AI-200 practice: Secure secrets by using Azure Key Vault, including rotation and retrieval

Question 1

You are provisioning several Container Apps that all need identical Key Vault access permissions. You want to grant the Key Vault role assignment once, before any of the Container Apps exist, and then attach the same identity to each Container App as it's created, without repeating the role assignment for every app.

Which identity type should you use?

Accepted Answer

A user-assigned managed identity created independently, granted the Key Vault role once, then attached to each Container App as it is provisioned

Answer

A system-assigned managed identity on each Container App, created with the resource and granted Key Vault access separately for every newly provisioned app

Answer

A shared Microsoft Entra application whose client secret is stored in each Container App environment variable for Key Vault access

Answer

No managed identity; instead a Key Vault access policy that allows anonymous get operations from the Container Apps subnet ranges

Question 2

You want a secret in Key Vault to rotate automatically on a schedule before it expires, and you want an Event Grid-based notification sent to a Function so the team can proactively handle downstream systems that cache the secret — rather than discovering the rotation only after something breaks.

What should you configure?

Accepted Answer

A Key Vault rotation policy for schedule and expiry, plus an Event Grid subscription on near-expiry or secret-update events that invokes a Function

Answer

A shared calendar reminder for operators to rotate the secret manually, because Key Vault has no native rotation policy or Event Grid hooks

Answer

A Logic App that polls each secret value daily, compares it to a cached copy in storage, and alerts only after detecting that a rotation has already occurred

Answer

Move the secret into App Configuration feature flags, because only App Configuration emits native rotation notifications that Functions can subscribe to

Question 3

You retrieve a secret from Key Vault using DefaultAzureCredential in code that must work identically both locally (developer signed in via Azure CLI) and in production (running in a Container App with a user-assigned managed identity), without any code branching:
```python
from azure.identity import DefaultAzureCredential
from azure.keyvault.secrets import SecretClient

credential = DefaultAzureCredential()
client = SecretClient(vault_url="https://myvault.vault.azure.net/", credential=credential)
secret = client.get_secret("db-password")
```
In production, this throws a credential authentication failure, while locally (via az login) it works fine. The Container App has a user-assigned managed identity configured. What's missing?

Accepted Answer

DefaultAzureCredential must be explicitly told which managed identity to use via managed_identity_client_id (or AZURE_CLIENT_ID environment variable), because when multiple identity sources could apply (and specifically with user-assigned managed identities) DefaultAzureCredential's ManagedIdentityCredential step needs the specific client ID to select the correct identity.

Answer

DefaultAzureCredential only works in local development; production code must always use ManagedIdentityCredential explicitly.

Answer

The Container App's managed identity must be system-assigned; user-assigned identities are not supported by DefaultAzureCredential.

Answer

SecretClient requires an explicit api_version parameter when used with managed identity credentials.

Question 4

You implement secret rotation awareness so your application always uses the latest version of a Key Vault secret without redeploying, and without a long-lived cache serving a stale/revoked version indefinitely:
```python
from azure.keyvault.secrets import SecretClient
from azure.identity import DefaultAzureCredential
import time

client = SecretClient(vault_url=vault_url, credential=DefaultAzureCredential())
_cache = {}

def get_db_password():
    if "db-password" not in _cache:
        secret = client.get_secret("db-password") # version-less request
        _cache["db-password"] = {"value": secret.value, "cachedAt": time.time()}
    return _cache["db-password"]["value"]
```
This caches the secret indefinitely after first retrieval, meaning a rotated secret is never picked up until the process restarts. What is the best fix that balances reducing Key Vault call volume with staying reasonably current after rotation?

Accepted Answer

Add a TTL check (e.g., re-fetch if time.time() - cachedAt > 3600) so the cached value is refreshed periodically (e.g., hourly) rather than only once at startup — balancing reduced Key Vault call volume against staying reasonably current within the TTL window after a rotation event.

Answer

Remove caching entirely and call get_secret("db-password") on every single use of the password, regardless of call frequency.

Answer

Request a specific pinned secret version (e.g., client.get_secret("db-password", version="abc123")) so the cache is always guaranteed correct.

Answer

Rely on Key Vault's server-side push notifications to automatically update the local _cache dictionary in real time; no TTL logic is needed.

Question 5

Which command creates an Azure Key Vault?

Accepted Answer

az keyvault create --name myVault --resource-group myRG --location eastus

Answer

az keyvault secret set --vault-name myVault --name mySecret --value secret

Answer

az keyvault key create --vault-name myVault --name myKey --protection software

Answer

az keyvault certificate create --vault-name myVault --name myCert --policy @p.json

Question 6

Which Python SDK class retrieves secrets from Azure Key Vault?

Accepted Answer

SecretClient from azure-keyvault-secrets for get_secret/set_secret

Answer

KeyClient from azure-keyvault-keys for create_key and get_key ops

Answer

CertificateClient from azure-keyvault-certificates for cert lifecycle

Answer

BlobServiceClient from azure-storage-blob for blob upload/download

Question 7

Which Azure CLI command grants a managed identity the 'Key Vault Secrets User' role on a specific Key Vault, scoped only to that vault?

Accepted Answer

az role assignment create --assignee --role "Key Vault Secrets User" --scope

Answer

az keyvault set-policy --name myVault --object-id <principalId> --secret-permissions get list

Answer

az role assignment create --assignee --role Owner --scope /subscriptions/

Answer

az keyvault update --name myVault --resource-group myRG --enable-rbac-authorization true

Question 8

Which Azure CLI command creates a new secret inside an existing Key Vault?

Accepted Answer

az keyvault secret set --vault-name myVault --name mySecret --value "mySecretValue"

Answer

az keyvault key create --vault-name myVault --name myKey --protection software

Answer

az keyvault certificate create --vault-name myVault --name myCert --policy @p.json

Answer

az keyvault secret backup --vault-name myVault --name mySecret --file secret.bak

Question 9

Which Azure CLI command lists all secrets that currently exist, including their versions, within a Key Vault (troubleshooting a missing-secret issue)?

Accepted Answer

az keyvault secret list --vault-name myVault --query "[].{name:name,enabled:attributes.enabled}"

Answer

az keyvault secret show --vault-name myVault --name mySecret --version "" --query attributes

Answer

az keyvault secret restore --vault-name myVault --file secret.bak --encoding base64

Answer

az keyvault secret list-deleted --vault-name myVault --query "[].{name:name,deletionDate:deletedDate}"

Question 10

Which Azure service should be used to securely store and manage API keys, connection strings, and certificates used by an AI application?

Accepted Answer

Azure Key Vault secrets

Answer

Azure App Configuration

Answer

Azure Blob Storage acct

Answer

Azure Monitor Logs hub

21 questions