A multi-agent order-fulfillment system stores third-party shipping API credentials and signing certificates used by tool connectors. Compliance requires centralized secret storage, role-based access to secrets, automated rotation, and encryption at rest. Agents run on Azure with managed identities. Which design best satisfies these requirements?
Select an answer to reveal the explanation.
Short Explanation
Correct answer: C. Azure Key Vault is the standard secrets plane for multi-agent solutions: certificates and keys stay encrypted at rest, access is RBAC- or access-policy based per identity, and rotation can be automated. Agents with managed identities pull only what they need at runtime. Git-based .env patterns (A) mix secrets with code and weak passphrase crypto. Broad App Configuration Contributor (B) over-privileges agents and is not a full secrets lifecycle solution. Putting keys in prompts (D) leaks them into logs, traces, and context windows. Key Vault plus least-privilege agent identities is the exam-aligned approach.
Full Explanation
The AI-500 skills measured explicitly call out secrets management with Azure Key Vault: secrets, certificates, key rotation, role-based access to secrets, and encryption. Production multi-agent systems should never treat prompts, Git, or flat config as the system of record for credentials. With managed identities, agents authenticate to Key Vault without embedded vault keys. Scope each identity to specific secret names or prefixes (get/list, not set/delete, unless the agent must write). Enable rotation and dual-version windows so tools can refresh without downtime. Option A fails audit and rotation requirements. Option B confuses configuration with secrets governance and grants write-capable roles too broadly. Option D is an anti-pattern that guarantees secret exposure in observability pipelines. Layer Key Vault references from App Service or Container Apps when useful, but keep the vault as the authoritative store and audit secret access with diagnostic logs.