Storing secrets in Azure - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

Why use Azure Key Vault for storing secrets?

Which of the following is the main reason to use Azure Key Vault for storing secrets instead of storing them directly in application code?

A It allows anyone in the organization to read secrets without restrictions.

B It automatically writes secrets into application code for faster access.

C It stores secrets in plain text for easy debugging.

D It encrypts secrets and controls access centrally, reducing risk of exposure.

💡 Hint

Think about security and access control for sensitive information.

Azure Key Vault encrypts secrets and provides centralized access control, which helps protect sensitive data better than embedding secrets in code.

❓ Configuration

intermediate

Accessing a secret from Azure Key Vault using Managed Identity

You want an Azure Virtual Machine to access a secret from Azure Key Vault without storing credentials in code. Which configuration allows this?

A Assign a Managed Identity to the VM and grant it 'Get' permission on the Key Vault access policy.

B Store the Key Vault access key in the VM's environment variables.

C Enable public access on the Key Vault so the VM can read secrets anonymously.

D Create a user account and hardcode its password in the VM application.

💡 Hint

Think about how Azure services can authenticate securely without passwords.

Managed Identity lets the VM authenticate to Key Vault securely without credentials, by granting it specific permissions.

❓ Architecture

advanced

Designing secret rotation with Azure Key Vault

You need to design a system where application secrets rotate automatically every 30 days without downtime. Which architecture best supports this?

A Use Azure Key Vault with versioned secrets and configure the application to fetch the latest version at startup and periodically.

B Manually update secrets in the application code every 30 days and redeploy the app.

C Store secrets in a database and update them without notifying the application.

D Disable secret rotation to avoid application failures.

💡 Hint

Consider how to update secrets without stopping the application.

Azure Key Vault supports secret versioning. Applications can retrieve the latest secret version dynamically, enabling smooth rotation.

❓ security

advanced

Preventing unauthorized access to Azure Key Vault secrets

Which of the following configurations best prevents unauthorized users from accessing secrets in Azure Key Vault?

A Disable logging to hide access attempts and avoid alerts.

B Allow all IP addresses to access the Key Vault and assign all users the 'Reader' role.

C Enable firewall rules to restrict network access and use Azure RBAC to assign minimum required permissions.

D Share Key Vault access keys via email to trusted users.

💡 Hint

Think about limiting who and where can access the Key Vault.

Restricting network access and using role-based access control limits exposure and enforces least privilege.

❓ service_behavior

expert

Behavior of Azure Key Vault when a secret is deleted

What happens to a secret in Azure Key Vault immediately after it is deleted, assuming soft-delete is enabled?

A The secret is copied to a backup vault automatically.

B The secret is marked as deleted but remains recoverable for a retention period before permanent removal.

C The secret is archived and accessible only by administrators indefinitely.

D The secret is permanently removed instantly and cannot be recovered.

💡 Hint

Consider Azure Key Vault's soft-delete feature behavior.

With soft-delete enabled, deleted secrets remain recoverable for a configurable retention period before permanent deletion.

Practice

1. What is the main purpose of using Azure Key Vault to store secrets?

easy

A. To keep sensitive information safe and separate from application code

B. To speed up application performance by caching data

C. To store large files like videos and images

D. To create virtual machines automatically

Solution

1. Step 1: Understand what secrets are

   Secrets are sensitive data like passwords or keys that should be protected.

2. Step 2: Identify Azure Key Vault's role

   Azure Key Vault securely stores and manages these secrets separately from code.

