Examkin

Question

Difficulty: MediumAzure Key Vault Secret, Key, and Certificate Management

You are developing a C# console application that runs on an Azure Virtual Machine. The application must perform key wrapping and unwrapping operations using an RSA key stored in an Azure Key Vault named kv-prod-keys. The Key Vault is configured to use the Azure Role-Based Access Control (Azure RBAC) permission model. The virtual machine has a system-assigned managed identity enabled. You need to grant the application the minimum necessary permissions to perform the operations and configure the application code using the latest Azure SDK for .NET. Which two actions should you perform? (Select TWO.)

  1. Assign the Key Vault Crypto User role to the system-assigned managed identity of the virtual machine.Answer
  2. Instantiate the CryptographyClient class from the Azure.Security.KeyVault.Keys.Cryptography namespace.Answer
  3. C
    Assign the Key Vault Secrets User role to the system-assigned managed identity of the virtual machine.
  4. D
    Create a Key Vault access policy that grants Key Wrap and Key Unwrap permissions to the system-assigned managed identity.
  5. E
    Configure a user-assigned managed identity on the virtual machine and assign it the Reader role on the Key Vault resource.

Answer

Assign the Key Vault Crypto User role to the system-assigned managed identity and use the CryptographyClient class from the Azure.Security.KeyVault.Keys.Cryptography namespace.
To perform cryptographic operations such as key wrapping and unwrapping using an RSA key in Azure Key Vault, the application identity requires the 'Key Vault Crypto User' RBAC role, which provides data plane access for keys. In the Azure SDK for .NET (Azure.Security.KeyVault), cryptographic operations are separated from management operations and must be executed using the 'CryptographyClient' class located in the 'Azure.Security.KeyVault.Keys.Cryptography' namespace.

Step-by-Step Solution

1
Determine the required access control configuration for the Azure Key Vault.
Since the vault uses the Azure RBAC permission model, permissions must be assigned using Azure RBAC roles rather than Key Vault access policies.
Access policies are disabled when the Azure RBAC permission model is active.
2
Select the correct role for key wrapping and unwrapping operations.
The Key Vault Crypto User role is chosen, as it provides the least privilege required to perform data plane cryptographic operations on keys.
Other roles like Key Vault Secrets User are for secrets, and the Reader role does not grant data plane access.
3
Identify the modern C# SDK class and namespace for cryptographic operations.
Use the CryptographyClient class within the Azure.Security.KeyVault.Keys.Cryptography namespace.
The Azure.Security.KeyVault.Keys SDK separates management operations (KeyClient) from cryptographic operations (CryptographyClient) for efficiency and security.

Key Concept

Azure Key Vault cryptographic operations and RBAC-based access control using the Azure SDK for .NET.
Rate this question

Topics

Azure Key Vault Secret, Key, and Certificate Management

More questions from this topic