Design solutions that align with security best practices and priorities →mediumMultiple ChoiceObjective-mapped
SC-100 Practice Question: Design solutions that align with security best practices and priorities
Your organization is migrating on-premises applications to Azure and needs to secure secrets (database connection strings, API keys) used by these applications. You are required to rotate secrets automatically without downtime. Which Azure service should you use?
⚠ Common exam trap
Candidates often confuse Azure App Configuration (which can store configuration values but not secrets securely with rotation) with Azure Key Vault, or mistakenly think Purview Information Protection handles secrets management, when only Key Vault provides the required secure storage and automated rotation capabilities.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure Key Vault with managed identity and certificate auto-rotation
Azure Key Vault with managed identity and certificate auto-rotation is correct because it provides a centralized, secure store for secrets like database connection strings and API keys, supports automatic rotation of certificates and secrets via Event Grid notifications or lifecycle policies, and integrates with Azure resources using managed identities to enable zero-downtime rotation without exposing credentials in code or configuration.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Microsoft Purview Information Protection
Why it's wrong here
Microsoft Purview Information Protection is a data governance solution focused on classifying, labeling, and protecting documents and emails, not on storing application secrets. It does not provide secure storage for credentials, connection strings, or certificates, nor does it offer any mechanism for managed identity to access secrets. While it protects data at rest or in transit, it cannot serve as a vault for infrastructure secrets needed by application workloads.
- ✗
Azure App Configuration with feature flags
Why it's wrong here
Azure App Configuration is designed to manage application configuration settings and feature flags, enabling developers to centrally control app behavior and release features. However, it is explicitly not a replacement for a secret store; it lacks the hardened, key-management–specific security controls and integration with managed identities required for securely storing sensitive credentials. Storing secrets there would expose them to unauthorized access and bypass the auditing and rotation capabilities provided by a dedicated key vault.
- ✓
Azure Key Vault with managed identity and certificate auto-rotation
Why this is correct
Azure Key Vault is the appropriate service for securely storing and managing sensitive information such as certificates, keys, and secrets. By combining it with a managed identity, an application authenticates to Key Vault without any hardcoded credentials, and the built-in certificate auto-rotation ensures certificates are renewed and renewed versions are made available transparently. This integrated approach fully addresses secret storage, access control, and lifecycle management for your migration.
- ✗
Azure AD Application Proxy
Why it's wrong here
Azure AD Application Proxy enables secure remote access to on-premises web applications by publishing them through an external URL, allowing users to connect via Azure AD authentication. It does not store or manage secrets—it simply relays traffic and enforces conditional access policies. Therefore, it is unrelated to the secret-management requirement and would not help in safely handling certificates or credentials in the migration.
Go deeper
Related to this question
About these practice questions
One of 208 original SC-100 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-100 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-100 exam.