AZ-204 Certification Practice Question #150

Question

You develop and deploy an Azure App Service web app named App1. You create a new Azure Key Vault named Vault1. You import several API keys, passwords, certificates, and cryptographic keys into Vault1.

You need to grant App1 access to Vault1 and automatically rotate credentials. Credentials must not be stored in code.

What should you do?

Accepted Answer

The two requirements — grant access to Key Vault without storing credentials in code, and automatically rotate credentials — are precisely the value proposition of managed identities. With a managed identity assigned to App1, Azure handles the credential lifecycle automatically. You then grant that identity access to Vault1 via access policy or RBAC, and Key Vault's built-in key rotation policies handle rotation. No connection string, certificate, or password needs to appear in the application code. All community votes (20 total) back option D, and there is no meaningful dissent.

More AZ-204 practice questions