AZ-204 Practice Exam 64 — 20 Questions

Question 1

Your company has an Azure Kubernetes Service (AKS) cluster that hosts multiple microservices. You are tasked with deploying a new microservice that processes incoming HTTP requests and publishes messages to an Azure Service Bus topic. The microservice must scale based on the number of messages in the topic, and it must support graceful shutdown to complete in-flight requests. You need to choose the appropriate compute platform. The microservice is stateless and can be containerized. You want to minimize operational overhead and cost. The solution must automatically scale to zero when there are no messages. Which option should you choose?

Option A: Deploy the microservice as an Azure Function with a Service Bus trigger on the Consumption plan.
Option B: Deploy the microservice as a container in AKS with a Horizontal Pod Autoscaler based on Service Bus queue length.
Option C: Deploy the microservice as an Azure Container App with a Service Bus scale rule.
Option D: Deploy the microservice as an Azure App Service WebJob with continuous mode.

Accepted Answer

Azure Container App with Service Bus scale rule. Azure Container Apps (ACA) with a Service Bus scale rule is the correct choice because it provides event-driven scaling based on the number of messages in a Service Bus topic, can scale to zero when there are no messages, supports graceful shutdown via terminationGracePeriodSeconds, and minimizes operational overhead compared to AKS. ACA is a serverless container platform that abstracts Kubernetes complexity while still allowing containerized workloads, making it ideal for stateless microservices that need to scale on demand.

Answer

AKS with HPA based on Service Bus queue length

Answer

Azure Function with Service Bus trigger on Consumption plan

Answer

Azure App Service WebJob with continuous mode

Question 2

Your organization runs a critical e-commerce application on Azure App Service. The application uses a Standard App Service plan with three instances. During a flash sale, traffic spikes cause some requests to fail with HTTP 503 errors. The operations team reports that the app's CPU usage reaches 95% during spikes. You need to ensure the application remains responsive without manual intervention. The solution must minimize cost while handling unpredictable traffic patterns. You evaluate the following options: A) Enable autoscale to scale out based on CPU usage threshold of 70%, with a maximum of 10 instances. B) Change the App Service plan to Premium v3 and enable zone redundancy. C) Implement a queue-based load leveling pattern using Azure Queue Storage and a background process. D) Use Azure Front Door with a Web Application Firewall (WAF) policy to distribute traffic. Which option should you recommend?

Accepted Answer

Enable autoscale to scale out based on CPU usage threshold of 70%, with a maximum of 10 instances.. Option B is correct because enabling autoscale on the Standard App Service plan allows the application to automatically scale out from 3 to up to 10 instances when CPU exceeds 70%, handling traffic spikes without manual intervention. This minimizes cost by only adding instances when needed, and the Standard plan supports autoscale natively, making it the most cost-effective solution for unpredictable traffic patterns.

Answer

Use Azure Front Door with a Web Application Firewall (WAF) policy to distribute traffic.

Answer

Implement a queue-based load leveling pattern using Azure Queue Storage and a background process.

Answer

Change the App Service plan to Premium v3 and enable zone redundancy.

Question 3

You are deploying a containerized application on Azure Container Instances (ACI) that needs to run as a background job every hour. The job processes data from an Azure SQL Database and sends a report via email. You need to minimize costs while ensuring the job runs reliably on schedule. The job takes about 10 minutes to complete. What should you do?

Accepted Answer

Create an Azure Logic App with a recurrence trigger that starts the container group using the 'Start Container Group' action, and stop it after completion.. Option B is correct because it uses Azure Logic Apps with a recurrence trigger to start the container group only when needed, and stops it after the job completes. This minimizes costs by avoiding continuous running charges for the container, while the Logic App itself incurs minimal execution cost. The job's 10-minute duration fits well within the 1-hour recurrence window, ensuring reliable scheduling without idle compute time.

Answer

Use Azure Batch with a job schedule to run the container as a task.

Answer

Deploy the container on a single Azure virtual machine and schedule it using Windows Task Scheduler.

Answer

Use an Azure Function with a timer trigger that uses the Azure Container Instances SDK to start the container group.

