https://learn.microsoft.com/en-us/credentials/certifications/exams/az-400/practice/assessment?assessment-type=practice&assessmentId=56
The most secure way to pass secrets to run commands is to reference them as environment variables, rather than arguments. This requires the use of the env: element. The $env: notation is used to reference an environment variable, but the intention of this question is to define rather than reference. The run: element defines which command to run, so it follows the env: notation.
Use secrets in a workflow - Training | Microsoft Learn
OWASP ZAP implements a passive penetration test, not static code analysis, OSS vulnerability scan, or regression test.
Explore OWASP ZAP penetration test - Training | Microsoft Learn