Environment variables and configuration in Azure - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ service_behavior

intermediate

How does Azure App Service handle environment variables during deployment?

When you deploy an application to Azure App Service and set environment variables in the Application Settings, what happens to these variables during the app's runtime?

A The environment variables are injected into the app's runtime environment and override any variables set in the app code or container.

B The environment variables are ignored unless explicitly read from a configuration file inside the app.

C The environment variables are encrypted and cannot be accessed by the app.

D The environment variables are only available during build time, not at runtime.

💡 Hint

Think about how Azure App Service manages configuration for running apps.

Azure App Service injects environment variables set in Application Settings into the app's runtime environment. These variables override any default values in the app or container, allowing easy configuration without code changes.

❓ Configuration

intermediate

Which Azure service is best for securely storing environment variables for multiple apps?

You want to store sensitive environment variables like API keys and database passwords securely and share them across multiple Azure applications. Which Azure service should you use?

A Azure Cosmos DB

B Azure Key Vault

C Azure App Service Application Settings

D Azure Blob Storage

💡 Hint

Consider which service is designed for secure secret storage and access control.

Azure Key Vault is designed to securely store secrets like environment variables, keys, and certificates. It allows controlled access and central management for multiple apps.

❓ Architecture

advanced

How to design an Azure Function app to use environment variables securely and update them without redeploying?

You have an Azure Function app that needs to use environment variables for configuration. You want to update these variables securely without redeploying the function app. Which architecture approach achieves this?

A Store environment variables in a local JSON file inside the function app and update the file via FTP.

B Hardcode environment variables in the function app code and redeploy when changes are needed.

C Store secrets in Azure Key Vault and configure the function app to reference them via managed identity and Key Vault references in Application Settings.

D Use Azure Blob Storage to store environment variables and read them at function startup.

💡 Hint

Think about secure secret storage and how Azure Functions can access secrets dynamically.

Using Azure Key Vault with managed identity and Key Vault references in Application Settings allows the function app to securely access secrets. Updates in Key Vault reflect immediately without redeployment.

❓ security

advanced

What is the risk of storing sensitive environment variables directly in Azure App Service Application Settings without encryption?

Consider storing sensitive data like database passwords directly in Azure App Service Application Settings without additional encryption. What is the main security risk?

A The app will fail to start because it cannot read unencrypted environment variables.

B The sensitive data will be hidden from all users except the app itself.

C The environment variables will be automatically encrypted and safe from all access.

D Anyone with access to the Azure portal or deployment pipeline can view the sensitive values in plain text.

💡 Hint

Think about who can access Application Settings in Azure portal.

Application Settings values are visible in plain text to anyone with access to the Azure portal or deployment pipeline, so storing sensitive data there without encryption risks exposure.

✅ Best Practice

expert

What is the recommended method to manage environment variables for a multi-region Azure Kubernetes Service (AKS) deployment?

You have an application deployed on AKS clusters in multiple Azure regions. You want to manage environment variables consistently and securely across all clusters. Which approach is best?

A Use Azure Key Vault with Azure AD Pod Identity to inject secrets as environment variables dynamically in each AKS cluster.

B Manually update environment variables in each cluster's deployment YAML files and redeploy.

C Store environment variables in ConfigMaps without encryption and mount them as environment variables.

D Hardcode environment variables inside container images before deployment.

💡 Hint

Consider secure, centralized secret management integrated with AKS.

Using Azure Key Vault with Azure AD Pod Identity allows AKS pods to securely access secrets dynamically. This approach centralizes secret management and avoids manual updates or insecure storage.

Practice

1. What is the main purpose of using environment variables in Azure web apps?

easy

A. To write application logic inside the environment

B. To separate configuration settings from the application code

C. To store large files for the application

D. To replace the need for a database

Solution

1. Step 1: Understand environment variables role

   Environment variables hold configuration data outside the code, making apps flexible and secure.

2. Step 2: Identify correct purpose in Azure context

   Azure web apps use environment variables to keep settings separate from code, allowing easy updates without code changes.