Question 4

Your company is developing a real-time dashboard that displays live metrics from IoT devices. The backend processes device data using Azure Functions with an Event Hubs trigger. The processed data is stored in Azure Cosmos DB. You need to ensure that the system can handle a sudden increase in device data without losing messages or overloading Cosmos DB. The solution must minimize latency and cost. What should you do?

Accepted Answer

Implement a buffer using Azure Blob storage: the Event Hubs triggered function writes raw data to blobs, and a separate timer-triggered function batches and writes to Cosmos DB at a controlled rate.. Option A is correct because it decouples the ingestion rate from the write rate to Cosmos DB. By buffering raw data in Azure Blob storage and using a timer-triggered function to batch-write at a controlled rate, the system can absorb sudden spikes in device data without overwhelming Cosmos DB or losing messages. This approach minimizes latency by keeping the Event Hubs trigger processing fast (writing to blob) and reduces cost by avoiding the need to over-provision RU/s on Cosmos DB.

Answer

Configure the Event Hubs trigger to use a checkpointing strategy with a larger batch size to reduce the number of function invocations.

Answer

Use Azure Stream Analytics to process the Event Hubs data and write directly to Cosmos DB.

Answer

Increase the provisioned throughput (RU/s) on the Cosmos DB container to handle peak loads.

Question 5

You are designing a serverless data processing pipeline. The pipeline receives JSON messages from an Azure Event Hubs instance. Each message must be enriched with data from a Cosmos DB database and then written to a Parquet file in Azure Data Lake Storage Gen2. The enrichment step involves a lookup that takes approximately 2 seconds per message. The pipeline must process up to 1000 messages per second. You need to choose the most cost-effective and scalable compute option. Consider the following options: A) Use a single Azure Function with Event Hubs trigger and output to Data Lake Storage. B) Use a Durable Functions orchestration with fan-out/fan-in pattern. C) Use Azure Stream Analytics with a reference data input from Cosmos DB and output to Data Lake Storage. D) Use an Azure Databricks notebook with structured streaming. Which option should you recommend?

Accepted Answer

Use Azure Stream Analytics with a reference data input from Cosmos DB and output to Data Lake Storage.. Azure Stream Analytics with a reference data input from Cosmos DB is the most cost-effective and scalable option because it can handle high-throughput streams (up to 1 GB/s) with sub-second latency, and it natively supports enriching incoming events with static or slowly-changing reference data (like Cosmos DB) without requiring custom code. The enrichment lookup is performed in-memory within the Stream Analytics job, avoiding per-message function invocation overhead and enabling linear scale-out across streaming units to meet 1000 messages/second with a 2-second lookup.

Answer

Use an Azure Databricks notebook with structured streaming.

Answer

Use a Durable Functions orchestration with fan-out/fan-in pattern.

Answer

Use a single Azure Function with Event Hubs trigger and output to Data Lake Storage.

Question 6

Your company uses Azure App Service to host a web application that requires periodic database maintenance. The maintenance tasks are time-consuming and must run outside of peak hours. You need to schedule these tasks to run automatically at 2:00 AM every Sunday. The tasks should be implemented as an Azure Function that runs in the same App Service plan to reduce costs. What should you do?

Accepted Answer

Add a WebJob to the App Service that uses a scheduled trigger to run the maintenance code.. Option C is correct because WebJobs in Azure App Service allow you to run background tasks on a schedule using a settings.job file with a CRON expression. Since the WebJob runs in the same App Service plan as the web application, it shares the same resources and incurs no additional cost, meeting the requirement to reduce costs. The scheduled trigger at 2:00 AM every Sunday can be configured with the CRON expression '0 0 2 * * 0'.

Answer

Deploy the maintenance code as an Azure Function in the Consumption plan and configure a timer trigger.

Answer

Create a separate Azure Function App in the same App Service plan and configure a timer trigger.

Answer

Use Azure Logic Apps with a recurrence trigger to call the web application's maintenance endpoint.

Question 7

Your company runs a web application on Azure App Service that uses a custom domain. The application must be accessible only via HTTPS. You have already uploaded an SSL certificate for the custom domain. However, users can still access the site via HTTP. You need to enforce HTTPS redirection. What should you do?

