AZ-500 Manage identity and access Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Step 1: Create an Azure Key Vault. Step 2: Import a certificate into the Key Vault. Step 3: Enable managed identity on the Application Gateway. Step 4: Grant the managed identity permissions to access the Key Vault certificate secrets. Step 5: Configure the HTTPS listener to use the certificate from Key Vault.

  Why this is correct

  This order ensures the Key Vault and certificate exist, the Application Gateway has a managed identity, that identity has permission to read the certificate, and finally the listener is configured with the certificate reference. Each step builds on the previous one.

• ✗

  Step 1: Create an Application Gateway. Step 2: Configure the HTTPS listener. Step 3: Create a Key Vault and import a certificate. Step 4: Grant the Application Gateway access to the Key Vault.

  Why it's wrong here

  This order is incorrect because the HTTPS listener cannot be configured with a certificate that hasn't been imported into Key Vault yet, and the access grant is missing before listener configuration. The listener must be configured after the certificate is available and access is granted.

• ✗

  Step 1: Enable managed identity on the Application Gateway. Step 2: Create a Key Vault and import a certificate. Step 3: Configure the HTTPS listener to use the certificate from Key Vault. Step 4: Grant the managed identity permissions to access the Key Vault certificate secrets.

  Why it's wrong here

  This sequence fails because the HTTPS listener's certificate binding is validated against Key Vault at configuration time. If the Application Gateway's managed identity has not yet been granted at least 'Get' and 'List' permissions on the certificate secrets, the listener configuration will be rejected with an access-denied error. Granting permissions after the listener is configured is too late, because the gateway cannot dynamically resolve the certificate reference after validation has already failed.

• ✗

  Step 1: Create a Key Vault and import a certificate. Step 2: Configure the HTTPS listener to use the certificate from Key Vault. Step 3: Enable managed identity on the Application Gateway. Step 4: Grant the managed identity permissions to access the Key Vault certificate secrets.

  Why it's wrong here

  This order is incorrect because the Application Gateway must have a managed identity enabled before granting it access to Key Vault. Without a managed identity, the permission assignment is invalid, and the listener configuration will fail.

Go deeper

Related to this question