A grain-elevator API registration still uses a two-year client secret pasted into a Function app setting. What credential approach should the security engineer prefer on the app registration?
Select an answer to reveal the explanation.
Short Explanation
A two-year secret living in an app setting is a long-lived spare key under the doormat. Prefer a certificate on the app registration—and if a secret must linger, make its remaining life short while you migrate.
Full Explanation
App registrations support password (client secret) and certificate credentials. Certificates are preferred over long-lived secrets for application authentication. Remaining secrets should use short lifetimes and secure distribution; embedding multi-year secrets in Function settings increases exposure. Storage account keys and Functions binding samples are not the app-registration credential control this skill tests; Key Vault administration of secrets is a related but separate Domain 4 concern.