AZ-305 Question 38
Select 2You are designing an e-commerce platform that needs to securely store SSL certificates for public-facing endpoints, secrets for third-party payment gateways, and encryption keys for sensitive customer data. The solution must also support regular secret rotation and meet strict compliance requirements, including FIPS 140-2 Level 3 for key management. Which two approaches should you recommend to securely manage these secrets, certificates, and keys?
- A
Deploy an Azure Key Vault to store SSL certificates, secrets, and keys, leveraging its built-in secret rotation policies.
- B
Implement Azure Managed HSM to store cryptographic keys requiring hardware-level protection and FIPS 140-2 Level 3 compliance.
- C
Use local environment variables in each microservice to store and rotate secrets independently.
- D
Store secrets and keys in a self-managed HSM on-premises, integrated via VPN, to ensure encryption key isolation.
- E
Maintain secrets in an Azure Blob Storage container protected with a private endpoint and custom RBAC rules.
Show answer and explanation
Correct answers: A, B
Explanation
Azure Key Vault and Azure Managed HSM together provide a robust, cloud-native solution for securely storing and rotating secrets, certificates, and cryptographic keys. Key Vault offers secret rotation, certificate management, and straightforward integration with Azure services and applications, while Managed HSM provides FIPS 140-2 Level 3 compliance for safeguarding sensitive cryptographic keys. Refer to the Microsoft documentation on Azure Key Vault and Managed HSM for detailed guidance on best practices for secrets and key management.
- A. Correct.
Option 1: Correct. Azure Key Vault is a secure, central repository specifically designed to store secrets, certificates, and encryption keys with built-in capabilities such as secret versioning and rotation. This aligns with best practices for securely managing and automatically rotating sensitive data.
- B. Correct.
Option 2: Correct. Azure Managed HSM meets FIPS 140-2 Level 3 requirements and allows you to store cryptographic keys in a hardware security module. This is particularly important for highly sensitive data where hardware-level protection is required to meet compliance.
- C. Incorrect.
Option 3: Incorrect. Storing secrets in local environment variables poses a greater risk of exposure and does not simplify secret rotation. It also does not meet rigorous compliance requirements for hardware-based encryption key management.
- D. Incorrect.
Option 4: Incorrect. While a self-managed HSM on-premises can provide hardware protection, it complicates integration with cloud services and secret rotation processes. Maintaining on-premises hardware can increase overhead and reduce the centralized control that Azure services can provide.
- E. Incorrect.
Option 5: Incorrect. Although a private endpoint and RBAC help secure an Azure Blob Storage container, it is not purpose-built for secret or key management and does not offer integrated secret rotation or hardware-based key protection.