Home labs & practical projects

Remove a secret from a delivery workflow

A project to do with your own tools, with guidance on what to create and capture.

Local lab Suggested time: 2–3 hoursYour own authorised environment

What you could create

A fictional deployment pipeline contains a placeholder long-lived credential. The team wants a safer delivery design and evidence that secrets are not printed in logs.

Example evidence format

Project evidence map (example)

Pipeline security change proposalScope and inputs

Repository checks and deployment trust diagramDecisions and reasoning

Evidence record (example)

Evidence	What to capture
Pipeline security change proposal	Show the inputs, scope and decisions behind this record. No real credential enters the repository or exercise output.
Repository checks and deployment trust diagram	Include the evidence supporting your conclusion. The proposed identity has a defined audience, scope and trust boundary.

What you'll need

Local lab

Create a sample repository and pipeline definition using dummy credentials only. Use the current platform documentation to design an identity-based deployment option.

Project record

Keep the working files for pipeline security change proposal and record assumptions as you go.

Current reference material

Use the linked provider resources to verify the features, access terms and version relevant to your project.

Access & cost

Uses your own computer. Confirm hardware capacity, software licences and download terms before setup.

Use disposable VMs, containers or a simulator. Keep the lab separate from your everyday machine and work network.

Suggested milestones

1
Plan and investigate
Inventory credential exposure in configuration, logs and artefacts.
2
Develop your approach
Replace the dummy-secret pattern with a documented short-lived identity design.
3
Verify and explain
Add checks for leaked placeholders, protected deployment environments and failed authorisation.

Evidence worth keeping

Keep clear, organised evidence of your design and any testing you carry out.

1
Pipeline security change proposal
Show the inputs, scope and decisions behind this record. No real credential enters the repository or exercise output.
2
Repository checks and deployment trust diagram
Include the evidence supporting your conclusion. The proposed identity has a defined audience, scope and trust boundary.

Label design proposals and observed results clearly.

Explain your work

Use these prompts to reflect on your decisions and what you learned.

Which part of your pipeline security change proposal needed the most judgement?
What observation or assumption changed your approach?
What would you improve, and what have you not verified?

Describe this as a personal project in your portfolio.

Useful resources

Use these resources to deepen your understanding and check key details.

Official certification objectives

Review the current provider requirements and relevant subject areas.

Microsoft Official Practice Assessment (AZ-400)

Check relevance, platform versions and current access terms.

Explore external learning resources

Find relevant providers and check features, access requirements and costs.

A useful starting point

Create a sample repository and pipeline definition using dummy credentials only. Use the current platform documentation to design an identity-based deployment option.

What a good result looks like

No real credential enters the repository or exercise output.
The proposed identity has a defined audience, scope and trust boundary.
Failed authorisation stops deployment and produces a usable diagnostic.

Finish the project

Save sanitised evidence, then remove the lab instances or revert to the clean snapshot. Remove temporary accounts and credentials.

Independent home-project guidance, not an official vendor lab or a claim of complete exam coverage. Use your own tools and label the work accurately.