Examkin

Question

Difficulty: HardAzure Key Vault Secret, Key, and Certificate Management

An organization is migrating an ASP.NET Core web application to Azure App Service. The application must retrieve a database connection string from Azure Key Vault `kv-prod` using Azure App Configuration. The web application is configured to use a user-assigned managed identity named `id-app-prod`. The Azure Key Vault uses Azure role-based access control (Azure RBAC) for authorization. You need to configure the App Configuration key-vault reference and ensure the App Service web application can retrieve the database connection string. Which two configuration steps must you perform? (Select TWO)

  1. Configure a key-value pair in Azure App Configuration with a value of `@Microsoft.KeyVault(SecretUri=https://kv-prod.vault.azure.net/secrets/db-conn-string)`Answer
  2. B
    Configure a key-value pair in Azure App Configuration with a value of `@Azure.KeyVault(Uri=https://kv-prod.vault.azure.net/secrets/db-conn-string)`
  3. Assign the 'Key Vault Secrets User' Azure RBAC role to the user-assigned managed identity `id-app-prod` for the Key Vault `kv-prod`Answer
  4. D
    Grant the Azure App Configuration system-assigned managed identity a Key Vault access policy with 'Get' secret permissions

Answer

Configure a key-value pair in Azure App Configuration with a value using the `@Microsoft.KeyVault(SecretUri=...)` syntax, and assign the 'Key Vault Secrets User' Azure RBAC role to the user-assigned managed identity `id-app-prod` on the Key Vault.
The correct configuration requires using the exact `@Microsoft.KeyVault(SecretUri=...)` syntax in Azure App Configuration so the client provider knows to retrieve the secret value from Azure Key Vault. In addition, because the Key Vault uses Azure RBAC for authorization, the application's user-assigned managed identity must be granted the 'Key Vault Secrets User' role. The client application resolves these references at runtime using its own credentials, not the App Configuration service principal.

Step-by-Step Solution

1
Configure the key-value pair in Azure App Configuration.
The reference uses the prefix `@Microsoft.KeyVault(SecretUri=...)` pointing to the Key Vault secret URI.
This instructs the App Configuration client library to resolve the secret directly from Azure Key Vault.
2
Configure authorization on the Azure Key Vault.
The user-assigned managed identity `id-app-prod` is granted the 'Key Vault Secrets User' role on the vault.
Because the Key Vault uses Azure RBAC, the web app's identity must have read access to the secrets.

Key Concept

Azure App Configuration Key Vault References and Azure RBAC Authorization
Rate this question

Topics

Azure Key Vault Secret, Key, and Certificate Management

More questions from this topic