To reduce the likelihood that infrastructure credentials are leaked from an Azure DevOps pipeline, which of the following should you recommend?

Adding an Azure Key Vault task to the pipeline is the most secure and recommended approach. This task allows the pipeline to retrieve secrets directly from Azure Key Vault at runtime, without exposing them in the pipeline definition, variables, or logs. Key Vault is designed for securely storing and managing secrets, keys, and certificates. Using a Run Inline Azure PowerShell task or a PowerShell task with Set-AzureKeyVaultSecret would typically be used to store secrets into Key Vault, not to retrieve them securely within a pipeline for consumption. While you could write PowerShell to retrieve secrets, the dedicated Azure Key Vault task provides a more integrated and secure method. Adding Azure Key Vault references to Azure Resource Manager (ARM) templates is for deploying resources that need to access Key Vault secrets, not for the pipeline itself to retrieve credentials for its own operations.