Encrypting Credentials During Azure Deployment

AZ-900 By islever Editorial Last updated

Describe Azure identity, access, and security

Short answer

B Azure Key Vault is required to securely store and encrypt administrative credentials, whereas Azure Information Protection only classifies and labels documents and emails.

Question

Note: The question is included in a number of questions that depicts the identical set-up. However, every question has a distinctive result. Establish if
the solution satisfies the requirements.
You have been informed by your superiors of the company's intentions to automate server deployment to Azure. There is, however, some concern that
administrative credentials could be uncovered during this process.
You are required to make sure that during the deployment, the administrative credentials are encrypted using a suitable Azure solution.
Solution: You recommend the use of Azure Information Protection.
Does the solution meet the goal?
  1. Yes
  2. No Correct Answer

Key Takeaways

The question tests knowledge of Azure security services, specifically the trap of confusing content protection (AIP) with secret storage (Key Vault).

This question evaluates the correct Azure service for securing administrative credentials during server automation. It clarifies that Azure Key Vault, not Azure Information Protection, is the appropriate solution for secret management.

Common mistake: Learners often select 'Yes' because they associate Azure Information Protection with general data security, failing to distinguish between protecting documents and managing deployment secrets.

Expert Analysis

Why the Answer Is Correct

Azure Key Vault is the dedicated service for securely storing and accessing secrets such as API keys, passwords, certificates, or cryptographic keys. Since the goal is to encrypt and protect administrative credentials used during automated server deployment, Key Vault provides the necessary managed access and encryption capabilities. Therefore, recommending Azure Information Protection does not meet the requirement.

Why the Other Options Are Wrong

Azure Information Protection (AIP) is designed to classify, label, and protect sensitive information within documents and emails. It focuses on data loss prevention and persistent protection of content files rather than the secure storage and retrieval of credentials or secrets for infrastructure-as-code or deployment scripts. Using AIP for this purpose would be architecturally incorrect and ineffective.

Community Comment Notes

Community consensus strongly supports option B, with multiple users noting that AIP protects content like documents and emails, not passwords. Users frequently cite Azure Key Vault as the correct alternative, emphasizing its role in tightly controlling access to secrets. One comment explicitly states, "Azure INFORMATION protection protects content, not passwords," highlighting the key distinction.

Official Reference

https://learn.microsoft.com/en-us/azure/key-vault/general/basic-concepts

This link opens the official vendor documentation in a new tab.

Exam Strategy

When a question involves automating deployments or managing secrets, immediately consider Azure Key Vault. Do not confuse it with services focused on data classification or document labeling like AIP or Purview.

Frequently Asked Questions

Why is Azure Information Protection wrong for credentials?

AIP protects static content like documents and emails via labeling. It does not provide the dynamic secret management needed for deployment automation.

What Azure service manages secrets for automation?

Azure Key Vault is the standard service for storing and managing secrets, keys, and certificates securely for applications and deployments.

