Case study

Tailwind Traders — secrets, identity, and observability

Tailwind Traders operates a multi-tenant SaaS platform across App Service, Azure Functions, and AKS.

Secrets are currently a single Key Vault shared by every application and environment, and each service authenticates with a client secret stored in app settings. A recent near-miss saw a leaked secret grant access to production storage. Security has mandated that no application store a credential of any kind, and that a compromise of one workload must not expose another's secrets.

The database password must rotate every 60 days with zero downtime. An earlier attempt caused an outage because applications cached the old value and kept presenting a revoked credential.

On the observability side, one Application Insights resource is shared by all services, and during incidents the team cannot tell which service is failing or follow a request across service boundaries. Telemetry ingestion cost has also tripled year on year, and a daily cap was applied that silently created gaps in the data.

Requirements

No stored credentials in any application
A compromised workload must not reach another workload's secrets
60-day password rotation with no failed authentications
Attribute telemetry to a specific service and follow a request end to end
Reduce ingestion cost without losing representative data or creating gaps

Q42 RBAC Domain 4 · 20–25% of exam Priority · Real Exam

Security mandates that no application stores a credential. Which approach satisfies this across App Service, Functions, and AKS?

A Move every client secret into the shared Key Vault
B Managed identities for App Service and Functions, and Workload Identity for AKS pods (correct answer)
C Rotate the client secrets every 30 days
D Store the secrets as encrypted environment variables

Shortcut: Managed identities are issued and rotated by the platform, and the application never sees a credential; it obtains a token from a local endpoint. Workload Identity is the AKS equivalent, federating a pod service account to an Entra ID identity. Moving a secret into Key Vault still leaves a bootstrap secret to reach the vault.

Security mandates that no application stores a credential. Which approach satisfies this across App Service, Functions, and AKS?

More RBAC questions