Examkin

Soru

Zorluk: OrtaAzure Key Vault Secret, Key, and Certificate Management

You are configuring an Azure App Service web application to retrieve a third-party payment provider API key stored as a secret in Azure Key Vault. The Key Vault, named kv-payment-prod, is configured to use the Azure role-based access control (Azure RBAC) permission model. The web application uses a system-assigned managed identity for authentication. You must reference the Key Vault secret directly within the App Service application settings under a setting named PaymentApiKey. You must follow the principle of least privilege. Which action should you perform to configure the application setting and permissions?

  1. Assign the Key Vault Secrets User role to the web application's system-assigned managed identity at the Key Vault scope, and set the value of the PaymentApiKey application setting to @Microsoft.KeyVault(SecretUri=https://kv-payment-prod.vault.azure.net/secrets/ApiKey/).Cevap
  2. B
    Create a Key Vault access policy for the web application's system-assigned managed identity that grants Get secret permissions, and set the value of the PaymentApiKey application setting to @Microsoft.KeyVault(SecretUri=https://kv-payment-prod.vault.azure.net/secrets/ApiKey/).
  3. C
    Assign the Key Vault Secrets User role to the web application's system-assigned managed identity at the Key Vault scope, and set the value of the PaymentApiKey application setting to @KeyVault(SecretUri=https://kv-payment-prod.vault.azure.net/secrets/ApiKey/).
  4. D
    Create a new user-assigned managed identity, assign the Key Vault Reader role to this identity at the Key Vault scope, and set the value of the PaymentApiKey application setting to @Microsoft.KeyVault(SecretUri=https://kv-payment-prod.vault.azure.net/secrets/ApiKey/).

Cevap

Assign the Key Vault Secrets User role to the web application's system-assigned managed identity at the Key Vault scope, and set the value of the PaymentApiKey application setting to @Microsoft.KeyVault(SecretUri=https://kv-payment-prod.vault.azure.net/secrets/ApiKey/).
To allow the App Service to retrieve a secret from an Azure Key Vault configured with the Azure RBAC permission model, the application's system-assigned managed identity must be granted the Key Vault Secrets User role, which provides read access to the secret values. The App Service configuration reference must use the correct prefix @Microsoft.KeyVault(SecretUri=...) pointing to the secret's URI.

Adım Adım Çözüm

1
Determine the correct authorization role under the Azure RBAC model.
The Key Vault Secrets User role is selected as it grants the necessary data-plane permissions to read secret values, satisfying the principle of least privilege.
Other roles like Key Vault Reader do not grant access to the secret contents.
2
Formulate the App Service Key Vault reference syntax.
The syntax must follow the pattern @Microsoft.KeyVault(SecretUri=...) containing the full URI of the secret.
Incorrect prefixes such as @KeyVault(...) will prevent the App Service from resolving the reference.
3
Apply the configurations to the App Service setting.
Configure the system-assigned managed identity of the App Service with the Key Vault Secrets User role, and assign the valid Key Vault reference string to the PaymentApiKey setting.
This completes the authorization and reference mapping without requiring legacy access policies.

Anahtar Kavram

Azure Key Vault references in App Service configuration combined with Azure RBAC authorization.
Bu soruyu puanla

Konular

Azure Key Vault Secret, Key, and Certificate Management

Bu konudan daha fazla soru