Examkin

Question

Difficulty: EasyCreate and Configure Azure Functions

You are configuring a new Azure Function App that must retrieve secrets from Azure Key Vault. According to your organization's security policy, you must ensure that no credentials, tokens, or connection strings are stored directly in the Function App's configuration settings or code. Which Azure feature should you enable for the Function App to authenticate and gain access to the Key Vault?

  1. A
    A user-assigned managed identity assigned directly to the Key Vault resource
  2. B
    A Key Vault reference configured in the application settings without configuring access policies or roles
  3. A system-assigned managed identity for the Function AppAnswer
  4. D
    A Shared Access Signature (SAS) token with full read and write scopes stored in the configuration settings

Answer

A system-assigned managed identity for the Function App
Enabling a system-assigned managed identity creates a security principal in Microsoft Entra ID that is uniquely tied to the Azure Function App. The Function App can use this identity to authenticate to Key Vault and other Azure services without needing to store or manage credentials in settings or code.

Step-by-Step Solution

1
Analyze the security constraints.
The Function App must access the Key Vault without storing any credentials or secrets in its configuration settings or source code.
This rules out authentication methods that rely on shared keys, connection strings, or static SAS tokens.
2
Select the correct identity mechanism.
A system-assigned managed identity is enabled directly on the Function App.
This provides the application with an identity in Microsoft Entra ID that is automatically managed and tied to the lifecycle of the Function App resource.
3
Configure permissions on the target resource.
Grant the system-assigned managed identity GET secret permissions on the Key Vault.
This allows the Function App to authenticate securely and authorizes it to read the required secrets.

Key Concept

Configuring managed identities for Azure Functions to secure resource access
Estimated Time:1m 0s
Rate this question

Topics

Create and Configure Azure Functions

More questions from this topic