Connection from applications in Azure - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is the purpose of a connection string in Azure applications?

A connection string is a simple text that tells an application how to connect to a cloud service, like a database or storage. It includes information like the service address, credentials, and other settings.

beginner

How does Azure App Service securely store connection strings?

Azure App Service stores connection strings in its configuration settings, which are encrypted at rest and not visible in the application code. This keeps sensitive information safe and easy to update without changing the app.

intermediate

What is Managed Identity in Azure and how does it help application connections?

Managed Identity is like a special ID for your app that Azure creates and manages. It lets your app connect to other Azure services securely without needing to store passwords or keys.

beginner

Why should applications avoid hardcoding connection details?

Hardcoding connection details makes apps less secure and harder to update. If credentials change, you must change the code and redeploy. Using configuration or managed identities is safer and easier.

intermediate

What role does Azure Key Vault play in application connections?

Azure Key Vault securely stores secrets like passwords and keys. Applications can retrieve these secrets at runtime, keeping sensitive data out of code and configuration files.

What is the best way to manage database credentials for an Azure web app?

A Store them in Azure App Service configuration settings

B Hardcode them in the application code

C Send them in plain text over the network

D Write them on a paper and keep it near the server

Storing credentials in Azure App Service configuration settings keeps them secure and separate from code.

What does Managed Identity allow an Azure application to do?

A Automatically scale the app

B Connect to Azure services without storing credentials

C Run without internet connection

D Encrypt all data in the database

Managed Identity lets apps authenticate to Azure services securely without credentials in code.

Which Azure service is best for securely storing secrets like passwords?

A Azure Blob Storage

B Azure Functions

C Azure Key Vault

D Azure DevOps

Azure Key Vault is designed to securely store and manage secrets.

Why is hardcoding connection strings in application code discouraged?

A It is required by Azure

B It improves application speed

C It reduces the app size

D It makes updating credentials difficult and less secure

Hardcoding credentials risks security and complicates updates.

Where can you configure connection strings for an Azure App Service?

A In the App Service's Configuration blade in Azure Portal

B Inside the app's source code only

C In the Azure Monitor logs

D In the Azure DevOps pipeline

Azure Portal's Configuration blade allows secure management of connection strings.

Explain how an Azure application can securely connect to a database without storing passwords in code.

Think about Azure features that keep credentials safe and separate from code.

Describe the risks of hardcoding connection strings in applications and how Azure helps avoid them.

Consider what happens if credentials change or get stolen.

Practice

1. What is the main purpose of a connection string when an application connects to an Azure service?

easy

A. It stores the application's source code.

B. It provides the necessary information to authenticate and access the service.

C. It defines the user interface of the application.

D. It manages the billing details for the Azure subscription.

Solution

1. Step 1: Understand connection string role

   A connection string contains credentials and endpoint details needed to connect securely to an Azure service.

2. Step 2: Eliminate unrelated options

   Options about source code, UI, or billing are unrelated to connection strings.

3. Final Answer:

   It provides the necessary information to authenticate and access the service. -> Option B

4. Quick Check:

   Connection string = authentication info [OK]

Hint: Connection strings hold access info, not code or UI [OK]

Common Mistakes:

• Confusing connection strings with application code
• Thinking connection strings manage billing
• Assuming connection strings define UI

2. Which of the following is the correct format for an Azure Storage Account connection string?

easy

A. AccountName=youraccount;Password=yourpassword;Region=us-east

B. https://youraccount.blob.core.windows.net/yourcontainer

C. DefaultEndpointsProtocol=https;AccountName=youraccount;AccountKey=yourkey;EndpointSuffix=core.windows.net

D. Server=yourserver;Database=yourdb;User Id=youruser;Password=yourpassword;

Solution

1. Step 1: Identify Azure Storage connection string format

   Azure Storage connection strings include protocol, account name, account key, and endpoint suffix as in DefaultEndpointsProtocol=https;AccountName=youraccount;AccountKey=yourkey;EndpointSuffix=core.windows.net.

