MENU
You are developing an Al-powered API that retrieves connection strings and API keys from Azure Key Vault.
You must configure a solution that provides the following security functionality:
* The API must authenticate to Key Vault without storing credentials in any application configuration files
* The identity used by tie API must have only the minimum permissions necessary to lead secrets.
* The configuration must minimize the blast radius if an identity or credent al is compromised.
You need to implement a secure access strategy for the API.
Which two actions should you perform? Each correct answer presents part of the solution. Choose two.
NOTE: Each correct selection is worth one point.
Suggested Answer: A, D
Get Premium AI-200 Questions
as Interactive Web-Based Practice Test or PDF
Real Exam Format
Detailed Explanations
Instant Access
Get Your Practice Test
12 comments · newest first
CH
Charlette
22 days ago
Definitely! And granting the Key Vault Secrets User role is smart for limited access.
GO
Golda
27 days ago
Agreed! It minimizes the risk of exposure.
MA
Margret
1 month ago
I think using a system assigned managed identity is crucial. No credentials stored!
HE
Helga
1 month ago
Wait, can you really avoid storing credentials completely? Sounds risky!
LI
Lili
1 month ago
I thought assigning the Key Vault Administrator role was safer?
SE
Selene
2 months ago
A seems unnecessary, why store secrets in App Configuration?
CA
Catarina
2 months ago
C is a must too, we need to limit permissions.
JE
Jennie
2 months ago
Definitely go with D, using system assigned managed identity is the way to go!
MA
Malika
2 months ago
I think storing a secret value in Azure App Configuration isn't relevant here since we need to access secrets directly from Key Vault. So that option seems wrong to me.
FR
Freida
2 months ago
I practiced a similar question where we had to limit permissions, and I feel like assigning the Key Vault Administrator role at the subscription scope would be too broad.
PO
Portia
2 months ago
I'm not entirely sure, but I think granting the Key Vault Secrets User role at the vault scope could be the right choice too. It seems to align with the principle of least privilege.
LA
Lavina
3 months ago
I remember that using a managed identity is a secure way to authenticate without storing credentials, so I think option D is definitely one of the answers.