Microsoft Certified: Azure Developer Associate (AZ-204)Develop Azure compute solutionsHard
A development team is building a new application that uses Azure Functions. They need to ensure that the secrets (e.g., API keys, database connection strings) required by the functions are stored securely and are only accessible by authorized functions. The solution must also allow for easy rotation of these secrets without requiring code changes or redeployments. Which Azure service should be used to manage these secrets?
- AAzure Key Vault
- BEnvironment Variables
- CAzure App Configuration
- DAzure Storage Account
Show answer & explanationAnswer & explanation
Correct answer: A. Azure Key Vault
Azure Key Vault is a service for securely storing and accessing secrets, keys, and certificates. It provides a centralized, highly secure solution for managing application secrets, with features like access policies, auditing, and secret rotation without requiring application redeployment, making it the ideal choice for Azure Functions.
Why the other options are wrong
- B. Environment Variables can store secrets, but they lack centralized management, granular access control, auditing, and secure rotation mechanisms, making them unsuitable for sensitive production secrets.
- C. Azure App Configuration is primarily for managing application settings and feature flags, not for highly sensitive secrets that require the robust security and rotation features of Key Vault.
- D. Azure Storage Account is for storing data (blobs, queues, tables, files), not designed for secure secret management with rotation capabilities and granular access control for applications.
Azure Key Vault
A cloud service for securely storing and accessing secrets, cryptographic keys, and SSL/TLS certificates.
- Centralized secret management
- Hardware Security Module (HSM) protected keys
- Access policies for granular control
- Auditing and monitoring, secret rotation
Memory trick: Key Vault is the Key to Secure Secrets and Certificates.