Examkin

Soru

Zorluk: OrtaCreate and Configure Azure Functions

A developer is configuring a V4 Azure Function App to connect to a secure database. The database connection string is stored in Azure Key Vault. The developer wants to reference this secret directly in the Function App's application settings without writing custom code to retrieve it. The Function App has a system-assigned managed identity enabled. Which of the following configurations is required to successfully retrieve the secret at runtime?

  1. Grant the system-assigned managed identity GET permission on secrets in the Key Vault access policy, and set the application setting value using the @Microsoft.KeyVault(SecretUri=...) syntax.Cevap
  2. B
    Grant the system-assigned managed identity GET permission on secrets in the Key Vault access policy, and set the application setting value using the keyvault://[vaultname]/[secretname] URI format.
  3. C
    Configure the application setting value using the @Microsoft.KeyVault(SecretUri=...) syntax, but enable a user-assigned managed identity on the Function App without granting it any permissions in Key Vault.
  4. D
    Grant the system-assigned managed identity Contributor permissions on the Key Vault resource group, and set the application setting value using the secret's name only.

Cevap

Grant the system-assigned managed identity GET permission on secrets in the Key Vault access policy, and set the application setting value using the @Microsoft.KeyVault(SecretUri=...) syntax.
The correct configuration resolves the secret automatically because it meets both the syntax and permission criteria. The system-assigned managed identity must be granted the GET secret permission in the Key Vault's access policy (or via Azure RBAC Key Vault Secrets User), and the application setting must use the `@Microsoft.KeyVault(SecretUri=...)` syntax for the runtime to locate and retrieve the secret.

Adım Adım Çözüm

1
Determine the syntax needed for Key Vault references in Azure Functions.
The reference must use the `@Microsoft.KeyVault(...)` syntax.
This is the syntax required by the App Service and Azure Functions hosting runtime to automatically intercept and resolve the setting value.
2
Identify the authentication mechanism and permissions.
The system-assigned managed identity must have GET permissions for Key Vault secrets.
The runtime resolves references using the app's managed identity, which needs explicit data-plane read permissions on Key Vault secrets.
3
Combine both configurations.
Ensure the managed identity is configured with the Key Vault access policy (or RBAC data plane role) and the setting has the correct reference syntax.
If either setting syntax is wrong or permission is missing, the reference fails to resolve, yielding a runtime error or empty value.

Anahtar Kavram

Configuring Key Vault references in Azure Functions application settings
Bu soruyu puanla

Konular

Create and Configure Azure Functions

Bu konudan daha fazla soru