What is Azure Key Vault, and how should an application access a secret from it securely?
What they are really testing: Whether you know Key Vault stores secrets/keys/certs and, critically, that the app authenticates with a managed identity rather than a stored credential, the no-bootstrap-secret pattern.
A real interview question
What is Azure Key Vault, and how should an application access a secret from it securely?
What most people say
drag me
“Key Vault stores your secrets, and the app reads them using a key or connection string.”
Using a key or connection string to read Key Vault recreates the original problem: a bootstrap secret you must store. The correct pattern is the app authenticating with its managed identity, so nothing is stored.
The follow-ups they ask next
Why is accessing Key Vault with a managed identity better than a connection string?
A connection string is itself a secret you must store, recreating the problem. A managed identity has no stored credential, the platform issues a token, so there is no bootstrap secret to leak.
What do soft-delete and purge protection do?
Soft-delete retains deleted secrets/keys for a recovery window; purge protection blocks permanent deletion during that window even by admins, protecting against accidental or malicious loss.
What the interviewer is listening for
- Stores secrets/keys/certs with RBAC + audit
- App authenticates via managed identity (no stored secret)
- Knows soft-delete/purge protection
What sinks the answer
- App reads vault with a stored key/connection string
- No managed identity
- Unaware of access control/protection features
If you genuinely do not know
Say this instead of freezing. Reasoning out loud from what you do know beats silence every single time, and a good interviewer is listening for exactly that.
“Key Vault [stores secrets, keys, and certificates with RBAC access control and audit logs]. Grant a principal [a scoped role like Key Vault Secrets User]. The app [authenticates with its managed identity and pulls the secret at runtime (DefaultAzureCredential), no stored secret to bootstrap]. Enable [soft-delete + purge protection] against deletion.”
Keep going with azure
Foundation
What is Microsoft Entra ID (formerly Azure AD), and how does authentication work in Azure?
Foundation
In Azure, what handles authentication versus authorization?
Foundation
Explain the Azure resource hierarchy: tenant, management group, subscription, resource group.
Junior
How does Azure RBAC work? Explain roles, scopes, and assignments.
Junior
What happens when a user signs in to an Azure/Entra-protected application?
Junior
What is the difference between a service principal and a managed identity, and why prefer managed identities?
Knowing the answer is not the same as recalling it under pressure
Sign in to send the questions you fumble to spaced recall, so they come back right before you would forget them, and learn the concepts behind them with hands-on labs.
Start free