Exam Preparation Quiz

Explanations for each answer:

• Create a user-assigned managed identity, reference it in the service connection, and grant it Key Vault access via an access policy is correct. A user-assigned managed identity provides a secure identity that can be referenced in the service connection and granted only the specific access needed to retrieve secrets from Key Vault. Using an access policy allows precise control over which secrets can be accessed, adhering to the principle of least privilege by granting only the required permissions.
• Create a service principal with Contributor access at the subscription level and reference it in the service connection is incorrect. This approach violates the principle of least privilege by granting Contributor access at the subscription level, which provides far more permissions than necessary to access Key Vault secrets. A service principal with such broad access represents a significant security risk as it could modify many other resources in the subscription.
• Use a system-assigned managed identity tied to a Microsoft-hosted agent and configure RBAC on the Key Vault is incorrect. Microsoft-hosted agents in Azure DevOps cannot use system-assigned managed identities. These agents are temporary and isolated environments that don't have persistent identities across pipeline runs. Microsoft-hosted agents have no built-in mechanism to authenticate to Azure resources using system-assigned managed identities, making this approach technically impossible for accessing Key Vault secrets during deployments.
• Grant Azure DevOps the Key Vault Secrets User role at the subscription level to allow access during deployments is incorrect. This solution violates the principle of least privilege by granting permissions at the subscription level, which would allow access to all key vaults in the subscription rather than just the specific vault needed for the deployment. Such broad access increases the security risk unnecessarily.