Implement Secure Azure Solutions AI-200 Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Which Azure service is used to control which users or applications can perform operations on secrets in a Key Vault?

   • AAzure Policy
   • BAzure Advisor
   • CAzure Role-Based Access Control (RBAC)
   • DAzure Monitor
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A company is migrating to Azure and needs to store secrets for a legacy application that runs on an on-premises server. The application cannot be modified to use managed identity. The security team requires that the secrets be stored in Azure Key Vault and that access be restricted to the on-premises application only. What should they implement?

   • AStore the secrets in a local file and sync them to Key Vault periodically.
   • BUse Azure AD Application Proxy to expose Key Vault to the on-premises application.
   • CUse a managed identity for the on-premises server.
   • DCreate a service principal, store its credentials in Key Vault, and use those credentials in the on-premises application to authenticate to Key Vault.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A company runs a microservices application on Azure Kubernetes Service (AKS). Each service reads its own configuration from Azure App Configuration and secrets from Azure Key Vault. The security team requires that secrets never appear in application logs or configuration files. The development team wants to minimize code changes and centralize access control. What should you implement?

   • AStore secrets as plain values in Azure App Configuration and use Key Vault only for TLS certificates.
   • BExport Key Vault secrets to environment variables in the AKS deployment YAML files.
   • CUse the Azure Key Vault Provider for Secrets Store CSI Driver on AKS to mount secrets as volumes, and reference Key Vault URIs in App Configuration.
   • DUse Azure Key Vault SDK in each microservice to fetch secrets at startup and cache them in memory.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A developer is writing a Python application that runs on an Azure VM. The application needs to retrieve a secret from Key Vault. The VM has a system-assigned managed identity enabled. Which code snippet correctly retrieves the secret using the managed identity?

   • AUse the AzureCliCredential class to authenticate using the Azure CLI's logged-in user.
   • BUse the ClientSecretCredential class with a client ID and client secret hardcoded in the code.
   • CUse the DefaultAzureCredential class from the azure-identity library and pass it to the SecretClient.
   • DUse the EnvironmentCredential class and set environment variables for the service principal.
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   What is the recommended way for an application to access a secret stored in Azure Key Vault?

   • AInclude the secret value directly in the application's source code
   • BEmbed the secret in an environment variable on the application server
   • CStore the secret in a plain text file in the application's deployment package
   • DUse a managed identity to authenticate to Key Vault and retrieve the secret at runtime
   Reveal Solution Discussion Select an answer first