AI-200 · Domain 4: Secure, monitor, troubleshoot Azure solutions · 23% of the exam
Task 4.1: Implement secure Azure solutions
Storing, retrieving and rotating secrets in Azure Key Vault with managed identities, and storing configuration and feature flags in Azure App Configuration.
Study it
Azure Key Vault secrets: access with managed identities, retrieval and rotation
Try each one before opening the answer. Every option is explained, with the Microsoft documentation page that proves it.
Question 1 · choose 1
An App Service app reads a database password through the app setting @Microsoft.KeyVault(SecretUri=https://kv-prod.vault.azure.net/secrets/db-pass), with no version in the URI. After you rotate the secret in Key Vault, the app keeps using the old password for hours. You need the new version picked up now, without editing app settings. What do you do?
APOST to the app's config/configreferences/appsettings/refresh endpoint
BAdd the new secret's version identifier to the end of the SecretUri in the reference
CGrant the app's identity the Key Vault Secrets Officer role
DTurn on purge protection for the vault
Show the answer and why
APOST to the app's config/configreferences/appsettings/refresh endpoint
Correct
App Service caches Key Vault reference values and refetches them every 24 hours; this API forces the references to resolve again.
BAdd the new secret's version identifier to the end of the SecretUri in the reference
Incorrect
That pins the setting to one version and edits the app settings, which the requirement rules out.
CGrant the app's identity the Key Vault Secrets Officer role
Incorrect
The app can already read the secret; permissions don't affect the 24-hour cache.
DTurn on purge protection for the vault
Incorrect
Purge protection controls permanent deletion; it has no effect on how references are refreshed.
Without a version, a Key Vault reference uses the latest secret version, but App Service caches the value and refetches it every 24 hours. Any configuration change restarts the app and refetches immediately, and the refresh endpoint does the same without a change.
A Container Apps app reads three secrets from a key vault that uses the Azure RBAC permission model. Following least privilege, which role do you assign to the app's managed identity, scoped to the vault?
Secrets Officer can create, update and delete secrets, which is more than the app needs.
DKey Vault Contributor
Incorrect
Key Vault Contributor manages vaults on the control plane and grants no access to secrets.
With the RBAC model, data plane access comes from roles such as Key Vault Secrets User (read secret contents), Key Vault Secrets Officer (manage secrets) and Key Vault Administrator. Key Vault Reader and Key Vault Contributor don't expose secret values.
A developer deleted the key vault kv-rag-dev yesterday. It had soft delete and purge protection, with the default 90-day retention. The deployment pipeline now fails to create a vault with that name, and the team needs the name working today with its secrets. What do you do?
APurge the deleted vault with the Key Vault Purge Operator role, then create it again
BLower the vault's retention period to 7 days and wait a week
CTurn off soft delete on the subscription, then create the vault again
DRecover the soft-deleted vault
Show the answer and why
APurge the deleted vault with the Key Vault Purge Operator role, then create it again
Incorrect
With purge protection on, a deleted vault can't be purged until its retention period ends.
BLower the vault's retention period to 7 days and wait a week
Incorrect
The retention interval is set at creation and can't be changed afterwards.
CTurn off soft delete on the subscription, then create the vault again
Incorrect
Once soft delete is enabled on a vault it can't be disabled, and the deleted name stays reserved.
DRecover the soft-deleted vault
Correct
A soft-deleted vault can be recovered during the retention period, which brings back the vault and its objects under the same name.
Deleted vaults stay recoverable for 7 to 90 days (90 by default), and their names can't be reused until then. Purge protection blocks purging during that period, so recovery is the way back. Role assignments and Event Grid subscriptions must be recreated after recovery.
You deploy the Event Grid–triggered rotation function from Microsoft's tutorial for a SQL password stored in Key Vault. The event subscription filters on Microsoft.KeyVault.SecretNearExpiry and the function has access to the vault, but months later it has never run. What's the most likely cause?
