Examkin

Question

Difficulty: HardAzure Key Vault Secret, Key, and Certificate Management

An organization has a web application deployed to Azure App Service named app-payment-prod. The application needs to retrieve a database connection string stored as a secret in an Azure Key Vault named kv-payment-prod. The Key Vault is configured to use the Azure Role-Based Access Control (Azure RBAC) authorization model. You must implement access using the principle of least privilege. Which set of configuration steps should you perform to grant the web application access to the Key Vault secret?

  1. Enable a system-assigned managed identity on the App Service. Assign the 'Key Vault Secrets User' Azure RBAC role to the identity's service principal at the scope of the Key Vault. Reference the secret in the App Service settings using the syntax: @Microsoft.KeyVault(SecretUri=https://kv-payment-prod.vault.azure.net/secrets/db-conn-string/)Answer
  2. B
    Enable a system-assigned managed identity on the App Service. Create a Key Vault access policy on kv-payment-prod that grants 'Get' secrets permission to the identity. Reference the secret in the App Service settings using the syntax: @Microsoft.KeyVault(SecretUri=https://kv-payment-prod.vault.azure.net/secrets/db-conn-string/)
  3. C
    Enable a system-assigned managed identity on the App Service. Assign the 'Key Vault Reader' Azure RBAC role to the identity's service principal at the scope of the Key Vault. Reference the secret in the App Service settings using the syntax: @KeyVault(SecretUri=https://kv-payment-prod.vault.azure.net/secrets/db-conn-string/)
  4. D
    Enable a user-assigned managed identity on the App Service. Assign the 'Key Vault Secrets User' Azure RBAC role to the identity's service principal at the scope of the Key Vault. Reference the secret in the App Service settings using the syntax: @Microsoft.KeyVault(SecretUri=https://kv-payment-prod.vault.azure.net/secrets/db-conn-string/)

Answer

Enable a system-assigned managed identity on the App Service, assign the 'Key Vault Secrets User' Azure RBAC role to the identity at the Key Vault scope, and reference the secret using the '@Microsoft.KeyVault(SecretUri=...)' syntax.
The correct configuration enables the system-assigned managed identity on the App Service, grants it the 'Key Vault Secrets User' role under the Azure RBAC model, and references the secret using the correct '@Microsoft.KeyVault(SecretUri=...)' syntax. This satisfies the requirement of using the Azure RBAC model, enforces least privilege (by avoiding administrative roles like 'Secrets Officer' or 'Administrator'), and uses valid parsing syntax.

Step-by-Step Solution

1
Configure the web application identity
Enable a system-assigned managed identity on the App Service
This establishes a security principal in Microsoft Entra ID (Azure Active Directory) that is tied to the lifecycle of the App Service.
2
Assign authorization permissions
Assign the 'Key Vault Secrets User' Azure RBAC role to the managed identity's service principal at the scope of the Key Vault
Since the vault uses the Azure RBAC model, access policies are ignored. The 'Key Vault Secrets User' role grants read access to secret values without granting unnecessary administrative permissions, satisfying the least-privilege requirement.
3
Define Key Vault references in application settings
Set the environment variable value using the '@Microsoft.KeyVault(SecretUri=...)' syntax
This enables the App Service to automatically resolve the secret from the Key Vault at runtime and expose it as a standard environment variable to the application code.

Key Concept

Configuring App Service Key Vault references with Azure RBAC and Managed Identities
Estimated Time:2m 30s
Rate this question

Topics

Azure Key Vault Secret, Key, and Certificate Management

More questions from this topic