An App Service hosting the clerk assistant should resolve secrets without copying values into app settings. What pattern should be used?
Select an answer to reveal the explanation.
Short Explanation
Key Vault references are sticky notes that say “look in the lockbox”—App Service reads the URI, not a copied password sitting in settings.
Full Explanation
An App Service hosting the clerk assistant should resolve secrets without copying values into application settings by using App Service Key Vault references. Settings store a Key Vault secret URI (and optionally a version); at runtime App Service uses the site’s managed identity to resolve that URI and injects the secret value into the process environment. Operators never paste the raw Cosmos key, API key, or connection string into configuration blades, which reduces portal exposure, keeps rotation centralized in Key Vault, and avoids duplicating secret material across slots and sticky settings.
Pasting secret values into App Service application settings as plain text fails the ‘no copy’ requirement: the secret now lives in App Service configuration stores, slot settings, and often deployment pipelines, and rotation requires coordinated updates in two places. Embedding secret strings directly in the front-end JavaScript bundle fails confidentiality completely—browser clients and CDN caches receive the credential. Checking secrets into the deployment package under a hidden folder fails for the same class of reason as baking secrets into artifacts: packages are copied widely, hidden folders are not encryption, and Git or artifact feeds retain history.
Exam caveat: Key Vault references still need the App Service managed identity granted secret Get, and network rules or private endpoints must allow the resolve path. Versionless references ease rotation; version-pinned references can leave the site on a retired secret after Key Vault rotation. Do not confuse Key Vault references (App Service resolves URIs) with putting non-secret App Configuration values in the same settings bag.
Operational check: set a setting to a @Microsoft.KeyVault(...) reference, restart or wait for refresh, confirm the app reads the secret successfully, rotate the Key Vault version, and verify the site picks up the new value without a plaintext paste into application settings.