Examkin

Question

Difficulty: MediumAzure Key Vault Secret, Key, and Certificate Management

A developer is configuring a C# ASP.NET Core web application hosted on an Azure App Service. The application must retrieve a database connection string stored in an Azure Key Vault named kv-prod using a Key Vault reference in the App Service configuration. The App Service is configured with a system-assigned managed identity. Which configuration should the developer apply to retrieve the secret value successfully?

  1. Set the application setting value to @Microsoft.KeyVault(SecretUri=https://kv-prod.vault.azure.net/secrets/db-conn/) and assign the Key Vault Secrets User role to the App Service system-assigned managed identity.Answer
  2. B
    Set the application setting value to @Microsoft.KeyVault(SecretUrl=https://kv-prod.vault.azure.net/secrets/db-conn/) and assign the Key Vault Secrets User role to the App Service system-assigned managed identity.
  3. C
    Set the application setting value to @Microsoft.KeyVault(SecretUri=https://kv-prod.vault.azure.net/secrets/db-conn/) and assign the Key Vault Reader role to the App Service system-assigned managed identity.
  4. D
    Set the application setting value to @Microsoft.KeyVault(SecretUri=https://kv-prod.vault.azure.net/secrets/db-conn/) and assign the Key Vault Secrets User role to a new user-assigned managed identity, because system-assigned managed identities are not supported for Key Vault references.

Answer

Set the application setting value to @Microsoft.KeyVault(SecretUri=https://kv-prod.vault.azure.net/secrets/db-conn/) and assign the Key Vault Secrets User role to the App Service system-assigned managed identity.
The correct configuration requires setting the application setting to the format @Microsoft.KeyVault(SecretUri=https://kv-prod.vault.azure.net/secrets/db-conn/) and granting the system-assigned managed identity the Key Vault Secrets User role. The SecretUri parameter is the correct syntax for referencing a secret by its URI, and the Key Vault Secrets User role provides the necessary permissions to read the secret's value at runtime.

Step-by-Step Solution

1
Define the App Service application setting value using the Key Vault reference syntax with the SecretUri parameter.
The setting is configured as @Microsoft.KeyVault(SecretUri=https://kv-prod.vault.azure.net/secrets/db-conn/).
This tells the App Service runtime to resolve the setting value from the specified Key Vault secret.
2
Assign the Key Vault Secrets User role to the system-assigned managed identity on the Key Vault.
The identity is authorized to retrieve the secret value.
Without this role (or equivalent access policy permissions), the App Service runtime will fail to retrieve the secret value, causing the setting to remain unresolved.

Key Concept

Key Vault References in App Service
Rate this question

Topics

Azure Key Vault Secret, Key, and Certificate Management

More questions from this topic