Examkin

Soru

Zorluk: OrtaAzure Key Vault Secret, Key, and Certificate Management

A C# background service runs on an Azure Virtual Machine that is configured with a user-assigned managed identity. The service must decrypt sensitive application data using an asymmetric key named `app-decrypt-key` stored in an Azure Key Vault named `contoso-vault`. The Key Vault has Azure role-based access control (Azure RBAC) enabled as its authorization model. You need to grant the minimum necessary permissions to the managed identity and implement the decryption logic in the service's C# code using the Azure SDK for .NET. Which two actions should you perform? (Choose two.)

  1. Assign the Key Vault Crypto User role to the user-assigned managed identity for the contoso-vault scope.Cevap
  2. In the C# application code, instantiate a CryptographyClient using the key URI and call its DecryptAsync method.Cevap
  3. C
    Assign the Key Vault Crypto User role to the virtual machine's system-assigned managed identity, while configuring the application's DefaultAzureCredential to use the user-assigned managed identity.
  4. D
    In the C# application code, instantiate a KeyClient using the Key Vault endpoint and call its DecryptAsync method.

Cevap

Assign the Key Vault Crypto User role to the user-assigned managed identity for the contoso-vault scope, and in the C# application code, instantiate a CryptographyClient using the key URI and call its DecryptAsync method.
To decrypt data using a Key Vault key under the Azure RBAC model, you must assign a role that grants the data plane permission for cryptographic decryption (such as Key Vault Crypto User) to the identity used by the application (the user-assigned managed identity). In the Azure SDK for .NET, cryptographic operations must be executed using the CryptographyClient class rather than the KeyClient class, which is only used for management tasks.

Adım Adım Çözüm

1
Assign the built-in Azure RBAC role for key cryptography.
The user-assigned managed identity is granted the Key Vault Crypto User role at the Key Vault scope.
This built-in role provides the minimum required data plane permissions (Microsoft.KeyVault/vaults/keys/decrypt/action) needed to decrypt data using keys in Azure Key Vault when Azure RBAC is used.
2
Implement the C# code using the correct client class in the Azure SDK for .NET.
The code uses CryptographyClient from the Azure.Security.KeyVault.Keys.Cryptography namespace to decrypt the cipher text.
In the modern Azure.Security.KeyVault SDK, KeyClient manages key lifecycles, whereas CryptographyClient is required to perform data plane cryptographic operations such as encrypting, decrypting, and wrapping.

Anahtar Kavram

Azure Key Vault key cryptography operations and RBAC role assignment using the Azure SDK for .NET.
Bu soruyu puanla

Konular

Azure Key Vault Secret, Key, and Certificate Management

Bu konudan daha fazla soru