5.3. Reflection Checkpoint

The architecture is now guarded and narrated: secrets used but never possessed, configuration centralized and refreshable, and every request telling its cross-service story.

Key Takeaways

• Sort substances into containers: secrets → Key Vault (RBAC + managed identity, versions, audit); settings and feature flags → App Configuration (labels, sentinel-key refresh); connect them with Key Vault references so apps see one surface and secrets stay vaulted.
• Secret rotation is assembled automation — SecretNearExpiry → Event Grid → Function → new secret version — and isn't finished until consumers re-fetch (restart ACA revisions; references resolve latest on restart).
• Distributed tracing lives or dies on context propagation: traceparent on HTTP hops, trace context in message properties across queues, consistent sampling everywhere — one trace ID, one story.
• KQL is a pipeline: table first, where early, summarize then render; percentiles over averages; operation_Id correlates requests, dependencies, and exceptions into a single investigation.

Connecting Forward

Content complete — all four exam domains plus foundations. Phase 6 turns knowledge into exam performance: strategy for the question formats, a quick-reference distillation of every decision table in this guide, and domain-organized practice questions with full rationales. Phases 7 and 8 close with the glossary and your readiness checklist.

Self-Check Questions

• An attacker obtains read access to your App Service configuration blade. Enumerate what they get in a Key Vault-references architecture versus plain app settings — and which additional control would have alerted you to the vault reads.
• A user reports a slow answer at 14:32. Walk the full diagnostic path — which KQL table you start in, how you find the request's trace, and where a missing queue-context propagation would truncate your investigation.