Microsoft Certified: Azure AI Engineer AssociatePlan and manage an Azure AI solutionHard
A public safety agency is developing an Azure AI solution to analyze emergency call transcripts for critical event detection. The solution uses Azure Cognitive Services for speech-to-text and custom NLP models deployed on Azure Machine Learning. Access to the AI services must be restricted to specific Azure resources (e.g., Azure Functions, Azure Logic Apps) without exposing them to the public internet. Which security mechanism should be used to provide secure, identity-based access for these Azure resources to the AI services?
- AAPI Keys
- BShared Access Signatures (SAS)
- CManaged Identities for Azure Resources
- DService Principals
Show answer & explanationAnswer & explanation
Correct answer: C. Managed Identities for Azure Resources
Managed Identities for Azure Resources provide an automatically managed identity for Azure services in Azure Active Directory, allowing them to authenticate to other services (like Cognitive Services) without needing to store credentials in code or configuration, enhancing security and simplifying access management.
Why the other options are wrong
- A. API Keys are static credentials and are less secure as they need to be managed, rotated, and stored securely, posing a risk if compromised.
- B. SAS tokens grant limited, time-bound access to specific resources, but managing them for multiple services can be complex and less secure than Managed Identities.
- D. Service Principals are used for applications, hosted services, and automated tools to access Azure resources, but Managed Identities are simpler and more secure for Azure-hosted services.
Managed Identities for Azure Resources
A feature of Azure Active Directory that provides Azure services with an automatically managed identity, enabling them to authenticate to other services that support Azure AD authentication without needing to store credentials.
- Eliminates the need for developers to manage credentials.
- Enhances security by using Azure AD for authentication.
- Supports both system-assigned and user-assigned identities.
Memory trick: Managed Identities are like 'auto-issued employee badges' for Azure services.