Accepted Answer

Enable the 'HTTPS Only' setting in the App Service's TLS/SSL settings blade.. The 'HTTPS Only' setting in the App Service's TLS/SSL settings blade enforces that all incoming requests are redirected from HTTP to HTTPS at the platform level, before any application code runs. Since you have already uploaded an SSL certificate, enabling this setting ensures that users cannot access the site via HTTP, meeting the requirement without modifying application code.

Answer

Set the 'Minimum TLS Version' to 1.2.

Answer

Add a rewrite rule in the web.config file to redirect HTTP to HTTPS.

Answer

Configure the App Service to require client certificates.

Question 8

You are developing a solution that processes messages from an Azure Storage Queue. Each message triggers a long-running operation that may take up to 30 minutes. You need to ensure that if the processing fails, the message is not lost and can be retried later. The current implementation uses a console application that polls the queue and deletes messages after processing. What should you change?

Accepted Answer

After processing fails, update the message's visibility timeout to a later time so it becomes visible again for retry.. The correct approach is to update the message's visibility timeout to a later time when processing fails. This makes the message reappear in the queue after the specified timeout, allowing another consumer to retry processing. Azure Storage Queue messages have a default visibility timeout of 30 seconds, but you can extend it to up to 7 days. This ensures the message is not lost and can be retried without being deleted or moved prematurely.

Answer

Move the message to a poison queue after the first failure.

Answer

Increase the polling interval to reduce the chance of missing messages.

Answer

Delete the message only if processing succeeds; otherwise, leave it in the queue.

Question 9

Your company is migrating a legacy on-premises .NET Framework 4.7.2 web application to Azure. The application uses session state stored in-memory and reads/writes to a local SQL Server database. The migration must minimize code changes, support auto-scaling, and handle session state across multiple instances. You plan to use Azure App Service with Windows OS. You need to recommend a solution for session state storage and database connectivity. Which option should you choose?

Accepted Answer

Use Azure Cache for Redis as the session state provider via the RedisSessionStateProvider NuGet package, and configure the database connection string in Azure App Service App Settings.. Option A is correct because Azure Cache for Redis provides a distributed, in-memory session state provider that supports session state sharing across multiple App Service instances without requiring code changes to the application logic. The RedisSessionStateProvider NuGet package is a drop-in replacement for the default in-memory provider, and configuring the database connection string in App Settings allows you to change the target without modifying web.config, minimizing migration effort.

Answer

Store session state in Azure Table Storage using a custom session state provider, and use a connection string for Azure SQL Database.

Answer

Configure session state using Azure SQL Database with a session state database, and update the connection string in web.config.

Answer

Use App Service's built-in session state with ARR affinity and connect to Azure SQL Database using Managed Identity.

Question 10

You are developing a real-time analytics application that ingests IoT sensor data every second. The data is written to Azure Blob Storage as small JSON files (each ~1 KB). The application also needs to query the data based on device ID and timestamp. You need to design a storage solution that allows efficient querying without writing custom code for indexing. You have decided to use Azure Data Lake Storage Gen2. What should you do to optimize query performance?

Accepted Answer

Use a folder structure like /deviceid/yyyy/mm/dd/hh/ and set the device ID as the partition key.. Azure Data Lake Storage Gen2 supports hierarchical namespaces, which allow you to organize data into folders and subfolders. By structuring the path as /deviceid/yyyy/mm/dd/hh/, you effectively partition the data by device ID and time, enabling efficient querying with tools like Azure Synapse or PolyBase without custom indexing. This leverages the directory structure as a natural partition key, minimizing the data scanned during queries.

Answer

Use Append Blobs to combine small writes into larger blobs.

Answer

Store all JSON files in a single folder and use Azure Data Lake Analytics to query.

Answer

Store the data in Azure SQL Database instead of Blob Storage.

Question 11

A retail company uses Azure Logic Apps to integrate with third-party APIs. One Logic App sends purchase orders to a supplier's HTTP endpoint. The supplier requires that the request include an OAuth 2.0 access token obtained from their authorization server. The company wants to manage the client credentials (client ID and client secret) securely and rotate them automatically. The Logic App must also log all requests for auditing. What should you do?

