Design and Implement a Strategy for Managing Sensitive Information in Automation AZ-400 Practice Questions (Page 5)

Questions 21–25

1. 21expert · medium

   Your Azure Pipeline needs to retrieve a secret from Key Vault, but the secret is updated frequently. You want to ensure that the pipeline always uses the latest version of the secret. What should you do?

   • ASpecify a specific version of the secret in the task.
   • BUse the Key Vault REST API to fetch the secret and specify the version.
   • CUse the AzureKeyVault task without specifying a version, so it retrieves the latest version.
   • DStore the secret in a variable group and update it manually.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   Your application needs to read a database password from Azure Key Vault at runtime. You want to minimize the risk of the password being exposed in application logs. Which approach should you use?

   • AEmbed the password in the application configuration file.
   • BStore the password in an environment variable and read it in the application.
   • CUse a connection string that includes the password and store it in the application code.
   • DUse a managed identity for the application to access Key Vault and retrieve the secret in code.
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   What is the primary benefit of storing a database connection string in Azure Key Vault instead of in an application configuration file?

   • AIt enables centralized management, access control, and auditing of the secret.
   • BIt encrypts the connection string at rest and in transit automatically.
   • CIt allows the connection string to be shared publicly with other applications.
   • DIt eliminates the need for any authentication when accessing the secret.
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   What is the purpose of Azure Pipelines Secure Files?

   • ATo store secrets like passwords and API keys.
   • BTo provide a backup service for pipeline artifacts.
   • CTo store sensitive files that can be downloaded and used during pipeline runs.
   • DTo store large binary files that are not sensitive.
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   Which Azure CLI command is used to create a new RSA key in an existing key vault?

   • Aaz keyvault key import --vault-name MyVault --name MyKey --type RSA
   • Baz keyvault key create --vault-name MyVault --name MyKey --type RSA
   • Caz keyvault key new --vault-name MyVault --name MyKey --kty RSA
   • Daz keyvault key generate --vault-name MyVault --name MyKey --algorithm RSA
   Reveal Solution Discussion Select an answer first