Plan and manage an Azure AI solution 1.3 Manage, monitor, and secure AI systems
Security policy for a Foundry environment requires (1) that API key-based connection…
Study guide skill: Configure security, including managed identity, private networking, keyless credentials, and role policies
Question B8-007
Security policy for a Foundry environment requires (1) that API key-based connection secrets for all projects live in the company's own key vault and (2) that data at rest is encrypted with customer-managed keys. Which two actions meet the requirements? (Choose two.)
Select 2 answers.
Answer: A, D
By default Foundry stores API key-based connection secrets in a managed key vault; to manage them yourself, connect your key vault to the Foundry resource, and one connection covers all project and resource level secrets. Customer-managed keys need a key vault in the same region as the Foundry resource, with soft delete and purge protection enabled. The managed identities also need the required key permissions, such as Key Vault Crypto User with Azure RBAC.
Deep dive
How it works
The two requirements are covered by two separate sections of the Foundry architecture page.
Connection secrets in your own key vault. By default, Foundry stores all API key-based connection secrets in a managed Azure Key Vault. If you want to manage secrets yourself, connect your key vault to the Foundry resource. One Azure Key Vault connection manages all project and resource level connection secrets, so you don't need one per project.
Customer-managed keys (CMK). By default, Azure encrypts data at rest and in transit with Microsoft-managed keys. To use your own keys, check these prerequisites before you enable CMK:
- Key Vault is deployed in the same Azure region as your Foundry resource.
- Soft delete and purge protection are enabled on Key Vault.
- Managed identities have the required key permissions, such as the Key Vault Crypto User role when using Azure RBAC.
The other options, and when you'd use them
- Keep the default: The default is a managed Key Vault, not yours. You have to connect your own.
- A Key Vault connection per project: Unnecessary. One connection at the Foundry resource manages secrets for all projects and the resource.
- Key vault in a different region: The CMK prerequisite is the same region as the Foundry resource.
Exam tip
BYO Key Vault = one connection on the Foundry resource, covering every project. CMK = same-region vault, soft delete + purge protection, Crypto User for the identities.
References
Last reviewed: