AI-102 Question 79
Single answerYou are developing a secure Azure AI solution where a Cognitive Services resource needs access to a storage account. To enhance security, you decide to protect the storage account keys using Azure Key Vault. What is the correct approach to achieve this?
- A
Store the storage account keys in Azure Key Vault and configure the Cognitive Services resource to retrieve the keys directly from the vault.
- B
Enable Azure Key Vault's network firewall and grant access to the Cognitive Services resource using its public IP address.
- C
Use Azure Key Vault to manage the storage account's keys and configure the Cognitive Services resource to use a managed identity to access the vault.
- D
Directly share the storage account keys with the Cognitive Services resource and regularly rotate them manually.
Show answer and explanation
Correct answer: C
Explanation
The best approach to securely protect and manage storage account keys is to use Azure Key Vault for centralized management and configure the Cognitive Services resource to use a managed identity for accessing the vault. This eliminates the need to expose or directly share keys while maintaining strong security practices.
- A. Incorrect.
Storing the storage account keys in Azure Key Vault is correct, but Cognitive Services resources should not retrieve keys directly. Instead, managed identities should be used for secure access.
- B. Incorrect.
Enabling Azure Key Vault's network firewall is a good security practice, but granting access using a public IP address is not recommended as it can expose the vault to potential vulnerabilities.
- C. Correct.
Using Azure Key Vault to manage the storage account's keys and leveraging managed identities ensures secure access without exposing keys or requiring manual handling.
- D. Incorrect.
Directly sharing the storage account keys is insecure and manual rotation increases the risk of errors or unintentional exposure of secrets.