Examkin

Soru

Zorluk: OrtaAzure Key Vault Secret, Key, and Certificate Management

You are developing a secure .NET web API hosted on an Azure App Service. The API needs to programmatically retrieve an X.509 certificate, including its private key, from an Azure Key Vault named `kv-prod` to sign outgoing requests.

The App Service is configured with a system-assigned managed identity and has been assigned only the 'Key Vault Secrets User' Azure RBAC role on `kv-prod`.

Which C# code segment should you use to retrieve the certificate along with its private key?

  1. var client = new SecretClient(new Uri("https://kv-prod.vault.azure.net/"), new DefaultAzureCredential());
    KeyVaultSecret secret = await client.GetSecretAsync("SigningCert");
    var certificate = new X509Certificate2(Convert.FromBase64String(secret.Value));    Cevap
  2. B
    var client = new CertificateClient(new Uri("https://kv-prod.vault.azure.net/"), new DefaultAzureCredential());
    KeyVaultCertificateWithPolicy cert = await client.GetCertificateAsync("SigningCert");
    var certificate = new X509Certificate2(cert.Cer);
  3. C
    var client = new KeyClient(new Uri("https://kv-prod.vault.azure.net/"), new DefaultAzureCredential());
    KeyVaultKey key = await client.GetKeyAsync("SigningCert");
    var certificate = new X509Certificate2(key.Key.N);
  4. D
    var credential = new ClientSecretCredential("tenantId", "clientId", "clientSecret");
    var client = new SecretClient(new Uri("https://kv-prod.vault.azure.net/"), credential);
    KeyVaultSecret secret = await client.GetSecretAsync("SigningCert");
    var certificate = new X509Certificate2(Convert.FromBase64String(secret.Value));

Cevap

Use SecretClient with DefaultAzureCredential to retrieve the certificate value as a secret, then instantiate the X509Certificate2 object using the base64-decoded bytes.
In Azure Key Vault, when an X.509 certificate is created or imported, the certificate's private key and full PFX/PEM contents are stored as a Secret with the same name. To retrieve the private key of a certificate programmatically, you must retrieve it as a secret using the SecretClient and decode the base64-encoded secret value. Because the App Service managed identity is granted the 'Key Vault Secrets User' RBAC role, it has the necessary permissions to read secrets from the Key Vault.

Adım Adım Çözüm

1
Identify where the private key of an Azure Key Vault certificate is stored.
The private key of an Azure Key Vault certificate is stored as a Key Vault Secret under the same name.
Azure Key Vault certificates are composite resources; the public portion is managed via the certificate API, but the private key can only be downloaded programmatically by retrieving the secret payload.
2
Verify authorization requirements against the assigned role.
The 'Key Vault Secrets User' RBAC role allows read access to secrets but not to certificates or keys.
Since the private key must be retrieved as a secret, the application needs to utilize SecretClient and must have the Secrets User permission.
3
Select the correct SDK client and credentials for local reconstruction.
Initialize SecretClient using DefaultAzureCredential to leverage the system-assigned managed identity, get the secret, base64-decode the value, and initialize X509Certificate2.
DefaultAzureCredential seamlessly handles system-assigned managed identity authentication in App Service environments.

Anahtar Kavram

Retrieving certificates with private keys from Azure Key Vault using the Azure SDK for .NET and Azure RBAC
Tahmini Süre:1m 30s
Bu soruyu puanla

Konular

Azure Key Vault Secret, Key, and Certificate Management

Bu konudan daha fazla soru