Examkin

Question

Difficulty: MediumConfigure Azure App Service Web Apps

An administrator is configuring a Web App named `inventory-api` on Azure App Service. The application must satisfy the following requirements:

1. Retrieve database credentials from Azure Key Vault without storing them in the application code.
2. Authenticate to the Key Vault using a managed identity that is tied to the lifecycle of the Web App.
3. Automatically increase the instance count when CPU usage exceeds 80%, and decrease the instance count when CPU usage drops below 70% without causing flapping.

Which two of the following configuration actions must you perform? Select two.

  1. Assign a system-assigned managed identity to the Web App and grant it GET access to the Key Vault secrets.Answer
  2. Create an application setting for the database credential that uses the value `@Microsoft.KeyVault(VaultName=kv-prod;SecretName=db-password)`.Answer
  3. C
    Assign a user-assigned managed identity to the Web App to ensure the identity is automatically cleaned up when the Web App is deleted.
  4. D
    Create an application setting for the database credential that uses the value `@Microsoft.AppConfiguration(KeyVaultUri=https://kv-prod.vault.azure.net/secrets/db-password/)`.
  5. E
    Configure a scale-out autoscale rule with a CPU threshold of 80% and a scale-in autoscale rule with a CPU threshold of 85%.

Answer

Assign a system-assigned managed identity to the Web App and grant it GET access to the Key Vault secrets, and create an application setting for the database credential that uses the value `@Microsoft.KeyVault(VaultName=kv-prod;SecretName=db-password)`.
Assigning a system-assigned managed identity fulfills the lifecycle requirement since system-assigned identities are deleted automatically when the associated Web App is deleted. Granting GET access allows the App Service to fetch the secret values. The App Service Key Vault reference syntax `@Microsoft.KeyVault(VaultName=kv-prod;SecretName=db-password)` allows the app setting to fetch the value securely from Key Vault.

Step-by-Step Solution

1
Select the correct managed identity type based on the lifecycle requirement.
Identify that a system-assigned managed identity is required because it is tied directly to the lifecycle of the Web App, whereas a user-assigned managed identity is a standalone resource.
Managed identity lifecycle requirements dictate whether to use system-assigned (tied to resource lifecycle) or user-assigned (independent).
2
Identify the correct syntax for referencing Key Vault secrets in App Service application settings.
Determine that `@Microsoft.KeyVault(VaultName=kv-prod;SecretName=db-password)` is the correct format.
App Service native Key Vault references must use the @Microsoft.KeyVault prefix and specify either SecretUri or VaultName/SecretName.
3
Evaluate the autoscale thresholds to prevent flapping.
Avoid configuring a scale-in threshold that is higher than or equal to the scale-out threshold, as this results in flapping.
Proper autoscale configuration requires the scale-out threshold to be higher than the scale-in threshold.

Key Concept

Configuring App Service App Settings, Managed Identities, Key Vault references, and autoscale rules.
Rate this question

Topics

Configure Azure App Service Web Apps

More questions from this topic