Exam AZ-700 topic 4 question 64 discussion

Actual exam question from Microsoft's AZ-700

Question #: 64
Topic #: 4

HOTSPOT -

You have an Azure subscription.

You plan to implement an Azure application gateway named AGW1.

You need to implement an external TLS certificate store for AGW1. The solution must meet the following requirements:

• Keys must be stored by using the highest possible security.
• Administrative effort must be minimized.

Which type of certificate store should you use, and which type of identity should you use to access the store? To answer, select the appropriate options in the answer area

NOTE: Each correct answer is worth one point.

Show Suggested Answer

Suggested Answer:

by manhattan at Jan. 5, 2025, 4:23 p.m.

Comments

Submit Cancel

xRiot007

3 months ago

store: Azure KV (not HSM because that is not supported in this scenario) identity: User MI (System MI would be more secure and with less attack surface, but the application gateway supports only User MI)

upvoted 1 times

...

ITrob523

3 months ago

HSM is not supported for Azure Key Vault. So the answer should be Azure Key Vault and User -assigned managed identity.

upvoted 1 times

...

Sergovladi

5 months, 2 weeks ago

1) Azure Key Vault 2) User-assigned managed identity https://learn.microsoft.com/en-us/azure/application-gateway/key-vault-certs

upvoted 4 times

Sergovladi

5 months, 2 weeks ago

Azure Managed or Dedicated HSM cannot be integrated with AG https://learn.microsoft.com/en-us/azure/security/fundamentals/key-management-choose

upvoted 1 times

...

manhattan

6 months, 1 week ago

Selected Answer: A

it should be good but I'm not 100% sure, any idea? https://learn.microsoft.com/en-us/azure/key-vault/managed-hsm/best-practices#control-access-to-your-managed-hsm

upvoted 1 times

...