope; assigning roles on individual secrets isn't recommended except in specific cases.