AZ-305 Question 188
Single answerYou are designing an Azure-based distributed e-commerce platform composed of multiple microservices. Each service needs to consume shared configuration settings (e.g., feature flags, endpoint URLs) and environment-specific secrets (e.g., connection strings). The configuration must be centrally managed, allow version control so you can roll back changes if needed, and be easily integrated into the microservices at runtime. Which solution should you recommend?
- A
Store all configuration in Git as environment-based JSON files and reference them at build time in your CI/CD pipeline.
- B
Embed the configuration values as environment variables in each microservice's container image and track changes via the container registry.
- C
Use Azure App Configuration for shared settings and Azure Key Vault for secrets, injecting the values into microservices at runtime.
- D
Maintain a private SQL database to store configuration values and retrieve them via direct database queries from each microservice.
Show answer and explanation
Correct answer: C
Explanation
Azure App Configuration is designed to manage and dynamically update application settings at runtime without requiring redeployment. It also integrates natively with Azure Key Vault for secure storage of secrets. Together, they provide versioning, rollback, feature flags, and centralized administration capabilities. For more details, refer to official Azure documentation on Azure App Configuration (https://learn.microsoft.com/azure/azure-app-configuration/) and Azure Key Vault (https://learn.microsoft.com/azure/key-vault/).
- A. Incorrect.
Option 1: Storing configuration in Git-based JSON files can work for static or build-time configuration. However, it doesn't natively offer real-time updates or built-in versioned rollback for runtime settings. Managing secrets in plain JSON files can also create security risks, even if encrypted in Git.
- B. Incorrect.
Option 2: Embedding configuration values as environment variables in the container image limits flexibility and real-time updates because changes would require rebuilding or redeploying the container. Version control of environment variables also becomes cumbersome.
- C. Correct.
Option 3: Using Azure App Configuration for non-secret settings (e.g., feature flags, environment-specific configurations) and Azure Key Vault for secrets allows centralized management, real-time updates, and versioning with rollback capabilities. It is designed for microservice architectures that need to consume both dynamic configuration and secrets in a secure manner.
- D. Incorrect.
Option 4: While you can store configuration in a SQL database, it lacks out-of-the-box features for versioning or feature flags, and would require custom code for secure secret management. Managing secrets directly in a SQL database typically requires additional safeguards and overhead compared to Azure Key Vault.