AZ-900 Practice Question 90: Key Vault Secrets Storage
Microsoft Azure Fundamentals (AZ-900) · Test 9 · question 10 of 10
A developer's application currently has its database connection string, including the password, written directly into the source code. A security review flags this and asks for it to be stored and retrieved securely instead. Which Azure service is designed for this?
Show answer and explanation
Answer:
Azure Key Vault exists to centralize application secrets and control their distribution, and Microsoft's own example is this precise scenario: instead of storing a database connection string in an app's code, you store it securely in Key Vault and let the application retrieve it at runtime through a URI. Key Vault also manages encryption keys and certificates, all encrypted at rest and guarded by authentication and authorization, so the password never has to live in the codebase or a config file again.
Option A, Microsoft Entra ID, is the identity and access management service that authenticates users and applications; it manages who signs in, not where an application's own secrets are stored. Option B, Azure Policy, enforces configuration rules on deployed resources; it could flag a hardcoded secret in some scenarios but has no mechanism for storing or serving one. Option C, Microsoft Defender for Cloud, assesses security posture and can *alert* on exposed secrets, but it is not itself a place to store credentials for an application to retrieve.
Reference: Azure Key Vault Overview