Azure Key Vault

Practice questions

1. Question 1Q-5AB1F2

   An ASP.NET Core application runs in Azure App Service and must read a database password from Azure Key Vault without storing credentials in configuration or source code. Which implementation is most appropriate?

   1. A.Enable a system-assigned managed identity for the App Service, grant it the Key Vault Secrets User role, and use DefaultAzureCredential with SecretClient.
   2. B.Store the Key Vault access key in appsettings.json and use it to authenticate with SecretClient.
   3. C.Use the App Service deployment password as the Azure Key Vault credential.
   4. D.Make the Key Vault publicly writable and retrieve the secret anonymously.
   See the answer and solution
2. Question 2Q-E9725F

   An application stores a database connection string in an Azure Key Vault secret named DbConnection. The operations team rotates the value by setting a new version of the same secret name. The application must begin using the new value without being redeployed. Which approach should the developer use?

   1. A.Call GetSecretAsync("DbConnection") without specifying a version, and refresh the cached value according to the application's rotation strategy.
   2. B.Use the original secret version ID permanently so that the application has a stable value.
   3. C.Delete the secret before every read so that Key Vault creates the newest version automatically.
   4. D.Read the secret only through an Azure Storage access key because Key Vault versions cannot be accessed by applications.
   See the answer and solution
3. Question 3Q-67025D

   A company requires that deleted secrets in a production Key Vault remain recoverable for 90 days and cannot be permanently purged early, even by an administrator. Which configuration best satisfies this requirement?

   1. A.Enable soft delete with a 90-day retention period and enable purge protection on the Key Vault.
   2. B.Disable soft delete and grant all administrators the Key Vault Administrator role.
   3. C.Enable diagnostic logging only; logs automatically restore deleted secrets.
   4. D.Create a new secret version every 90 days and disable deletion permissions.
   See the answer and solution
4. Question 4Q-669D60

   An Azure App Service uses a system-assigned managed identity to read secret values from an Azure Key Vault. The identity must not create, update, or delete secrets. Which Azure RBAC role should be assigned at the Key Vault scope?

   1. A.Reader
   2. B.Key Vault Secrets User
   3. C.Key Vault Secrets Officer
   4. D.Contributor
   See the answer and solution
5. Question 5Q-FA30B2

   A .NET application must digitally sign data with an RSA key stored in Azure Key Vault. The private key must remain non-exportable and must never be downloaded by the application. Which approach should the application use?

   1. A.Use SecretClient to retrieve the private key as a string and sign the data locally.
   2. B.Use CertificateClient to download the certificate and private key, then sign locally.
   3. C.Use KeyClient to obtain the key identifier, create a CryptographyClient, and call SignDataAsync with the appropriate RSA signature algorithm.
   4. D.Store the key in Azure Storage and use BlobClient to perform the signing operation.
   See the answer and solution