AZ-305 Question 191
Single answerYou are designing a new configuration management solution for a multi-instance .NET Core web application running in Azure App Service across development, staging, and production environments. The application requires centralized storage for both non-sensitive configuration (such as feature flags) and sensitive settings (such as connection strings). The solution must allow versioning of configuration changes and easy integration with the application’s CI/CD pipelines. Which approach should you recommend?
- A
Use only Azure Key Vault to store all configuration data, including secrets and non-sensitive settings.
- B
Use Azure App Configuration for non-sensitive data and feature flags, referencing secrets stored in Azure Key Vault where needed.
- C
Store all configuration values directly in the Azure App Service application settings per environment.
- D
Host a custom configuration service on a dedicated VM that encrypts and stores all settings locally.
Show answer and explanation
Correct answer: B
Explanation
Azure App Configuration is the recommended service for managing application settings and feature flags, as it supports version tracking, labels for environments, and straightforward integration with CI/CD pipelines. When used in combination with Azure Key Vault references for secrets, this pattern follows Microsoft best practices for secure and centralized application configuration management. Refer to the Microsoft documentation for Azure App Configuration (https://learn.microsoft.com/azure/azure-app-configuration/overview) and Azure Key Vault (https://learn.microsoft.com/azure/key-vault/general/basic-concepts) for additional guidance.
- A. Incorrect.
Option 1 is incorrect. While Azure Key Vault is an excellent tool for securing secrets such as passwords and connection strings, it is not optimized for managing and versioning all non-sensitive configurations, such as feature flags or reference data. Key Vault alone does not provide the same capabilities for feature management or easy version control of non-sensitive settings.
- B. Correct.
Option 2 is correct. Azure App Configuration is specifically designed for storing and managing non-sensitive settings and feature flags, providing built-in versioning and integration with CI/CD pipelines. Combined with Key Vault references for sensitive information, this offers a comprehensive approach to managing all application settings in a secure and centralized manner.
- C. Incorrect.
Option 3 is incorrect. Storing all settings in Azure App Service application settings can work but quickly becomes cumbersome for complex, multi-environment scenarios. It also lacks robust versioning, feature flag management, and the ease of rolling back changes compared to Azure App Configuration.
- D. Incorrect.
Option 4 is incorrect. Implementing a custom configuration service on a dedicated VM requires significant overhead in terms of development, maintenance, and security. It lacks the built-in, managed features offered by Azure App Configuration and Key Vault, making it less efficient and more error-prone.