Examkin

Question

Difficulty: Very hardAzure Key Vault Secret, Key, and Certificate Management

An enterprise Azure Function app is configured with a system-assigned managed identity. The application must perform envelope encryption on sensitive payloads before uploading them to Azure Blob Storage. A symmetric Data Encryption Key (DEK) is generated locally for each payload. The DEK must be wrapped (encrypted) using an HSM-backed RSA Key Encryption Key (KEK) named PayloadKEK stored in an Azure Key Vault named kv-prod. The Key Vault has Azure Role-Based Access Control (Azure RBAC) enabled as its permission model. You need to implement the solution using the latest Azure SDK for .NET. Which two of the following actions must you perform to configure permissions and wrap the DEK?

  1. Assign the Key Vault Crypto User role for kv-prod to the system-assigned managed identity of the Function app.Answer
  2. B
    Assign the Key Vault Crypto Service Encryption User role for kv-prod to the system-assigned managed identity of the Function app.
  3. In the Function app code, instantiate a CryptographyClient using DefaultAzureCredential and the URI of PayloadKEK, and call WrapKeyAsync.Answer
  4. D
    In the Function app code, instantiate a KeyClient using DefaultAzureCredential, call GetKeyAsync to retrieve PayloadKEK, and perform the key wrapping locally using the key's public/private parameters.

Answer

Assign the Key Vault Crypto User role for the Key Vault to the system-assigned managed identity, and in the application code, use the CryptographyClient with DefaultAzureCredential to call WrapKeyAsync.
To perform envelope encryption, you must grant the system-assigned managed identity of the Function app the Key Vault Crypto User role, which enables the identity to invoke the key wrapping APIs of Key Vault. In the C# .NET SDK, you must use the CryptographyClient class from the Azure.Security.KeyVault.Keys.Cryptography namespace to handle cryptographic operations like key wrapping, using DefaultAzureCredential for token acquisition.

Step-by-Step Solution

1
Configure Key Vault Authorization
The system-assigned managed identity of the Azure Function app is assigned the Key Vault Crypto User role on the kv-prod Key Vault.
This RBAC role is required to grant the application permission to perform cryptographic wrap/unwrap operations using keys within the Key Vault.
2
Instantiate the Cryptography Client
The CryptographyClient is instantiated in the .NET code using the Key Vault key's URI and DefaultAzureCredential.
The modern Azure SDK separates management operations (KeyClient) from cryptographic operations (CryptographyClient). The CryptographyClient is specialized for wrapping and unwrapping.
3
Execute the Wrapping Operation
WrapKeyAsync is called on the CryptographyClient, passing the locally generated DEK and the desired KeyWrapAlgorithm.
This securely wraps the symmetric DEK using the KEK stored in the Key Vault, offloading the cryptographic operation to the Key Vault itself.

Key Concept

Azure Key Vault Key Cryptography and Azure RBAC Roles
Rate this question

Topics

Azure Key Vault Secret, Key, and Certificate Management

More questions from this topic