Correct Answer: Enable System-Assigned Managed Identity on the App Service and grant it 'Key Vault Secrets User' role
Managed Identity eliminates credential management entirely. Enabling System-Assigned Managed Identity on the App Service creates an Azure AD identity for the app. Granting it the '...
Correct Answer
Enable System-Assigned Managed Identity on the App Service and grant it 'Key Vault Secrets User' role
Why This Answer Is Correct
Managed Identity eliminates credential management entirely. Enabling System-Assigned Managed Identity on the App Service creates an Azure AD identity for the app. Granting it the 'Key Vault Secrets User' role allows the app to retrieve secrets using DefaultAzureCredential — no passwords or keys stored anywhere.
This question evaluates your knowledge of Azure Key Vault — a core concept tested in Microsoft Certified: Azure Developer Associate (AZ-204). Understanding Azure Key Vault is essential for designing scalable, secure, and cost-effective cloud architectures. Mastery of this topic will help you answer scenario-based questions confidently on exam day.
Company policy requires that all database encryption keys be managed centrally and rotated annually. You need a secure, durable service to store and manage these cryptographic keys. Which service should you use?
A solutions architect needs to store application connection strings and API keys securely. Which service should they use?
What is the difference between a 'Secret' and a 'Key' in Azure Key Vault?
An administrator wants to manage access to a Key Vault using Azure RBAC (Role-Based Access Control) instead of legacy Access Policies. Is this possible?
What is the 'Soft Delete' feature in Azure Key Vault for?