Exam AZ-204 topic 1 question 2 discussion

Key Vault + Access Policy. Using Key Vault we create a secret containing our Password: https://docs.microsoft.com/en-us/azure/key-vault/secrets/quick-create-portal . Using an Access Policy we allow access to the previously created secret. Documentation Guide: https://docs.microsoft.com/en-us/azure/azure-resource-manager/templates/key-vault-parameter?tabs=azure-cli

Is it me, or is the question misleading since it says "option" - singuar?

Key Vault + Access Policy Azure Key Vault is the primary service for securely storing and managing sensitive information like passwords, keys, and secrets. However, simply storing the password in Key Vault isn't sufficient—permissions also need to be configured so that only authorized resources or users can access the secret. This is where the access policy comes into play. Azure Key Vault is the primary service for securely storing and managing sensitive information like passwords, keys, and secrets. However, simply storing the password in Key Vault isn't sufficient—permissions also need to be configured so that only authorized resources or users can access the secret. This is where the access policy comes into play.

Test comment

To ensure that the password is not stored in plain text in an Azure Resource Manager template, you should utilize an Azure Key Vault. Azure Key Vault provides a secure way to store and manage sensitive information such as passwords, cryptographic keys, and certificates. By storing the password in Azure Key Vault, it remains encrypted and can be securely accessed by authorized services or applications.

The user just needs to reference the administrative password, right? Am I understanding this correctly? "The access policies aren't needed if the user is deploying a template that retrieves a secret. Add a user to the access policies only if the user needs to work directly with the secrets. The deployment permissions are defined in the next section." https://learn.microsoft.com/en-us/azure/azure-resource-manager/templates/key-vault-parameter?tabs=azure-cli#:~:text=The%20access%20policies%20aren%27t%20needed%20if%20the%20user%20is%20deploying%20a%20template%20that%20retrieves%20a%20secret.%20Add%20a%20user%20to%20the%20access%20policies%20only%20if%20the%20user%20needs%20to%20work%20directly%20with%20the%20secrets.%20The%20deployment%20permissions%20are%20defined%20in%20the%20next%20section.

Using an Access Policy we allow access to the previously created secret. Documentation Guide: https://sites.google.com/view/learnmicrosoftcomenustrainingm/home

They might update it to Key Vault + RBAC, because access policy is deprecated now

Key Vault + Access Policy, Is the correct but the Access Policy option is legacy now, and most likely will be replaced with the option of Azure role-based access control instead of Access Policy

Key Vault and Access Policy both

https://learn.microsoft.com/en-us/azure/key-vault/general/assign-access-policy

Azure Key Vault is the recommended approach for securely storing and managing secrets such as the administrative password used in an Azure Resource Manager template. However, an access policy can also be used to control access to a secret stored in a different Azure resource, such as an Azure Storage account.

Key Vault & Access Policy

Key Vault + Access Policy.

https://www.examtopics.com/exams/microsoft/az-104/view/2/ Answer is correct, see question in AZ104 #20