Examkin

Question

Difficulty: HardSecure App Configuration and Key Vault References

You are configuring a Java web application hosted on Azure App Service to load configuration settings from an Azure App Configuration store. The application needs to retrieve a database password stored in an Azure Key Vault named kv-prod.

In the Azure App Configuration store, you create a key-value pair where the key is DbPassword and the value is set to {"uri":"https://kv-prod.vault.azure.net/secrets/db-pass"}. During application startup, the App Configuration provider library retrieves the DbPassword configuration, but logs show the value is received as the raw JSON string {"uri":"https://kv-prod.vault.azure.net/secrets/db-pass"} instead of the resolved secret. The App Service is configured with a system-assigned managed identity that has the 'Key Vault Secrets User' role on kv-prod.

Which of the following actions should you take to ensure the secret is correctly resolved by the application?

  1. Update the content-type of the DbPassword key-value in Azure App Configuration to application/vnd.microsoft.appconfig.keyvaultref+json;charset=utf-8.Answer
  2. B
    Change the value of the DbPassword key-value in Azure App Configuration to use the format @Microsoft.KeyVault(SecretUri=https://kv-prod.vault.azure.net/secrets/db-pass).
  3. C
    Enable a system-assigned managed identity on the Azure App Configuration store and assign it the Key Vault Secrets User role on the Key Vault.
  4. D
    Prefix the configuration key in Azure App Configuration with KeyVault: and set the content-type of the key-value to application/json.

Answer

Update the content-type of the DbPassword key-value in Azure App Configuration to application/vnd.microsoft.appconfig.keyvaultref+json;charset=utf-8.
The correct action is to set the content-type of the key-value pair to application/vnd.microsoft.appconfig.keyvaultref+json;charset=utf-8. Azure App Configuration client SDKs identify Key Vault references using this metadata. If it is missing or incorrect, the SDK retrieves the value as a plain JSON string rather than resolving the secret from the Key Vault.

Step-by-Step Solution

1
Analyze how Azure App Configuration distinguishes Key Vault references from standard string values.
Identify that the client SDK checks the key-value's content-type metadata to determine if it should resolve a secret.
If the content-type is empty or set to a standard type like text/plain, the SDK treats the value as a literal string.
2
Verify the permission model for Key Vault reference resolution.
Confirm that the application's identity (the App Service's system-assigned managed identity) is the one that needs access to Key Vault.
Because resolution is performed client-side by the client provider library, the application's credentials are used to fetch the secret from Key Vault.
3
Apply the correct configuration format in Azure App Configuration.
Update the key-value's content-type to application/vnd.microsoft.appconfig.keyvaultref+json;charset=utf-8.
This content-type instructs the provider library to parse the JSON value, retrieve the URI, and fetch the secret value from Key Vault at runtime.

Key Concept

Key Vault references in Azure App Configuration require a specific content-type header and are resolved client-side by the application SDK using the application's identity.
Rate this question

Topics

Secure App Configuration and Key Vault References

More questions from this topic