WhizLabs has the following file download task in their release pipeline YAML: 

Where is the file stored?

Answer options:

A.In Azure Key Vault
B.In Azure encrypted Blob Storage
C.In the root of the build directory
D.In Pipeline Library
E.In the GitHub secrets

Correct Answers: D 
The DonloadSecureFile@1 task is to download the secure files stored in Pipeline`s Library in the Secret File section to the build agent or release deployment. 

In our example, Whizlabs is downloading, probably, CA Certificate to the deployment environment with subsequent installation. The task creates the reference to the secret file in the form of the name - WLCertificate. You can use this name in the next steps instead of the original name of the file. The original name of the secure file (in inputs: secureFile) can be the file name or the GUID of this file. 
Option A is incorrect.Azure Key Vault can store certificates and renew them. However,in this case, we are using the standard pipeline YAML task that is defined only for the download of the secret files from the pipeline library. 
All other Options are incorrect. 
For more information about using secrete files with CI/CD pipelines, please visit the below URLs: 

https://docs.microsoft.com/en-us/azure/devops/pipelines/tasks/utility/download-secure-file?view=azure-devops
https://docs.microsoft.com/en-us/azure/devops/pipelines/library/secure-files?view=azure-devops