AZ-305 Question 18
Select 2You are designing an enterprise solution that uses Azure App Service to host a front-end web application for your corporate employees. The solution also includes an Azure Functions app that retrieves secrets from Azure Key Vault. You need to ensure that employees are authenticated when accessing the web application, and you want to minimize overhead for managing and rotating credentials in your environment. Which two approaches should you recommend to meet these requirements?
- A
Enable Azure AD-based authentication on the App Service to require corporate employee sign-in.
- B
Generate a client secret for the Azure Functions app’s service principal and store it directly in application code for retrieving Key Vault secrets.
- C
Assign a system-assigned managed identity to the Azure Functions app and grant the identity permissions to read Key Vault secrets.
- D
Store employee usernames and passwords in Azure Key Vault for the web application and rotate them manually every 90 days.
Show answer and explanation
Correct answers: A, C
Explanation
By enabling Azure AD authentication on the web application (Option 1) and configuring a system-assigned managed identity for the Azure Functions app (Option 3), you offload identity and credential management to Azure AD and eliminate the need to store secrets in code. This approach follows Microsoft’s recommended best practices for secure authentication (see Microsoft Docs: 'Manage identities in Azure' and 'Use managed identities for Azure resources'). It also helps maintain compliance and simplifies rotating credentials, as Azure AD manages user accounts and managed identities automatically.
- A. Correct.
Option 1 is correct. Enabling Azure AD authentication on the App Service requires employees to sign in with their corporate Azure AD credentials. This offloads identity management to Azure AD and reduces overhead of manual credential maintenance.
- B. Incorrect.
Option 2 is incorrect. While generating a client secret and using a service principal is valid, storing that secret directly in code is insecure and leads to increased management overhead (e.g., rotation and secure storage). This does not meet the goal of minimizing credential management complexity.
- C. Correct.
Option 3 is correct. Using a system-assigned managed identity for the Azure Functions app allows you to avoid storing secrets altogether. You can grant the managed identity necessary permissions (e.g., Key Vault Secrets User or Key Vault Secrets Officer role) to securely access Key Vault.
- D. Incorrect.
Option 4 is incorrect. Storing user credentials in Key Vault and manually rotating them every 90 days is cumbersome, prone to errors, and inefficient for corporate employees. Azure AD is a more appropriate identity provider that handles credential management centrally.