Accepted Answer

Use the 'HTTP + Swagger' connector, define the OAuth2 security scheme, store the client secret in Key Vault, and configure the Logic App to use a system-assigned managed identity to access Key Vault.. Option C is correct. Using HTTP + Swagger connector with managed identity and Key Vault integration allows secure storage and automatic rotation of credentials. Option A is wrong because the built-in HTTP action does not support managed identity. Option B is wrong because the Managed API connector does not support OAuth token acquisition. Option D is wrong because the system-assigned managed identity cannot be used for external OAuth flows.

Answer

Use the built-in HTTP action with a system-assigned managed identity and request a token from the supplier's authorization server using the managed identity.

Answer

Use the built-in HTTP action in the Logic App, store the client secret in Azure Key Vault, and retrieve it using the Key Vault connector. Then request a token from the supplier's authorization server.

Answer

Use the 'Managed API' connector for the supplier, configure it with client ID and secret in the connection parameters, and enable 'Azure AD Integration' on the Logic App.

Question 12

Your company, Contoso Ltd., operates a global e-commerce platform. The platform stores product images in Azure Blob Storage. Currently, the images are stored in a single storage account in the West US region. The application uses HTTP to download images. Users in Europe report slow load times. You need to reduce latency for European users. The solution must minimize costs and administrative overhead. You also need to ensure that images are served over HTTPS. You have the following requirements: 1) Users in Europe must have low-latency access. 2) The solution must be cost-effective. 3) The solution must not require changes to the application code. 4) Images must be served over HTTPS. Which course of action should you recommend?

Accepted Answer

Create an Azure CDN profile and add a CDN endpoint that points to the storage account. Enable HTTPS on the CDN endpoint.. Option B is correct because Azure CDN provides a global, distributed network of edge servers that cache content closer to users, reducing latency for European users without requiring application code changes. Enabling HTTPS on the CDN endpoint ensures images are served securely over HTTPS, meeting the requirement. This solution is cost-effective as it uses a pay-as-you-go model and minimizes administrative overhead by leveraging a managed service.

Answer

Use Azure Front Door with the storage account as a backend.

Answer

Create a secondary storage account in Europe and use asynchronous replication. Update the application to use the secondary endpoint for European users.

Answer

Enable geo-redundant storage (GRS) on the storage account.

Question 13

You are building a serverless application that processes images uploaded to an Azure Blob Storage container. When a new blob is added, an Azure Function (PowerShell) is triggered to generate a thumbnail and store it in a different container. The function must run with the least privilege necessary. The function uses a managed identity assigned to the function app. You need to grant the function access to read blobs from the source container and write blobs to the destination container. The storage account already has a private endpoint configured. What is the correct way to assign permissions?

Accepted Answer

Add the function app's managed identity to the source container's Access Control (IAM) with the 'Storage Blob Data Reader' role, and to the destination container with the 'Storage Blob Data Contributor' role.. Option C is correct because it uses Azure RBAC roles scoped to individual containers, granting the function app's managed identity exactly the permissions needed: 'Storage Blob Data Reader' for reading from the source container and 'Storage Blob Data Contributor' for writing to the destination container. This follows the principle of least privilege, avoids over-permissioning, and works seamlessly with private endpoints since RBAC does not depend on network paths.

Answer

Generate a SAS token for the source container with read permission and for the destination container with write permission, and store them in Key Vault for the function to retrieve.

Answer

Add the function app's managed identity to the storage account's Access Control (IAM) with the 'Storage Blob Data Owner' role on the entire storage account.

Answer

Use the storage account connection string in the function app settings and access the blobs using the connection string.

Question 14

A financial services company uses Azure Container Instances (ACI) to run batch processing jobs. Each job processes sensitive financial data and must use a custom container image stored in Azure Container Registry (ACR). The security requirements are: the ACI container must authenticate to ACR using a managed identity, the container must run as a non-root user, and all secrets must be injected via environment variables from Azure Key Vault using the managed identity. The ACI instance must also be deployed into a virtual network (VNet) to restrict network access. What configuration should you use?

