Azure Key Vault: Securing Secrets and Keys for AZ-900

Azure Key Vault is a cloud service for securely storing and managing secrets, cryptographic keys, and certificates. It centralizes secret management, removing sensitive data from source code and providing granular access control through RBAC and access policies, ensuring that only authorized applications and users can access critical credentials.

What exactly is Azure Key Vault?

Think of Azure Key Vault as a digital safe for your cloud infrastructure. In the early days of development, it was common—and dangerous—for developers to hardcode database passwords or API keys directly into their source code. This is what we call 'secret sprawl,' and it's a goldmine for hackers if your code ever leaks. Key Vault solves this by providing a centralized, hardened repository where these sensitive items live separately from your application logic.

For the AZ-900 exam, you need to understand that Key Vault isn't just a folder for passwords; it's a managed service that handles the lifecycle of security objects. Instead of your app 'knowing' the password, it asks Key Vault for the password at runtime using a secure identity. This shift significantly reduces your attack surface and ensures that your credentials aren't sitting in plain text in a GitHub repository or a config file.

How do secrets, keys, and certificates differ in the vault?

One of the trickiest parts of the AZ-900 is distinguishing between the three types of objects Key Vault manages. First, you have Secrets. These are essentially simple strings—think of them as passwords, connection strings, or API keys. They are encrypted and can only be retrieved by authorized entities. If you're storing a SQL Server password, you're using a Secret.

Next are Keys. These are cryptographic keys used for encryption, decryption, signing, and verification. Unlike secrets, you don't typically 'retrieve' a key to use it elsewhere; instead, you send data to the vault, and the vault performs the cryptographic operation for you. Finally, we have Certificates. These are used for SSL/TLS and are essentially a combination of a public key and a private key. Key Vault simplifies the nightmare of certificate management by automating the creation, renewal, and deployment of these certificates across your Azure resources.

Why is centralized secret management critical for your apps?

Imagine you have ten different microservices all using the same database password. If that password is compromised or needs to be rotated for security compliance, you'd normally have to update ten different config files and redeploy ten different services. That's an operational disaster waiting to happen. Centralized management means you update the secret in one place—the Key Vault—and every service automatically pulls the latest version the next time it requests it.

This 'single source of truth' approach is a cornerstone of modern cloud security. It allows your security team to manage credentials without needing to touch the developer's code. From a practical standpoint, this means less downtime during credential rotations and a much cleaner audit trail. You can see exactly which application requested which secret and when, which is a requirement for most high-level compliance frameworks like PCI-DSS or HIPAA.

How do you control who accesses your vault?

You can't just leave the vault door open. Azure provides two primary ways to secure it: Vault Access Policies and Azure Role-Based Access Control (RBAC). Access Policies are the older method, allowing you to define specific permissions (like 'Get', 'List', or 'Set') for a user or application. However, the industry is moving toward RBAC because it offers more granular control and integrates better with the rest of the Azure ecosystem.

When configuring access, always follow the principle of least privilege. Your application should have 'Get' permissions for the secrets it needs, but it should never have 'Delete' or 'Manage' permissions. By combining these access controls with Managed Identities—where the Azure resource itself is the identity—you can eliminate the need for 'secrets to protect your secrets.' This creates a seamless, passwordless authentication flow that is highly resistant to credential theft.

What is the deal with key rotation and versioning?

Static passwords are a security liability. The longer a key exists, the higher the chance it will be leaked. This is where key rotation comes in. Rotation is the process of generating a new cryptographic key or password and retiring the old one. Azure Key Vault allows you to automate this process, ensuring that your environment stays secure without requiring manual intervention every 90 days.

Versioning is the secret sauce that makes rotation possible without breaking your apps. When you update a secret, Key Vault doesn't overwrite the old one; it creates a new version. Your application can be configured to always pull the 'latest' version, or it can target a specific version during a transition period. This prevents the dreaded 'outage' that happens when a password is changed in the vault but the application is still trying to use the old one. Understanding this lifecycle is a key component of the Azure security domain on the AZ-900.

How does this fit into the AZ-900 exam?

On the AZ-900, you'll likely see questions asking you to identify the best service for storing a connection string or explaining the difference between a key and a secret. This topic falls under the 'Security, Privacy, and Compliance' domain, which is a significant portion of the exam. You don't need to know how to write the code to call the API, but you must understand the architectural 'why' and 'how' of Key Vault.

To really nail this section, you need practice. We've built the Cert Sensei platform to bridge the gap between theory and the exam. We offer 1,000 expert-curated Microsoft Azure Fundamentals (AZ-900) practice questions that mirror the actual exam's difficulty. Each question comes with detailed expert reasoning to explain why an answer is correct and why the distractors are wrong. Plus, our domain-level analytics will show you exactly if you're struggling with security concepts or cloud architecture, so you can stop wasting time on what you already know.

❓ Frequently Asked Questions