An embedding Function app must load connection settings and secrets without hardcoding them in code. What configuration practice fits?
Select an answer to reveal the explanation.
Short Explanation
App settings plus Key Vault references are the locked drawer under the counter—embedding workers get secrets without baking them into the source.
Full Explanation
An embedding Function app that loads Cosmos, Service Bus, and Azure OpenAI settings must keep secrets out of source. Function app settings with Key Vault references supply connection strings and API credentials at runtime from a managed vault, supporting rotation, RBAC, and municipal compliance without committing secrets to git.
Hardcoding Cosmos and OpenAI secrets in Function source and committing them to git exposes the library SOP pipeline to repository leaks. Emailing production keys for pasting into notebooks breaks chain of custody and invites sprawl. Storing secrets in plain text on a public Blob container is equivalent to publishing the city's credentials.
Exam caveat: configuration for Functions on AI-oriented exams centers on app settings, identity, and Key Vault references—not plaintext in code or public storage. Managed identity to Key Vault further reduces long-lived secrets in settings where supported.
Operational check: remove secrets from code, set Key Vault references on the embedding Function app, assign the app's managed identity get/list on the vault secrets, restart, and confirm embeddings succeed while a deliberate wrong reference fails closed without falling back to hardcoded values.