Microsoft Cybersecurity Architect (SC-100)Design security for applications and dataEasy
A financial institution is designing a new customer-facing web application that will handle sensitive personal identifiable information (PII) and financial transaction data. The application will be hosted on Azure App Service. The security architect needs to ensure that all data in transit between the client browser and the application, and between the application and backend services, is encrypted. Additionally, the application must enforce strict access controls based on user roles and ensure that only authenticated users can access their own data. Which Azure service should be primarily used to manage and rotate the digital certificates required for secure communication (TLS/SSL) for the web application?
- AAzure Key Vault
- BAzure Policy
- CAzure Security Center
- DAzure Active Directory
Show answer & explanationAnswer & explanation
Correct answer: A. Azure Key Vault
Azure Key Vault is specifically designed to store and manage cryptographic keys, secrets, and certificates, making it the ideal service for handling TLS/SSL certificates for web applications to ensure secure communication.
Why the other options are wrong
- B. Azure Policy helps enforce organizational standards and assess compliance, it does not manage cryptographic certificates.
- C. Azure Security Center (now Microsoft Defender for Cloud) provides security posture management and threat protection, not certificate management.
- D. Azure Active Directory (now Microsoft Entra ID) manages user identities and access, not digital certificates for application communication.
Azure Key Vault Certificates
Azure Key Vault can securely store and manage X.509 certificates, allowing for automated renewal and deployment, crucial for TLS/SSL.
- Centralized certificate management.
- Automated certificate renewal.
- Integration with Azure services like App Service.
Memory trick: Keys and secrets for secure communication live in the Vault.