3. Final Answer:

   To separate configuration settings from the application code -> Option B

4. Quick Check:

   Environment variables separate config from code [OK]

Hint: Think: config outside code for easy updates [OK]

Common Mistakes:

• Confusing environment variables with code logic
• Using environment variables to store large files
• Assuming environment variables replace databases

2. Which Azure CLI command correctly sets an environment variable named API_KEY with value 12345 for a web app called myapp?

easy

A. az webapp config appsettings set --name myapp --resource-group mygroup --settings API_KEY=12345

B. az webapp set env --app myapp --key API_KEY --value 12345

C. az appservice env set --app myapp --name API_KEY --value 12345

D. az webapp config set --app myapp --env API_KEY=12345

Solution

1. Step 1: Recall Azure CLI syntax for setting app settings

   The correct command uses az webapp config appsettings set with --name, --resource-group, and --settings.

2. Step 2: Match command to given options

   az webapp config appsettings set --name myapp --resource-group mygroup --settings API_KEY=12345 matches the correct syntax exactly; others use incorrect commands or flags.

3. Final Answer:

   az webapp config appsettings set --name myapp --resource-group mygroup --settings API_KEY=12345 -> Option A

4. Quick Check:

   Use az webapp config appsettings set with correct flags [OK]

Hint: Remember: 'az webapp config appsettings set' sets env vars [OK]

Common Mistakes:

• Using wrong Azure CLI commands or flags
• Omitting resource group parameter
• Confusing appsettings with environment commands

3. Given this Azure web app environment variable setup:
API_URL=https://api.example.com
What will the following Python code print?

import os
print(os.getenv('API_URL'))

medium

A. os.getenv('API_URL')

B. API_URL

C. None

D. https://api.example.com

Solution

1. Step 1: Understand os.getenv behavior

   os.getenv('API_URL') fetches the value of environment variable 'API_URL' if set.

2. Step 2: Match environment variable value

   The environment variable 'API_URL' is set to 'https://api.example.com', so the print outputs this string.

3. Final Answer:

   https://api.example.com -> Option D

4. Quick Check:

   os.getenv returns env var value [OK]

Hint: os.getenv returns the variable's value, not the name [OK]

Common Mistakes:

• Expecting the variable name instead of its value
• Assuming None if variable is set
• Confusing function call with string output

4. You tried to update an environment variable in Azure CLI but the app still uses the old value. What is the most likely cause?

medium

A. Azure CLI does not support environment variable updates

B. You used the wrong variable name in the code

C. You forgot to restart the web app after updating the variable

D. Environment variables cannot be updated once set

Solution

1. Step 1: Understand environment variable update behavior

   After updating environment variables, Azure web apps often require a restart to apply changes.

2. Step 2: Identify common mistake

   Not restarting the app causes it to keep using old cached environment values.

3. Final Answer:

   You forgot to restart the web app after updating the variable -> Option C

4. Quick Check:

   Restart app to apply env var changes [OK]

Hint: Restart app after env var changes to apply them [OK]

Common Mistakes:

• Assuming variables update instantly without restart
• Confusing variable name errors with update issues
• Thinking Azure CLI cannot update variables

5. You want to securely store a database password as an environment variable in Azure App Service. Which approach is best practice?

hard

A. Use Azure Key Vault and reference the secret in the app settings

B. Store the password directly in the app settings as plain text

C. Hardcode the password inside your application code

D. Send the password as a query parameter in URLs

Solution

1. Step 1: Identify secure storage options

   Azure Key Vault is designed to securely store secrets like passwords and keys.

2. Step 2: Understand integration with app settings

   You can reference Key Vault secrets in Azure App Service app settings, avoiding plain text storage.

3. Step 3: Evaluate other options

   Storing passwords in plain text, code, or URLs exposes security risks and is not recommended.

4. Final Answer:

   Use Azure Key Vault and reference the secret in the app settings -> Option A

5. Quick Check:

   Use Key Vault for secure secret storage [OK]

Hint: Always use Key Vault for sensitive secrets [OK]

Common Mistakes:

• Storing passwords in plain text app settings
• Hardcoding secrets in code
• Exposing secrets in URLs