Examkin

Question

Difficulty: MediumAzure Key Vault Secret, Key, and Certificate Management

Your company is migrating an Azure App Service web application to a new security model. The web application must retrieve database connection strings stored as secrets in an Azure Key Vault. The Key Vault is configured to use the Azure role-based access control (Azure RBAC) authorization model. You need to configure the minimum permissions required for the web application's system-assigned managed identity to read the secrets. Which configuration should you apply?

  1. A
    Assign the Key Vault Reader role to the system-assigned managed identity.
  2. Assign the Key Vault Secrets User role to the system-assigned managed identity.Answer
  3. C
    Create a Key Vault access policy with Secret Get permissions and assign it to the system-assigned managed identity.
  4. D
    Assign the Key Vault Secrets User role to a new user-assigned managed identity and configure the web application to use it.

Answer

Assign the Key Vault Secrets User role to the system-assigned managed identity.
The correct answer is to assign the Key Vault Secrets User role to the system-assigned managed identity. Under the Azure RBAC authorization model, this specific role provides the minimum privilege necessary to read secret values (such as database connection strings) without granting administrative permissions to create or delete secrets. Furthermore, because the vault uses Azure RBAC, legacy access policies are disabled, and the Web App's existing system-assigned managed identity should be used directly rather than creating a new identity.

Step-by-Step Solution

1
Identify the active authorization model for the Azure Key Vault.
The Key Vault is configured for Azure RBAC, meaning classic Key Vault access policies are disabled and will not grant access.
Choosing the correct authorization mechanism is necessary to ensure permissions are successfully evaluated.
2
Determine the minimum privilege Azure RBAC role required to read secret values.
The Key Vault Secrets User role allows reading secret values, whereas Key Vault Reader only allows reading metadata.
Using the least privilege principle prevents over-assigning permissions while still enabling functionality.
3
Apply the role assignment to the appropriate identity.
The role is assigned directly to the App Service's existing system-assigned managed identity.
This utilizes the existing identity lifecycle without creating redundant resources.

Key Concept

Azure Key Vault RBAC permission model and built-in roles
Estimated Time:1m 30s
Rate this question

Topics

Azure Key Vault Secret, Key, and Certificate Management

More questions from this topic