AI-102 Question 78
Single answerYou are tasked with securing the storage account keys for an Azure-based solution. The solution requires that the application accesses the storage account without embedding the keys in the application code. How can you achieve this using Azure Key Vault?
- A
Store the storage account keys in Azure Key Vault and grant the application access to the Key Vault using a managed identity.
- B
Embed the storage account keys in the application code and use Azure Application Insights to monitor access.
- C
Store the storage account keys in a local configuration file and encrypt the file.
- D
Use Azure Key Vault to regenerate the storage account keys automatically every 24 hours.
Show answer and explanation
Correct answer: A
Explanation
Azure Key Vault is designed to securely store and manage sensitive information such as storage account keys. By storing the keys in Azure Key Vault and granting the application access using a managed identity, you avoid embedding keys in the code and ensure secure access. This approach aligns with Azure security best practices.
- A. Correct.
This is the correct approach. Storing the storage account keys in Azure Key Vault and granting application access through a managed identity ensures secure access without embedding sensitive data in the application code.
- B. Incorrect.
Embedding keys in the application code is not a secure practice and does not align with best practices for managing sensitive information.
- C. Incorrect.
Storing keys in a local configuration file, even if encrypted, poses a security risk and does not utilize Azure Key Vault for centralized and secure key management.
- D. Incorrect.
Azure Key Vault does not automatically regenerate storage account keys. Regeneration of keys is a manual or scripted process that can be triggered, but it is not automatic every 24 hours.