The transit RAG API needs both model temperature defaults and database connection secrets. How should they be split?
Select an answer to reveal the explanation.
Short Explanation
Split the binder and the lockbox—App Configuration holds the temperature sticky notes; Key Vault holds the real keys.
Full Explanation
The transit RAG API needs both model temperature defaults and database connection secrets, so split them: keep non-secret settings in Azure App Configuration and store secrets only in Azure Key Vault. Temperature, endpoint hostnames, top-p, and similar generative defaults are configuration; database connection strings and API keys are secrets. App Configuration centralizes non-secret transit RAG behavior with labels/refresh, while Key Vault protects credentials with RBAC, soft-delete, and managed-identity retrieval. This split is a recurring AI-200/Azure design theme for municipal generative apps.
Placing both temperatures and connection secrets exclusively in App Configuration as plain values fails secret protection—connection strings become readable configuration and lack Key Vault’s secret controls. Putting every configuration value including temperatures into Key Vault as secrets fails operational fit: non-secrets become harder to browse/change, inflate secret operations, and blur least-privilege reviews. Embedding secrets and non-secrets together in client-side localStorage fails catastrophically for a server-side transit RAG API—browsers must never hold database credentials, and localStorage is not an enterprise config store.
Exam caveat: App Configuration can reference Key Vault for secret values while still storing non-secrets directly—that hybrid still respects the split. Do not confuse ‘encrypted at rest in App Config’ with ‘appropriate secret store’; exams expect Key Vault for secrets. Client-side storage distractors often appear when stems mention APIs—keep secrets server-side.
Operational check: store temperature defaults in App Configuration labels for transit, store DB connection strings in Key Vault, confirm the API identity reads both correctly, rotate the DB secret without changing temperature keys, and verify no connection string appears in App Configuration plaintext or browser storage.