Examkin

Question

Difficulty: HardConfigure Azure App Services

An administrator is configuring a deployment slot named staging for an Azure App Service web app named app-finance that runs on a Standard S1 App Service plan. The web app connects to an Azure SQL database. The production slot must connect to a database named db-prod by retrieving a connection string from an Azure Key Vault named kv-prod. The staging slot must connect to a database named db-stage by retrieving a connection string from an Azure Key Vault named kv-stage. A system-assigned managed identity is enabled on both the production slot and the staging slot. The database connection string is configured in the App Service settings under the name DbConnectionString using Key Vault references. The administrator needs to configure the web app and Key Vaults to ensure that after a slot swap, the web app running in the production slot connects to db-prod and the web app running in the staging slot connects to db-stage, without any authentication failures. Which of the following configurations should the administrator implement?

  1. A
    Configure DbConnectionString as a deployment slot setting in both slots. Grant the Key Vault Contributor role on the resource group containing the Key Vaults to both managed identities.
  2. Configure DbConnectionString as a deployment slot setting in both slots. Grant the Key Vault Secrets User role in kv-prod to the production slot's managed identity, and grant the Key Vault Secrets User role in kv-stage to the staging slot's managed identity.Answer
  3. C
    Configure DbConnectionString as a deployment slot setting in both slots. Assign the Microsoft Entra ID Application Administrator role to the managed identities of both slots to allow them to read secrets from the Key Vaults.
  4. D
    Configure DbConnectionString as a standard (non-slot) setting in both slots, and scale down the App Service plan to the Basic B1 tier to reduce costs during testing.

Answer

Configure DbConnectionString as a deployment slot setting in both slots. Grant the Key Vault Secrets User role in kv-prod to the production slot's managed identity, and grant the Key Vault Secrets User role in kv-stage to the staging slot's managed identity.
The correct configuration requires marking the DbConnectionString setting as a deployment slot setting in both slots. This ensures that the setting is sticky to the slot and does not swap when the deployment slots are swapped, keeping the production slot pointing to the production Key Vault (kv-prod) and the staging slot pointing to the staging Key Vault (kv-stage). Additionally, because system-assigned managed identities are resource-specific and do not swap with the slots, the production slot's managed identity must be granted the Key Vault Secrets User role in kv-prod, and the staging slot's managed identity must be granted the Key Vault Secrets User role in kv-stage to read the secret values.

Step-by-Step Solution

1
Configure the DbConnectionString setting in both the production and staging slots using Key Vault references pointing to the respective Key Vault secrets.
The production slot points to the secret in kv-prod and the staging slot points to the secret in kv-stage.
Allows the App Service to securely retrieve database connection strings from Azure Key Vault without storing them in plain text.
2
Mark the DbConnectionString app setting as a deployment slot setting (sticky setting) in both slots.
The setting value is locked to the slot and does not swap during deployment slot swaps.
Prevents the production slot from swapping its connection string configuration with the staging slot, ensuring it always points to the production database.
3
Assign the Key Vault Secrets User role to the production slot's managed identity on kv-prod, and to the staging slot's managed identity on kv-stage.
Each slot's system-assigned managed identity has the required data-plane permissions to read secrets from its respective Key Vault.
System-assigned managed identities are resource-specific and sticky to their respective slots. Because they do not swap, each identity must be granted the specific permissions needed for its corresponding Key Vault.

Key Concept

Deployment slots and managed identities in Azure App Service. System-assigned managed identities are bound to the specific slot instance and do not swap, requiring separate Key Vault permissions for each slot. App settings must be configured as deployment slot settings to remain sticky during a slot swap.
Rate this question

Topics

Configure Azure App Services

More questions from this topic