Examkin

Question

Difficulty: MediumAzure Key Vault Secret, Key, and Certificate Management

You are deploying a web application to Azure App Service. The application must retrieve a database connection string from an Azure Key Vault named kv-billing. You configure a system-assigned managed identity for the App Service and assign the Key Vault Secrets User role to the identity on kv-billing. You need to configure an application setting in the App Service named DbConnectionString that references the secret named DbPassword in the Key Vault without pinning it to a specific version. Which of the following values represents the correct syntax to define the Key Vault reference?

  1. @Microsoft.KeyVault(SecretUri=https://kv-billing.vault.azure.net/secrets/DbPassword)Answer
  2. B
    @Microsoft.KeyVault(Uri=https://kv-billing.vault.azure.net/secrets/DbPassword)
  3. C
    @KeyVault(SecretUri=https://kv-billing.vault.azure.net/secrets/DbPassword)
  4. D
    @Microsoft.KeyVault(VaultName=kv-billing;Secret=DbPassword)

Answer

@Microsoft.KeyVault(SecretUri=https://kv-billing.vault.azure.net/secrets/DbPassword)
The correct answer uses the valid syntax format '@Microsoft.KeyVault(SecretUri=https://kv-billing.vault.azure.net/secrets/DbPassword)'. This tells the Azure App Service runtime to fetch the secret named 'DbPassword' from the Key Vault named 'kv-billing' using the system-assigned managed identity.

Step-by-Step Solution

1
Identify the required prefix for Key Vault references in Azure App Service application settings.
The prefix must be @Microsoft.KeyVault.
Azure App Service recognizes this prefix to intercept and resolve the reference from Key Vault before exposing the configuration value to the application code.
2
Identify the correct parameter name for referencing a secret by its URI.
The parameter name is SecretUri.
Using other parameter names like Uri will cause the reference to be treated as invalid syntax and it will not resolve.
3
Format the URI for the secret without pinning a version.
The URI is https://kv-billing.vault.azure.net/secrets/DbPassword.
Leaving out the version GUID at the end of the secret path ensures that the reference always resolves to the latest version of the secret.

Key Concept

Key Vault references allow an Azure App Service application to read secrets from Key Vault using configuration settings without modifying application code, requiring a system-assigned or user-assigned managed identity with appropriate access permissions.
Rate this question

Topics

Azure Key Vault Secret, Key, and Certificate Management

More questions from this topic