Task 3.3: Implement security for application platform services

• ADisable local accounts; the issued admin kubeconfigs stop working immediately

  Incorrect

  Certificates already issued stay valid until the cluster certificates are rotated.

• BDisable local accounts, then rotate the cluster certificates

  Correct

  Rotation revokes certificates that users with local accounts might still hold.

• CRemove the contractors from the cluster's Kubernetes RBAC bindings

  Incorrect

  Admin credentials bypass Entra-based role bindings.

• DEnable Azure RBAC for Kubernetes authorization

  Incorrect

  Azure RBAC governs Entra identities, not the local admin backdoor.

Local accounts are enabled by default and, even with Microsoft Entra integration, --admin credentials are a non-auditable backdoor. Use disable-local-accounts to turn them off; on an existing cluster where users might have authenticated with local accounts, also rotate the cluster certificates to revoke certificates they might hold. Members of the Entra admin group keep access with their Entra credentials.

• ADisable the registry admin user

  Incorrect

  The admin user is a separate credential; this doesn't change which Entra tokens are accepted.

• BAssign each engineer AcrPush instead of a broader role

  Incorrect

  Roles decide what an identity may do, not which token scope the registry accepts.

• CEnable anonymous pull to reduce the need for tokens

  Incorrect

  Anonymous pull opens the registry further.

• DDisable the azureADAuthenticationAsArmPolicy

  Correct

  The registry then accepts only ACR-scoped Entra authentication.

The azureADAuthenticationAsArmPolicy property controls which Microsoft Entra scopes a registry accepts during az acr login. Disabled (recommended) means the registry accepts only ACR-scoped tokens and rejects ARM-scoped ones; users then request an ACR-scoped token by signing in with --scope https://containerregistry.azure.net/.default.

• ASCM Basic Auth Publishing Credentials

  Correct

  Web Deploy, local Git and similar methods use SCM basic authentication, controlled separately from FTP.

• BFTP Basic Auth Publishing Credentials again, because it didn't take effect

  Incorrect

  FTP is already blocked; the remaining path is SCM.

• CThe app's system-assigned managed identity

  Incorrect

  The pipeline's managed identity is what should deploy; the app's identity is unrelated.

• DHTTPS Only on the app

  Incorrect

  HTTPS Only enforces transport security, not deployment authentication.

App Service supports basic authentication for FTP and for other deployment methods such as Web Deploy, Visual Studio, local Git and GitHub. FTP is controlled by basicPublishingCredentialsPolicies/ftp and the others by basicPublishingCredentialsPolicies/scm. Disabling both leaves Microsoft Entra-based deployment, for example with managed identities.

• ARedeploy the function app from a new package

  Incorrect

  Redeployment doesn't change stored keys.

• BChange the function's authLevel to function

  Incorrect

  The function already needs a key; the stored key is the problem.

• CRegenerate the function's key in the secret store

  Correct

  Deleting a function doesn't delete or rotate keys, and a recreated function with the same name reuses them.

• DMove key storage to Key Vault, which invalidates existing keys

  Incorrect

  Changing the storage location isn't the documented way to rotate a leaked key.

Function keys live in the app's secret store with their own lifecycle, independent of the functions they protect. Deleting a function doesn't delete or rotate its keys, and because the storage location is derived from names, recreating a function with the same name reuses the stored keys. Generate a new value for the key after a leak.

• A@Microsoft.KeyVault(SecretUri=https://<vault>.vault.azure.net/secrets/<name>/)

  Correct

  This reference syntax resolves the secret at runtime through the app's identity.

• Bkeyvault://<vault>/<name>

  Incorrect

  That isn't the documented syntax.

• C$(KeyVault.<vault>.<name>)

  Incorrect

  That isn't the documented syntax.

• D${{ secrets.<name> }}

  Incorrect

  That's pipeline syntax, not an App Service reference.

A Key Vault reference in an app setting uses the form @Microsoft.KeyVault(SecretUri=...) or @Microsoft.KeyVault(VaultName=...;SecretName=...). The app resolves it with its managed identity, which needs read access to the secret.

• AThe registry admin user

  Incorrect

  The admin user has full access to every repository.

• BAn Entra service principal with AcrPush on that repository

  Incorrect

  The partner can't use Microsoft Entra ID.

• CA token with a scope map limited to that repository

  Correct

  Non-Entra tokens with scope maps grant repository-scoped permissions.

• DAnonymous pull

  Incorrect

  Anonymous access allows pulls only, by anyone.

Azure Container Registry supports non-Microsoft Entra tokens with scope maps that grant specific permissions, such as push, on specific repositories. They suit clients that can't use Entra ID, while the admin user grants full access to the whole registry.

• ABlocks the request and returns 403

  Incorrect

  That's Prevention mode.

• BRedirects it to a custom page

  Incorrect

  Redirects are a custom rule action, not Detection mode.

• CDrops the connection silently

  Incorrect

  Detection mode doesn't interfere with requests.

• DLogs the match without blocking the request

  Correct

  Detection mode monitors and logs; Prevention mode blocks.

In Detection mode, the WAF monitors and logs requests that match rules but doesn't block them, which helps tuning. In Prevention mode, it blocks matching requests.

• Aanonymous

  Incorrect

  Anonymous requires no access key.

• Badmin

  Correct

  The admin level requires the master key.

• Cfunction

  Incorrect

  Function level requires a function-specific key.

• Dsystem

  Incorrect

  System isn't an authorization level; system keys belong to extensions.

The HTTP trigger's authorization level decides which key a request needs: anonymous needs none, function needs a function-specific key, and admin needs the master key. When no level is set, it defaults to function.