AThe secret has no expiration date, so no near-expiry event is ever published
BEvent Grid stopped retrying after two hours
CThe function needs the Key Vault Administrator role to receive events
DSecretNearExpiry is published only for certificates
Show the answer and why
AThe secret has no expiration date, so no near-expiry event is ever published
Correct
Key Vault publishes SecretNearExpiry 30 days before the current version's expiration date; without a date there's nothing to warn about.
BEvent Grid stopped retrying after two hours
Incorrect
Retries apply to events that were published but failed; here no event was published.
CThe function needs the Key Vault Administrator role to receive events
Incorrect
Events reach the function through the Event Grid subscription; vault roles only govern what the function can do in the vault.
DSecretNearExpiry is published only for certificates
Incorrect
There are separate near-expiry events for secrets, keys and certificates.
The single-credential rotation pattern relies on the SecretNearExpiry event, raised 30 days before the expiration date of the current secret version. Set an expiration date on every version the function creates, or the next rotation never starts.
An App Configuration store holds shared settings with no label and production overrides for some of the same keys under the label prod. A Python service uses the azure-appconfiguration-provider package and must load the shared values with the prod values taking precedence. Which selects argument does load() need?
This loads only keys with the prod label and drops the shared values.
DNo selects argument; the provider merges every label automatically
Incorrect
By default the provider loads only key-values with no label.
Each key-value is identified by its key and label, and \0 stands for no label. The provider loads selectors in the listed order; when two selectors return the same key, the last one wins.
A Python app loads settings from App Configuration with DefaultAzureCredential. One key is a Key Vault reference to an API key. Loading fails when the provider reaches that key. Which two changes are needed? (Choose TWO.)
AGive the App Configuration store a managed identity with access to the vault
BPass a credential to load() with the keyvault_credential argument
CGrant the app's identity a role on the vault that can read secret values
DGrant the app's identity App Configuration Data Owner on the store
ECopy the secret value into the App Configuration key
Show the answer and why
AGive the App Configuration store a managed identity with access to the vault
Incorrect
App Configuration doesn't access the key vault; the client reads the secret.
BPass a credential to load() with the keyvault_credential argument
Correct
The provider uses this credential to resolve Key Vault references itself.
CGrant the app's identity a role on the vault that can read secret values
Correct
The app, not App Configuration, reads the secret, so its own identity needs data plane read access to secret contents in the vault.
DGrant the app's identity App Configuration Data Owner on the store
Incorrect
App Configuration Data Reader is enough to read key-values, including references.
ECopy the secret value into the App Configuration key
Incorrect
That stores the secret outside Key Vault, which the reference exists to avoid.
A Key Vault reference stores only the secret's URI. The configuration provider recognizes it and calls Key Vault with the credential you supply, so the app's identity needs App Configuration Data Reader on the store and a Key Vault role that reads secret values on the vault.
A Python worker loads App Configuration with refresh_on set to [WatchKey("sentinel")]. Operators change several keys at once and want the worker to pick up all of them together, at most a minute later. What must the operators and the code do?
AOperators update the sentinel key first, and the provider pushes the changes to the worker
BThe worker adds a WatchKey for every key it reads
CUpdate the sentinel last, and have the worker call config.refresh() periodically
DThe worker sets refresh_interval to 3600 seconds
Show the answer and why
AOperators update the sentinel key first, and the provider pushes the changes to the worker
Incorrect
Updating the sentinel first can reload a half-changed set, and the provider doesn't push; the app must call refresh().
BThe worker adds a WatchKey for every key it reads
Incorrect
Watching every key works against the purpose of the sentinel and adds requests to the store.
CUpdate the sentinel last, and have the worker call config.refresh() periodically
Correct
The provider refreshes everything when the watched sentinel changes, and refresh() checks for that change once the interval has passed.
DThe worker sets refresh_interval to 3600 seconds
Incorrect
An hour-long interval misses the one-minute requirement; the default is 30 seconds.
A sentinel key is updated after all other changes. The app watches only that key, and when a refresh call finds it changed, the provider reloads all configuration, keeping related values consistent and reducing requests.