More AZ-900 FAQ →

Discussion 47 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 30 of 47

  1. iwarakorn 👍 98
    Answer is No Azure Information Protection (AIP) is a cloud-based solution that enables organizations to discover, classify, and protect documents and emails by applying labels to content.
  2. Dasiya 👍 80
    Correct answer is B. Solution : Azure Key Vault
  3. AntonioTech 👍 20 Answered B
    B. No Azure Information Protection is primarily used for classifying, labeling, and protecting documents and emails containing sensitive information. It's not designed for encrypting administrative credentials during server deployment processes. For encrypting administrative credentials during server deployment to Azure, a more suitable solution would be to use Azure Key Vault. Azure Key Vault is a cloud service that allows you to safeguard cryptographic keys, certificates, and secrets used by cloud applications and services. You can store the administrative credentials securely in Azure Key Vault and retrieve them when needed during the deployment process. This ensures that the credentials are properly protected and managed.
  4. toxicater 👍 10
    What if I AM a robot?
  5. maysonazure 👍 7
    Azure INFORMATION protection protects content, not passwords.
Show 25 more comments
  1. alexleonvalencia 👍 6
    La respuesta correcta es B, ya que Azure Information Protection sirve para proteger información que concierne a Documentos y Correos.
  2. tyhtyhtyh 👍 4 Answered B
    Azure Key Vault is a cloud service for securely storing and accessing secrets. A secret is anything that you want to tightly control access to, such as API keys, passwords, certificates, or cryptographic keys. https://learn.microsoft.com/en-us/azure/key-vault/general/basic-concepts -- Azure Information Protection (AIP) is part of Microsoft Purview Information Protection (formerly Microsoft Information Protection or MIP). Microsoft Purview Information Protection helps you discover, classify, protect, and govern sensitive information wherever it lives or travels. https://learn.microsoft.com/en-us/azure/information-protection/what-is-information-protection
  3. jgalanj 👍 4
    key word = concern that administrative credentials could be uncovered during this process = Key Vault
  4. chop_z_azur 👍 4
    Then why you robot are preparing for Azur exam ? You should already know the answers !
  5. Kanders 👍 4
    B. No - does not meet goal. Azure Key Vault is the correct solution.
  6. NOTEBOOK_789 👍 4 Answered B
    Key vault encrypt the data. So the answer should be no
  7. shadeey 👍 4
    Correct, Encryption solution => Azure Key Vault.
  8. kahla 👍 3 Answered B
    Azure Information Protection is for protecting documents and emails, not for securing administrative credentials in deployment processes. To ensure credentials are encrypted and securely managed during server deployment, Azure Key Vault should be used.
  9. BinuRaj 👍 3
    Azure Information Protection (AIP) is a cloud-based solution that enables organizations to discover, classify, and protect documents and emails by applying labels to content.
  10. CassarJ 👍 3
    Answer is correct. Key vaults are recommended to secure secrets /encrypt keys
  11. Petergrayston 👍 3
    Correct. The best solution is Azure Key Vault
  12. Mouhammad1 👍 3
    AIP only for email and documents
  13. qingyingsu 👍 3
    should is Key-Vault
  14. leonildo_a_l 👍 2 Answered B
    Solução correta é o uso da Azure Key Vault. A caixa de segredos do Azure, onde pode-se guardar credenciais de forma segura.
  15. Jas001 👍 2
    yeah, it is to protect documents to apply labels to them that further allows which internal and external users.
  16. buiducvu 👍 2 Answered B
    B. No, answer -> Key Vault
  17. ElPitu97 👍 2 Answered B
    Key Vault
  18. zswap 👍 1
    No, the solution does not meet the goal. Azure Information Protection is primarily used for classifying, labeling, and protecting documents and emails, but it is not specifically designed for encrypting administrative credentials during deployment. For securely encrypting administrative credentials during server deployment, Azure Key Vault should be used.
  19. Mahanad 👍 1 Answered B
    Azure Information Protection (AIP) is used to classify, label, and protect documents and emails. It is not designed to encrypt administrative credentials during automated server deployment. The appropriate solution is Azure Key Vault, which securely stores and manages secrets, passwords, keys, and certificates used during Azure deployments.
  20. arjunyv2022 👍 1 Answered B
    Azure Information Protection is not meant for securing administrative credentials, the solution does not meet the goal. The correct approach is to use Azure Key Vault or Managed Identities for secure credential management.
  21. beepic 👍 1 Answered B
    No , the answer of this question could be Azure Key Vault , Azure Information Protection (AIP) is a solutions that enables organizations to classfiy and protect documents and emails by adding labels to the content
  22. SyedAadRazaDevops 👍 1
    The Azure Information Protection tenant key is a root key for your organization. Other keys can be derived from this root key, including user keys, computer keys, or document encryption keys
  23. omsdigital 👍 1 Answered B
    Answer is no and fyi Azure Information Protection is retired now - in outlook and all microsoft suits they now have a way to classify documents if its sensitive - public etc.
  24. morpheusbn 👍 1 Answered B
    Keyword is: to automate server DEPLOYMENT to Azure. Answer is A
  25. Zaidsdb 👍 1 Answered B
    the answer is B because the other is more secuity then automate

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Azure Resource Locks for RG Protection

S-grade

Shared Responsibility in Azure SaaS

S-grade

Accessing Azure Cloud Shell via Web Browser

S-grade

Azure VM High Availability SLA Requirements

S-grade

Practice All AZ-900 Questions

Access 90 questions with complete answers and detailed explanations.

View Full AZ-900 Practice Test →

← Back to AZ-900 Study Guide