Correct Answer: Enable a system-assigned managed identity on the App Service and grant it Key Vault Secrets User role
System-assigned managed identities are the recommended credential-free approach. Azure automatically creates and manages the identity's lifecycle. You grant the identity the 'Key V...
Correct Answer
Enable a system-assigned managed identity on the App Service and grant it Key Vault Secrets User role
Why This Answer Is Correct
System-assigned managed identities are the recommended credential-free approach. Azure automatically creates and manages the identity's lifecycle. You grant the identity the 'Key Vault Secrets User' role (or appropriate Key Vault access policy), and the App Service authenticates to Key Vault using the identity token — no secrets, certificates, or credentials needed in the application.
This question evaluates your knowledge of Azure Key Vault — a core concept tested in Microsoft Certified: Azure Security Engineer Associate (AZ-500). Understanding Azure Key Vault is essential for designing scalable, secure, and cost-effective cloud architectures. Mastery of this topic will help you answer scenario-based questions confidently on exam day.
Company policy requires that all database encryption keys be managed centrally and rotated annually. You need a secure, durable service to store and manage these cryptographic keys. Which service should you use?
A solutions architect needs to store application connection strings and API keys securely. Which service should they use?
What is the difference between a 'Secret' and a 'Key' in Azure Key Vault?
An administrator wants to manage access to a Key Vault using Azure RBAC (Role-Based Access Control) instead of legacy Access Policies. Is this possible?
What is the 'Soft Delete' feature in Azure Key Vault for?