A Python service running with a managed identity must read the secret openai-key from https://kv-app.vault.azure.net. Which code returns the secret's value?
This lists secret properties without their values.
The azure-keyvault-secrets library authenticates with an azure-identity credential such as DefaultAzureCredential, which uses the managed identity in Azure and developer credentials locally.
Applications read secrets from a key vault through access policies. You plan to switch the vault to the Azure RBAC permission model during a maintenance window. What must happen before the switch to avoid an outage?
ANothing; access policies keep working alongside RBAC after the switch
BGive every application identity the Key Vault Contributor role
CEnable purge protection on the vault
DAssign equivalent Key Vault roles to every identity first
Show the answer and why
ANothing; access policies keep working alongside RBAC after the switch
Incorrect
The RBAC model replaces access policies; they stop granting access.
BGive every application identity the Key Vault Contributor role
Incorrect
Key Vault Contributor is a control plane role that doesn't grant access to secrets.
CEnable purge protection on the vault
Incorrect
Purge protection guards against permanent deletion; it has no role in authorization.
DAssign equivalent Key Vault roles to every identity first
Correct
Switching to RBAC invalidates all access policy permissions, so missing role assignments cause outages.
Key Vault authorizes data plane operations through either access policies (legacy) or Azure RBAC. Changing the permission model to RBAC invalidates every access policy, so assign the equivalent data plane roles beforehand.
A Python app loads configuration with azure-appconfiguration-provider and must check a feature flag named Beta, picking up changes when it refreshes. Which two steps are needed? (Choose TWO.)
ACall load() with feature_flag_enabled=True and feature_flag_refresh_enabled=True
BRead config[".appconfig.featureflag/Beta"] as a Boolean
CAdd a WatchKey for every feature flag
DCreate FeatureManager(config) from the featuremanagement package and call is_enabled("Beta")
EGrant the identity App Configuration Data Owner so it can read flags
Show the answer and why
ACall load() with feature_flag_enabled=True and feature_flag_refresh_enabled=True
Correct
The provider loads feature flags, and refreshes them, only when these options are set.
BRead config[".appconfig.featureflag/Beta"] as a Boolean
Incorrect
Feature flags are evaluated through the feature manager, which also applies filters.
CAdd a WatchKey for every feature flag
Incorrect
WatchKey sentinels serve key-value refresh; feature flags refresh with feature_flag_refresh_enabled.
DCreate FeatureManager(config) from the featuremanagement package and call is_enabled("Beta")
Correct
The feature management library evaluates flags from the loaded configuration.
EGrant the identity App Configuration Data Owner so it can read flags
Incorrect
App Configuration Data Reader is enough to read key-values and feature flags.
Feature management in Python combines the configuration provider, which loads flags from the store, with the featuremanagement library, which evaluates them. The library itself doesn't depend on Azure libraries.
Before each release, the team freezes the configuration a service will use so it can't change during the rollout and can be rolled back later. The Python service should load exactly that set. What do you use?
AA Key-composition snapshot, loaded with SettingSelector(snapshot_name=...)
BCreate a snapshot, then edit it in place whenever a value must change mid-rollout
CUse a label per release and give the snapshot_name selector a label_filter as well
DRely on point-in-time key-values and load the store as of the release time
Show the answer and why
AA Key-composition snapshot, loaded with SettingSelector(snapshot_name=...)
Correct
Snapshots are immutable sets of key-values, and the provider loads Key-composition snapshots by name.
BCreate a snapshot, then edit it in place whenever a value must change mid-rollout
Incorrect
Snapshots can't be edited, deleted or purged; they can only be created and archived.
CUse a label per release and give the snapshot_name selector a label_filter as well
Incorrect
snapshot_name can't be combined with key, label or tag filters.
DRely on point-in-time key-values and load the store as of the release time
Incorrect
Point-in-time history keeps past values for a limited period; a snapshot is the named, immutable set made for releases.
A snapshot captures key-values chosen by key and label filters at creation and guarantees they don't change. Applications switch versions by changing the snapshot name, which also gives a last known good configuration for rollback.