Hotspot Question You have an Azure subscription that contains the resources shown in the following table. You plan to use an Azure key vault to provide a secret to app1. What should you create for app

Question

Exhibits

Answer Area

• What should you create for app1 to access the key vault?Managed Identity (System-assigned)
  Managed Identity (System-assigned)Managed Identity (User-assigned)Service PrincipalKey vault access policy
• From which key vault can the secret be used?Vault1
  Vault1Vault2Vault3

Explanation

A Container App should use a Managed Identity to securely access an Azure Key Vault, and access can be granted to any Key Vault regardless of its region or resource group location.

Approach. For the first part of the question, 'What should you create for app1 to access the key vault?', the correct selection is 'Managed identity'. Azure Managed Identities provide an automatically managed identity for Azure services to authenticate to other Azure services that support Azure AD authentication, eliminating the need for developers to manage credentials. This is the most secure and recommended way for an Azure Container app like 'app1' to access an Azure Key Vault.

For the second part, 'From which key vault can the secret be used?', the correct selection is 'Vault1, Vault2, or Vault3'. Azure Key Vault access is controlled by an access policy or Azure Role-Based Access Control (RBAC) assigned to an identity. The geographical region (East US vs. West US) or resource group (RG1 vs. RG2) of the Key Vault does not inherently restrict which Azure resources can access it. As long as 'app1' (using its Managed Identity) is granted the appropriate permissions (e.g., 'Get' secret) on any of the Key Vaults ('Vault1', 'Vault2', or 'Vault3'), it can retrieve secrets from them. The question is about the potential vaults from which a secret can be used, given appropriate permissions.

Common mistakes.

• common_mistake. Selecting 'Service principal' for the first part is a common mistake; while a service principal can be used, a Managed Identity is a more specific and preferred solution for Azure services as Azure automatically manages its lifecycle. 'Private endpoint' is incorrect as it provides network connectivity, not an identity for authentication. 'User account' is for human users, not applications. For the second part, any choice that restricts access based on region or resource group (e.g., 'Vault1 only', 'Vault1 and Vault2 only', 'Vault1 and Vault3 only') is incorrect. This demonstrates a misunderstanding that Key Vault access is tied to the physical location or organizational grouping of resources. In reality, access is governed by identity-based authorization, allowing a resource to access any Key Vault it has permissions to, regardless of its location.

Concept tested. Azure Managed Identities for secure service-to-service authentication without credential management, and Azure Key Vault access control mechanisms (Access Policies/Azure RBAC) and the regional independence of Key Vault access.

No community discussion yet for this question.