AI-102 Question 82
Select 2You are developing an application that uses Azure Cognitive Services. The application needs to authenticate with an Azure AI Service resource securely, while minimizing maintenance efforts for credential management. Which authentication methods should you implement?
- A
Use a managed identity assigned to the application
- B
Use an API key stored in application configuration files
- C
Use Azure Active Directory (Azure AD) token-based authentication
- D
Use a hardcoded API key within the application code
- E
Use a connection string stored securely in Azure Key Vault
Show answer and explanation
Correct answers: A, C
Explanation
To securely authenticate with Azure AI Service resources while minimizing credential management overhead, it is recommended to use managed identities or Azure AD token-based authentication. Managed identities allow applications running in the Azure environment to authenticate without handling secrets, while Azure AD provides a secure identity solution for external applications. Avoid insecure practices like hardcoding keys or relying solely on configuration files, and only use Azure Key Vault for secret management if other options are not viable.
- A. Correct.
Using a managed identity assigned to the application is a secure and maintenance-free way to authenticate with Azure resources, eliminating the need to handle secrets or keys manually.
- B. Incorrect.
Storing an API key in configuration files is less secure and adds maintenance overhead as keys may need to be rotated or replaced manually.
- C. Correct.
Azure Active Directory token-based authentication is a robust and secure method to authenticate with Azure resources by leveraging Azure AD's identity management capabilities.
- D. Incorrect.
Hardcoding an API key in the application code is insecure and should be avoided, as it exposes sensitive information and requires code updates for key rotation.
- E. Incorrect.
While storing a connection string securely in Azure Key Vault is better than storing it in plain text, it still requires manual management of secrets and is not as seamless as using managed identities or Azure AD tokens.