3. Final Answer:

   To keep sensitive information safe and separate from application code -> Option A

4. Quick Check:

   Azure Key Vault = Secure secret storage [OK]

Hint: Secrets = sensitive info; Key Vault keeps them safe [OK]

Common Mistakes:

• Thinking Key Vault speeds up app performance
• Confusing secrets with large file storage
• Assuming Key Vault creates virtual machines

2. Which Azure CLI command correctly adds a secret named MySecret with value abc123 to a Key Vault named MyVault?

easy

A. az keyvault secret add --vault MyVault --secret-name MySecret --secret-value abc123

B. az keyvault secret set --vault-name MyVault --name MySecret --value abc123

C. az keyvault secret create --vault-name MyVault --secret MySecret --value abc123

D. az keyvault secret upload --vault MyVault --name MySecret --value abc123

Solution

1. Step 1: Recall the correct Azure CLI command for adding secrets

   The correct command is az keyvault secret set with parameters for vault name, secret name, and value.

2. Step 2: Match parameters with the command

   az keyvault secret set --vault-name MyVault --name MySecret --value abc123 uses the correct command and parameters: --vault-name, --name, and --value.

3. Final Answer:

   az keyvault secret set --vault-name MyVault --name MySecret --value abc123 -> Option B

4. Quick Check:

   Use az keyvault secret set to add secrets [OK]

Hint: Add secrets with 'az keyvault secret set' command [OK]

Common Mistakes:

• Using incorrect command verbs like add or create
• Wrong parameter names like --secret-name instead of --name
• Confusing upload with set command

3. Given this Azure CLI command:

az keyvault secret show --vault-name MyVault --name ApiKey

What will this command do?

medium

A. It retrieves the value of the secret named ApiKey from MyVault

B. It deletes the secret named ApiKey from MyVault

C. It lists all secrets stored in MyVault

D. It creates a new secret named ApiKey in MyVault

Solution

1. Step 1: Understand the command structure

   The command uses az keyvault secret show which is for retrieving a secret's value.

2. Step 2: Identify the parameters

   --vault-name MyVault specifies the vault, and --name ApiKey specifies the secret to retrieve.

3. Final Answer:

   It retrieves the value of the secret named ApiKey from MyVault -> Option A

4. Quick Check:

   secret show = retrieve secret [OK]

Hint: Use 'secret show' to get secret values [OK]

Common Mistakes:

• Confusing show with delete or create commands
• Thinking it lists all secrets
• Mixing up secret names and vault names

4. You run this command:

az keyvault secret set --vault-name MyVault --name Password

But it fails with an error. What is the most likely cause?

medium

A. The secret name Password is invalid

B. The vault name MyVault does not exist

C. You forgot to provide the secret value with --value parameter

D. You need to use 'secret create' instead of 'secret set'

Solution

1. Step 1: Check the command parameters

   The command is missing the --value parameter which is required to specify the secret's value.

2. Step 2: Consider other options

   While vault existence and secret name validity matter, the error is most commonly due to missing the secret value.

3. Final Answer:

   You forgot to provide the secret value with --value parameter -> Option C

4. Quick Check:

   Missing --value causes failure [OK]

Hint: Always include --value when setting a secret [OK]

Common Mistakes:

• Assuming 'secret create' is a valid command
• Ignoring missing required parameters
• Not verifying vault existence first

5. You want to securely store multiple environment variables as secrets in Azure Key Vault and access them in your app without exposing them in code. Which approach is best?

hard

A. Save the variables in a public GitHub repo and use environment variables locally

B. Store all variables in a single secret as a JSON string and parse it in your app

C. Hardcode the variables in your app and encrypt the app binary

D. Store each variable as a separate secret in Key Vault and configure your app to fetch them at runtime

Solution

1. Step 1: Understand secure secret storage best practices

   Storing each secret separately allows fine-grained control and easier management.

2. Step 2: Evaluate options for app access

   Fetching secrets at runtime keeps secrets out of code and source control, improving security.

3. Final Answer:

   Store each variable as a separate secret in Key Vault and configure your app to fetch them at runtime -> Option D

4. Quick Check:

   Separate secrets + runtime fetch = best practice [OK]

Hint: Use separate secrets and fetch at runtime for security [OK]

Common Mistakes:

• Putting all secrets in one JSON string secret
• Hardcoding secrets in app code
• Exposing secrets in public repositories