SC-100: Microsoft Cybersecurity ArchitectDemo

By Microsoft · Question Mode

QuestionQ286

Design security solutions for applications and data

You have an Azure subscription containing an Azure key vault named Vault1.

You plan to deploy multiple virtual machines to host a custom app named App1. App1 will use secrets stored in Vault1, and the virtual machines will be redeployed regularly according to App1 usage demands.

Recommend a solution that enables App1 to access the secrets in Vault1 while meeting these requirements:

  • Minimize the number of security principals that can access Vault1.
  • Minimize sensitive-data storage on the virtual machines.
  • Minimize administrative effort.

Which endpoint type and identity type should App1 use?

Select
Endpoint type:
Identity type:
Explanation

A user-assigned managed identity can be shared by multiple VMs and has an independent lifecycle, so one identity can be granted Key Vault access even as VMs are redeployed. Managed identities eliminate application-managed credentials. Code on an Azure VM requests the managed-identity token from the local Azure Instance Metadata Service (IMDS) endpoint.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!