AZ-305 Design infrastructure solutions Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Azure App Configuration

  Why it's wrong here

  Azure App Configuration is a managed service for centralized application settings and feature flags, not a secret store. It stores configuration data as plaintext at rest (even though encrypted by Azure), and it has no per-secret access policies, rotation, or audit logging specific to secret usage. The correct pattern is to place secrets in Key Vault and use App Configuration's Key Vault references to keep secrets out of configuration files and feature-flag payloads.

• ✓

  Azure Key Vault

  Why this is correct

  Azure Key Vault is the purpose-built service for securely storing secrets, encryption keys, and certificates, with granular access via Azure RBAC or vault access policies. It supports versioning, soft-delete, purge protection, and near-real-time audit logs through Azure Monitor, enabling tracking of every read, modify, and deletion operation. It is the correct choice because it is designed specifically for secret management and natively integrates with services like App Service, AKS, Azure Functions, and Logic Apps.

• ✗

  Azure Managed HSM

  Why it's wrong here

  Azure Managed HSM is a single-tenant, FIPS 140-2 Level 3 validated hardware security module that provides dedicated HSM-backed keys and cryptographic operations, but it does not support the 'Secrets' resource type (nor certificates) and is aimed at customers who need to own and manage their own HSM devices. It demands specialized quota, VNet integration, and significant operational overhead, making it overkill and unsuitable for general secret storage. Key Vault itself already offers HSM-backed keys, so Managed HSM is not the right answer for everyday secret storage.

• ✗

  Azure Storage

  Why it's wrong here

  Azure Storage is a generic blob, file, queue, and table service, not a security or secrets-management service. Although you can place encrypted blobs there, Azure Storage lacks key-versioning, secret-specific access policies, automatic rotation, and the same audit and diagnostic integration that Key Vault provides for secret operations. Storing secrets in Storage also increases the attack surface because shared keys, SAS tokens, and broad network rules can grant unintended access. It is wrong because it addresses raw storage rather than secret lifecycle management.

Go deeper

Related to this question