AZ-500 Question 42
Single answerYou have deployed a Windows Server virtual machine (VM) in Azure and enabled a system-assigned managed identity for the VM. You plan to store sensitive application settings in an Azure Key Vault. In order for applications running on this VM to securely retrieve secrets from the Key Vault without hardcoding credentials, which action must you perform next?
- A
Add the system-assigned managed identity to the Key Vault access policy or assign a relevant Key Vault role in Azure RBAC.
- B
Store a username and password in the VM’s environment variables for the VM to authenticate to the Key Vault.
- C
Enable Managed Service Identity (MSI) extension from the Azure Portal’s Identity blade after assigning a user-managed identity.
- D
Generate and install a self-signed certificate on the VM to authenticate against the Azure Key Vault.
Show answer and explanation
Correct answer: A
Explanation
When using a system-assigned managed identity, Azure takes care of identity management, allowing the VM to securely access Azure Key Vault. However, you must explicitly grant that identity the permissions to read secrets. This can be done via a Key Vault access policy for the VM’s identity (GET and LIST permissions for secrets) or through role-based access control (RBAC) by assigning the Key Vault Secrets User role at the appropriate scope. Refer to Microsoft Docs for detailed steps on configuring Key Vault access policies or Key Vault RBAC roles.
- A. Correct.
Correct. After enabling a system-assigned managed identity, you must grant the identity permission to read secrets from Azure Key Vault, either by adding the identity to the Key Vault’s access policy (if using the Vault access policy permission model) or assigning a built-in Key Vault role (e.g., Key Vault Secrets User) at the vault scope in Azure RBAC. This ensures the VM can programmatically retrieve secrets without storing credentials.
- B. Incorrect.
Incorrect. Storing credentials in environment variables defeats the purpose of managed identities, which allow secure access to resources without manually handling credentials. This approach also exposes secrets and is not recommended.
- C. Incorrect.
Incorrect. With a system-assigned managed identity already enabled, you do not need to enable an additional user-managed identity. User-managed identities are separate identities that you can create and manage independently, but that is not necessary in this scenario.
- D. Incorrect.
Incorrect. Installing a self-signed certificate on the VM is unrelated to using a managed identity for authentication. Managed identities eliminate the need for certificates or other secrets in application code.