The correct option is Variable groups.

Variable groups can be linked to an Azure Key Vault so pipelines can reference secrets as variables. You create a variable group in the Library and link it to a Key Vault by configuring a service connection and granting access so the pipeline can retrieve the secrets at runtime. Marking the secrets as secret in the variable group ensures they are masked in logs and handled securely.

Task groups let you bundle and reuse a sequence of pipeline tasks across builds and releases but they do not provide a way to reference or sync secrets from an Azure Key Vault.

Deployment groups define sets of target machines and agents for deployments and they are concerned with deployment topology rather than storing or exposing Key Vault secrets.

Full AWS Practitioner Certification Question