What's changed: Added per-section figures (cert-figure-retrofit). New AI-200 Chapter 4 (secret management = Key Vault/App Configuration/managed identity keyless/RBAC, observability = OpenTelemetry instrumentation/distributed tracing/Application Insights·Azure Monitor/KQL/AI-specific monitoring = tokens·cost·quota·generation quality)
4.1Secret Management and Identity
Understand securing an AI back-end’s secrets and configuration—Azure Key Vault (secrets/keys/certificates), Azure App Configuration (settings and feature flags), and keyless auth via managed identity with RBAC—from a developer’s view.
An AI back-end handles secrets—AI-service connection info, database credentials, API keys. The rule is to never hard-code them in code or config files. On Azure, centralize secrets, keys, and certificates in Azure Key Vault, and have the app retrieve them keylessly via managed identity. Manage configuration values (endpoints, parameters) and feature flags centrally in Azure App Configuration for safe per-environment swaps and gradual feature rollout.
| Purpose | Service |
|---|---|
| Centralize secrets, keys, certificates | Azure Key Vault |
| Centralize settings and feature flags | Azure App Configuration |
| Authenticate without secrets | Managed identity (keyless) |
| Least-privilege access control | RBAC |
Common: (1) "centralize secrets/keys/certificates" = Azure Key Vault. (2) "centralize settings and feature flags" = Azure App Configuration. (3) "authenticate to Key Vault/AI services without secret keys" = managed identity (keyless) + least-privilege RBAC. (4) never hard-code secrets in code/config.
Watch out: (1) Key Vault (secrets: secrets/keys/certificates) vs App Configuration (non-secret settings, feature flags)—secrets go in Key Vault. (2) authentication (managed identity) vs authorization (RBAC) are separate layers. (3) Managed identity removes the key-rotation burden at the root. (4) Feature flags toggle features on/off without code changes.
4.1.1Section summary
- Never hard-code secrets; centralize in Key Vault
- App Configuration = centralized settings and feature flags (non-secret)
- Authenticate/authorize securely with managed identity (keyless) + least-privilege RBAC, holding no secrets
Sign in to track progress — Log in.
Quick check
(just a quick review)Q1. Which Azure service centrally manages secrets, encryption keys, and certificates?
Q2. Which Azure service centralizes settings and feature flags for per-environment swaps and gradual rollout?
Q3. What is the recommended way to authenticate to Key Vault/AI services without secret keys in code/config?
Q4. Which correctly distinguishes Key Vault from App Configuration?
Q5. Which is the most appropriate access-granting policy for an AI back-end?
Keep track of your progress
The full study guide is free to read. Sign up free to practice with the question bank, track what you have read, review your mistakes, and highlight passages.