When should an administrator store a value as an Actions secret rather than a configuration variable?

The correct answer is storing credentials and sensitive material as secrets. Secrets are encrypted at rest, masked in logs when properly referenced, and permissioned differently than plain configuration variables. Option A should be a variable because region names are not credentials. Option C is insecure because plaintext logs defeat the purpose of secrets. Option D is public metadata, not a secret. Use environment secrets for production, rotate regularly, limit who can read secret values in settings, and prefer OIDC over long-lived cloud secrets when possible.