Domain 4 · Secure, monitor, and troubleshoot Azure solutions
The final domain covers what happens after the solution ships: keeping secrets out of code, changing configuration without redeploying, and being able to explain a production failure. It splits cleanly in half — Key Vault and App Configuration on the security side, OpenTelemetry and KQL on the observability side — and the underlying principle in both halves is the same: credentials and answers should be resolved at runtime, not baked in at build time.
Azure Key Vault
Key Vault is the secure store for secrets, keys, and certificates, and the exam expects you to distinguish its three object types because they are not interchangeable. Secrets hold arbitrary values such as passwords, connection strings, and API keys. Keys are cryptographic keys whose sign, verify, and wrap operations execute inside the vault or HSM, so the key material itself never leaves — that property is the entire reason to choose a key over a secret. Certificates add X.509 lifecycle management on top.
Access should come from a managed identity with RBAC (the Key Vault Secrets User role) or an access policy, never from a stored credential — otherwise you have merely moved the secrets problem somewhere else. Rotation follows from the same logic: read secrets at runtime, or through Key Vault references that re-resolve, so a rotated value is picked up without a redeploy. Baking a secret into a container image guarantees the opposite.
Two more controls complete the picture. A private endpoint (Private Link) combined with disabling public network access confines the vault to your virtual network. And soft delete with purge protection guards against a deletion — accidental or malicious — becoming permanent.
Azure App Configuration
Key Vault handles the sensitive values; App Configuration handles everything else, acting as a centralized store for application settings and feature flags shared across services.
Keys carry labels such as dev or prod, which is how one key name yields per-environment values, and snapshots capture a point-in-time set of configuration you can pin a release to. Where a setting is sensitive, App Configuration holds a Key Vault reference rather than the value itself, so the two services compose instead of competing.
The capability worth remembering is dynamic refresh: clients watch a sentinel key and re-read configuration on a poll interval, so flags and settings take effect live, without a restart. If a scenario asks how to flip a feature flag for a running fleet, this is the mechanism.
Observability with OpenTelemetry
OpenTelemetry is the vendor-neutral standard for traces, metrics, and logs; on Azure you use the Azure Monitor distro and exporters to send that data into Application Insights. Adopting the standard rather than a proprietary SDK is itself frequently the correct answer.
Distributed tracing is what makes a multi-service AI pipeline debuggable. Each child span references its parent through propagated W3C trace context — the traceparent header carrying a trace ID and span ID — which is what lets the backend reassemble the full call tree from independently emitted spans. Break the propagation and you get disconnected fragments instead of a trace.
The payoff is the end-to-end transaction view, which shows exactly which downstream span — a database query, a model endpoint, a queue — is slow or failing. For intermittent 500s spread across several services, it is the fastest route to a root cause, and considerably faster than reading logs service by service.
Analyzing logs with KQL
Log Analytics is queried with Kusto Query Language. It is not SQL: a query starts from a table and flows through the pipe (|) operator, each stage transforming the rows from the last.
// 10 newest exceptions in the last hour
AppExceptions
| where TimeGenerated > ago(1h)
| order by TimeGenerated desc
| take 10
// Requests per result code, in hourly buckets
AppRequests
| where TimeGenerated > ago(1d)
| summarize count() by ResultCode, bin(TimeGenerated, 1h)A small vocabulary covers most of what the exam asks:
| Need | Operator |
|---|---|
| Filter rows | where |
| Select/compute columns | project / extend |
| Aggregate | summarize |
| Time bucketing | bin(TimeGenerated, 1h) |
| Sort | order by ... desc |
| Limit | take / top |
The pairing to know cold is summarize with bin(): aggregating over time buckets is how you turn a raw log stream into a trend, and it is the shape of nearly every "show failures per hour" question.
Quiz · Domain 4
Your app must read a database password from Azure Key Vault at runtime without any stored credentials. What is the recommended identity mechanism?