Helping Hand Questions for AI-200

Provide the key storage for App1: Azure Key Vault secret

Secure App1 access to the key storage: Managed identity

An API access key is a sensitive string value, so it should be stored as an Azure Key Vault secret , not as an Azure Key Vault cryptographic key. Azure Container Apps supports direct Key Vault secret references , allowing sensitive values to remain centrally stored outside the container app rather than being embedded in images or supplied directly as Container Apps secret values. Microsoft recommends Key Vault references for production secrets because they provide centralized lifecycle management and avoid placing secret values directly in application configuration.

App1 should authenticate to Key Vault by using a managed identity . Azure Container Apps supports both system-assigned and user-assigned managed identities, enabling the workload to obtain Microsoft Entra tokens without maintaining client secrets or credentials. The identity must be granted appropriate Key Vault permissions, such as the Key Vault Secrets User RBAC role, to retrieve the stored secret.

This configuration also minimizes maintenance. When the Key Vault reference omits a specific secret version, Container Apps uses the latest version and automatically detects newer versions, retrieving the updated value within approximately 30 minutes.

Therefore, the required combination is Azure Key Vault secret + Managed identity .

Study Guide references: Azure Container Apps → secrets management; Key Vault references; managed identities; secret rotation and runtime retrieval.

Initialize the connection by using the account endpoint and key: CosmosClient

Define shared throughput: Database

Perform item CRUD operations: Container

The Azure Cosmos DB for NoSQL .NET SDK uses a clear resource hierarchy. CosmosClient is the top-level client object and is responsible for connecting to the Azure Cosmos DB account. Microsoft identifies it as the primary SDK class for accessing account-level resources and databases. It can be initialized by using the account endpoint together with an account key or another supported credential.

A Database represents a database resource within the account. Shared provisioned throughput is configured at the database level , allowing multiple containers within that database to share the same RU/s allocation. Microsoft documents that setting throughput on the database creates a shared-throughput database.

A Container is the SDK object used to interact with items stored in a Cosmos DB container. Microsoft specifically describes the Container class as the object used for item operations such as creating, reading, updating, deleting, and querying documents.

The Indexing policy option is not used for any of these requirements. It controls how Cosmos DB indexes document properties for query execution, not connectivity, shared throughput, or CRUD access.

Study Guide references: Azure Cosmos DB for NoSQL .NET SDK → CosmosClient; Database; shared throughput; Container; item CRUD operations.