BenchMark Quizzes by MDFT Pro

Store Storage Account Key in Key Vault

You work as a Security Engineer for MDFT Pro, a well-known training agency that provides cloud certification courses to thousands of students worldwide. Mark, the Chief Security Officer, has implemented a policy requiring all sensitive credentials and connection strings to be stored in Azure Key Vault rather than in application configuration files or environment variables.

You are developing a course management application that needs to access an Azure Storage account to store student course materials, training videos, and certificate templates. The application requires secure access to the storage account keys, which must be retrieved from Azure programmatically and stored in Key Vault for the application to reference.

You have an Azure user account with appropriate permissions to both the storage account and the Key Vault. You need to retrieve the account key from the storage account and then store it securely in the key vault under the name ‘secret1’.

Which PowerShell commands should you use in sequence to retrieve the storage account key and store it in Key Vault?

Choose all correct answers from the options below.

Explanations for each answer:

$key = Get-AzStorageAccountKey -ResourceGroupName $group -Name $account is correct. This cmdlet retrieves the storage account keys from Azure. It returns an array of key objects, each containing properties like KeyName, Value, and Permissions. This is the first required step to obtain the keys before storing them in Key Vault.
$secret = ConvertTo-SecureString $key -AsPlainText -Force is incorrect. The $key variable is an array of key objects, not a plain text string. Attempting to convert the entire array object to a SecureString will fail because ConvertTo-SecureString expects a string value, not a complex object with multiple properties.
$secret = ConvertTo-SecureString $key[0] -AsPlainText -Force is incorrect. While $key[0] correctly accesses the first key object in the array, the object itself still contains multiple properties (KeyName, Value, Permissions). Converting the entire object to SecureString won't work; you need to extract the Value property specifically.
$secret = ConvertTo-SecureString $key[0].value -AsPlainText -Force is correct. This correctly accesses the Value property of the first key in the array and converts it to a SecureString. The -AsPlainText flag indicates the input is plain text, and -Force suppresses the warning about using plain text. This SecureString can then be stored in Key Vault.
Set-AzKeyVaultSecret -VaultName $vault -Name "secret1" -SecretValue $secret is correct. This cmdlet stores the SecureString value in Azure Key Vault. It creates or updates a secret named 'secret1' in the specified vault with the storage account key as its value. The SecretValue parameter requires a SecureString type, which was created in the previous step.
Set-AzKeyVaultSecret -VaultName $vault -Name "secret1" -SecretValue $key is incorrect. The Set-AzKeyVaultSecret cmdlet requires the SecretValue parameter to be a SecureString type. The $key variable contains an array of key objects, not a SecureString, so this command will fail with a type mismatch error.
Set-AzKeyVaultSecret -VaultName $vault -Name "secret1" -SecretValue $key[0] is incorrect. Even though $key[0] accesses the first key object, it's still an object with multiple properties, not a SecureString. The Set-AzKeyVaultSecret cmdlet specifically requires the SecretValue to be a SecureString type, so this will result in a type conversion error.
Set-AzKeyVaultSecret -VaultName $vault -Name "secret1" -SecretValue $key[0].value is incorrect. While $key[0].value accesses the actual key string, it's still a plain text string, not a SecureString. The Set-AzKeyVaultSecret cmdlet requires SecretValue to be a SecureString type for security reasons, so passing a plain string will fail.

Learn more about Key Vault Secrets with PowerShell:

Key Vault PowerShell Quickstart

Practice Exam

Store Storage Account Key in Key Vault

Discuss this question on social media: