You have an Azure DevOps project named Project1, an Azure subscription Sub1, and an Azure Key Vault named vault1. You must reference secret values from vault1 in all pipelines of Project1 while preventing those secret values from being stored in the pipelines. What should you do?

Creating a variable group in Project1 and linking it to Azure Key Vault is the correct solution. This allows you to securely reference secrets stored in vault1 directly within your pipelines without hardcoding them. The variable group acts as a bridge, fetching the secret values at runtime. This approach prevents secrets from being stored in pipeline definitions, enhancing security and compliance. Adding a secure file is for storing files, not individual secret values, and doesn't directly integrate with Key Vault for dynamic secret retrieval. Modifying pipeline security settings primarily controls access to the pipeline itself, not how secrets are managed. Configuring Contoso's security policy is too broad and not a direct action within Azure DevOps for this specific requirement.