Examkin

Soru

Zorluk: OrtaSystem-Assigned and User-Assigned Managed Identities

You are designing a deployment architecture for a set of five independent Azure App Service web apps. Each web app must access a shared Azure Key Vault to retrieve common application settings. Each web app is managed and scaled independently, and some may be deleted or recreated during routine updates. You need to configure a managed identity solution that minimizes administrative overhead for granting Key Vault permissions and ensures that the identity credentials persist even if individual web apps are deleted.

Which managed identity configuration should you implement to meet these requirements?

  1. A single user-assigned managed identity assigned to all five App Services, with that identity granted the necessary access permissions on the Key Vault.Cevap
  2. B
    A system-assigned managed identity enabled on each App Service, with each individual identity granted the necessary access permissions on the Key Vault.
  3. C
    A single system-assigned managed identity configured at the App Service Plan level, allowing all App Services within the plan to inherit the identity.
  4. D
    A single user-assigned managed identity assigned to all five App Services, relying on default Key Vault settings that automatically authorize any identity created in the same Microsoft Entra tenant.

Cevap

A single user-assigned managed identity assigned to all five App Services, with that identity granted the necessary access permissions on the Key Vault.
Using a single user-assigned managed identity is the optimal choice because it exists as a standalone Azure resource. It can be shared across multiple Azure App Services, allowing you to configure a single access control rule (RBAC role or Key Vault access policy) on the Key Vault. Additionally, its lifecycle is independent of the App Services; deleting or recreating the web apps does not delete the user-assigned identity, avoiding the need to reconfigure Key Vault permissions.

Adım Adım Çözüm

1
Analyze resource sharing and lifecycle requirements.
The identity must support sharing across five App Services to minimize administrative overhead and survive the deletion and recreation of the individual App Service instances.
Identifying these parameters determines whether a system-assigned or user-assigned identity is appropriate.
2
Compare managed identity lifecycles and sharing features.
User-assigned managed identities are standalone resources that can be shared, while system-assigned identities are tied 1-to-1 to a single resource instance's lifecycle.
Selecting a user-assigned managed identity satisfies the independent lifecycle and cross-resource sharing requirements.
3
Determine the required access policy configuration.
Grant Key Vault access explicitly to the selected user-assigned managed identity.
Security credentials provided by managed identities do not have access by default, and access must be explicitly granted on the target resource.

Anahtar Kavram

Architectural and lifecycle differences between system-assigned and user-assigned managed identities.
Tahmini Süre:1m 30s
Bu soruyu puanla

Konular

System-Assigned and User-Assigned Managed Identities

Bu konudan daha fazla soru