2. Step 2: Compare other options

   https://youraccount.blob.core.windows.net/yourcontainer is a URL, not a connection string. AccountName=youraccount;Password=yourpassword;Region=us-east uses wrong keys and lacks protocol. Server=yourserver;Database=yourdb;User Id=youruser;Password=yourpassword; is a SQL Server connection string format.

3. Final Answer:

   DefaultEndpointsProtocol=https;AccountName=youraccount;AccountKey=yourkey;EndpointSuffix=core.windows.net -> Option C

4. Quick Check:

   Storage connection string = protocol + account info [OK]

Hint: Look for protocol, account name, and key in connection string [OK]

Common Mistakes:

• Confusing URLs with connection strings
• Using SQL connection string format for Azure Storage
• Missing protocol or key in connection string

3. Given this Python code snippet connecting to Azure Blob Storage, what will be the output if the connection string is invalid?

from azure.storage.blob import BlobServiceClient
try:
    conn_str = "InvalidConnectionString"
    blob_service_client = BlobServiceClient.from_connection_string(conn_str)
    print("Connection successful")
except Exception as e:
    print(f"Connection failed: {e}")

medium

A. Connection failed: Invalid connection string format

B. Connection successful

C. SyntaxError

D. No output

Solution

1. Step 1: Analyze code behavior on invalid connection string

   The BlobServiceClient.from_connection_string method raises an exception if the string is invalid.

2. Step 2: Check exception handling output

   The except block catches the exception and prints "Connection failed:" with the error message.

3. Final Answer:

   Connection failed: Invalid connection string format -> Option A

4. Quick Check:

   Invalid string triggers exception message [OK]

Hint: Invalid connection strings cause exceptions caught and printed [OK]

Common Mistakes:

• Assuming connection always succeeds
• Expecting syntax errors instead of runtime exceptions
• Ignoring exception handling output

4. You wrote this code to connect to Azure Key Vault but get an authentication error:

from azure.identity import DefaultAzureCredential
from azure.keyvault.secrets import SecretClient

credential = DefaultAzureCredential()
client = SecretClient(vault_url="https://myvault.vault.azure.net/", credential=credential)
secret = client.get_secret("MySecret")
print(secret.value)

What is the most likely cause of the error?

medium

A. The SecretClient class is deprecated and cannot be used.

B. The vault URL is incorrect and missing the .com suffix.

C. The secret name "MySecret" is invalid because it contains uppercase letters.

D. The application lacks proper Azure AD permissions or managed identity is not enabled.

Solution

1. Step 1: Understand authentication with DefaultAzureCredential

   This credential requires the app to have Azure AD permissions or a managed identity enabled to access Key Vault.

2. Step 2: Evaluate other options

   The vault URL format is correct without .com. SecretClient is current and uppercase secret names are allowed.

3. Final Answer:

   The application lacks proper Azure AD permissions or managed identity is not enabled. -> Option D

4. Quick Check:

   Authentication error = missing permissions or identity [OK]

Hint: Check Azure AD permissions and managed identity setup first [OK]

Common Mistakes:

• Assuming URL must end with .com
• Thinking SecretClient is deprecated
• Believing secret names cannot have uppercase letters

5. You want your Azure web app to securely connect to Azure SQL Database without storing credentials in code. Which approach is best practice?

hard

A. Use Managed Identity for the web app and configure Azure SQL to allow Azure AD authentication.

B. Store the SQL username and password in the web app's environment variables.

C. Embed the SQL connection string with username and password directly in the application code.

D. Use a public IP whitelist to restrict SQL access and use SQL authentication.

Solution

1. Step 1: Identify secure connection methods without hardcoding credentials

   Managed Identity allows the app to authenticate to Azure SQL using Azure AD without secrets in code.

2. Step 2: Compare other options for security risks

   Storing credentials in environment variables or code risks exposure. IP whitelisting alone does not remove credential storage.

3. Final Answer:

   Use Managed Identity for the web app and configure Azure SQL to allow Azure AD authentication. -> Option A

4. Quick Check:

   Managed Identity + Azure AD = secure no-secret connection [OK]

Hint: Managed Identity avoids storing secrets in code [OK]

Common Mistakes:

• Hardcoding credentials in code
• Relying only on IP whitelisting
• Storing secrets in environment variables without encryption