Implement Secure Azure Solutions AI-200 Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A company's web app needs to retrieve a database connection string from Azure Key Vault at startup. The app runs in an Azure App Service with a system-assigned managed identity. The development team wants to minimize code changes and avoid storing the secret in application settings. What should the developer do?

   • AStore the connection string in a plain text file in the App Service wwwroot folder and read it at startup.
   • BUse the Key Vault secret client library with DefaultAzureCredential to fetch the secret at runtime.
   • CAdd the connection string to the App Service application settings and reference it with the @Microsoft.KeyVault() syntax.
   • DUse the Azure CLI to download the secret to a local file during deployment and read it from the file system.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A company wants to ensure that only specific applications can access certain secrets in Key Vault. They have two applications: App1 and App2. App1 should only access SecretA, and App2 should only access SecretB. What is the most granular way to achieve this?

   • AStore all secrets in a single Key Vault and rely on the application code to only read the secret it needs.
   • BCreate separate Key Vaults for each application and store only the relevant secrets in each.
   • CUse Azure RBAC to grant each application Contributor access to the Key Vault.
   • DUse Key Vault access policies to grant each application's managed identity Get permission on only the specific secret.
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   A company has a requirement to rotate a database password stored in Azure Key Vault. The password is used by a web application that reads it at startup and caches it. The security team wants to ensure that the rotation does not cause application downtime. The application team is willing to make code changes. What is the best approach?

   • AStore the database password in App Configuration and use its refresh mechanism.
   • BUpdate the Key Vault secret and restart the application immediately.
   • CImplement a rotation function that updates the database password and Key Vault secret, and modify the application to reload the secret from Key Vault periodically.
   • DUse a Key Vault secret expiration date to trigger automatic rotation.
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   Which of the following items can be stored in Azure Key Vault?

   • ADatabase connection strings
   • BApplication performance counters
   • CVirtual machine images
   • DAzure resource tags
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   What is the purpose of the 'label' in an Azure App Configuration key-value pair?

   • ATo encrypt the value at rest
   • BTo specify the data type of the value
   • CTo provide a human-readable description of the setting
   • DTo differentiate between values for different environments or versions
   Reveal Solution Discussion Select an answer first