AI-102 Question 80
Single answerYou are developing an Azure-based application that requires access to a storage account. To enhance security, you want to ensure that the storage account access keys are protected and securely managed. Which approach should you take to securely access the keys?
- A
Store the storage account keys in Azure Key Vault and use Azure Managed Identities to access them.
- B
Embed the storage account keys directly in the application’s configuration file.
- C
Store the storage account keys in a secure on-premises database and retrieve them when needed.
- D
Use Azure Active Directory (Azure AD) authentication to directly access the storage account without requiring keys.
Show answer and explanation
Correct answer: A
Explanation
The best approach to protect and manage sensitive secrets like storage account keys is to use Azure Key Vault. Key Vault provides a secure repository for managing secrets, and Azure Managed Identities enable secure, credentials-free access to Key Vault from Azure resources. This approach eliminates the need to embed secrets in code or rely on less secure alternatives.
- A. Correct.
Correct. Storing the keys in Azure Key Vault ensures secure storage and management of secrets. Using Azure Managed Identities allows the application to securely access Key Vault without requiring explicit credentials.
- B. Incorrect.
Incorrect. Embedding keys in configuration files is insecure and exposes sensitive data to potential breaches.
- C. Incorrect.
Incorrect. While storing keys in an on-premises database can provide some protection, it lacks the integrated security benefits and advanced management features provided by Azure Key Vault.
- D. Incorrect.
Incorrect. Azure AD authentication can be used to access the storage account directly without keys, but this does not align with the requirement to manage and protect access keys specifically.