Accepted Answer

Create a user-assigned managed identity, assign it to both ACI and ACR (with AcrPull role), grant it Key Vault access, and deploy ACI with the identity and VNet integration.. Option A is correct. User-assigned managed identity can be assigned to ACI and ACR, and can also be used to access Key Vault. Enabling VNet deployment restricts network access. Option B is wrong because system-assigned managed identity cannot be shared between ACI and ACR. Option C is wrong because service principal requires credential management. Option D is wrong because admin credentials are not secure.

Answer

Create a system-assigned managed identity for ACI, assign AcrPull role to the identity, and grant it Key Vault access. Deploy ACI with VNet integration.

Answer

Enable ACR admin account, use admin credentials in ACI, and store secrets in Key Vault with a system-assigned managed identity for ACI.

Answer

Create a service principal, assign AcrPull role and Key Vault access, store the service principal secret in Key Vault, and configure ACI to use the service principal.

Question 15

Your company develops a REST API for a global e-commerce platform that stores product images in Azure Blob Storage. The API uses shared access signatures (SAS) to grant temporary read access to the images. The security team requires that SAS tokens be generated using a user delegation key derived from the application's Microsoft Entra ID credentials, not from the storage account key. Additionally, the SAS must be scoped to a specific container and have a maximum validity of 1 hour. You need to implement the SAS generation in the API using the Azure Storage SDK for .NET. The application authenticates with Microsoft Entra ID using a managed identity assigned to the Azure App Service hosting the API. Which approach should you use?

Accepted Answer

Use the managed identity credentials to create a BlobServiceClient, then call GetUserDelegationKeyAsync to get a key, and then call BlobSasBuilder.GenerateSas using the key.. Option A is correct because it follows the required pattern for generating a user delegation SAS: authenticate with managed identity via a BlobServiceClient, call GetUserDelegationKeyAsync to obtain a key derived from Microsoft Entra ID (not the storage account key), then use BlobSasBuilder with that key to call GenerateSas, which produces a SAS token scoped to a specific container with a 1-hour validity. This meets the security team's requirement of using Entra ID credentials and avoids exposing the storage account key.

Answer

Use the StorageSharedKeyCredential with the storage account key to create a BlobSasBuilder and generate a SAS token.

Answer

Use DefaultAzureCredential to authenticate, then call GenerateUserDelegationSas on the BlobContainerClient.

Answer

Use the managed identity credentials to create a BlobServiceClient, then call GetUserDelegationKeyAsync, then create a BlobSasBuilder with the key and call ToSasQueryParameters.

Question 16

You are a developer for a fintech company. Your application consists of multiple Azure Functions that process sensitive financial transactions. The functions need to access an Azure SQL Database and an Azure Storage account. Security requirements are: (1) No secrets or connection strings should be stored in application settings or code. (2) Access must be restricted to the specific resources each function needs. (3) All access must be audited. (4) The solution must support local development debugging. You have already enabled system-assigned managed identity for each function app. Which course of action should you take to meet the requirements?

Accepted Answer

Grant each function app's system-assigned managed identity access to Azure SQL Database using Microsoft Entra authentication (create contained user) and to Azure Storage using RBAC (Storage Blob Data Contributor role). Enable auditing on SQL and Storage. For local development, use Azure CLI to sign in with your developer account and assign it the same RBAC roles.. Option D is correct because it uses managed identity for Azure SQL (via Microsoft Entra authentication) and RBAC for Storage, satisfying no-secret requirement. It also enables auditing via Azure SQL Auditing and Storage analytics. For local development, you can use Azure CLI or Visual Studio with your developer account that has appropriate RBAC roles. Option A is wrong because it stores connection strings in Key Vault and uses Key Vault references, which still involves retrieving a secret (the connection string) even though it's not in code; the requirement says no secrets should be stored anywhere. Option B is wrong because it uses connection strings in Key Vault and then retrieves them. Option C is wrong because it uses a user-assigned identity but then stores connection strings in Key Vault.

Answer

Assign a user-assigned managed identity to each function app. Grant the identity access to Azure SQL via Microsoft Entra authentication and to Storage via RBAC. Use service principal for local development.

Answer

Use the system-assigned managed identity to access Key Vault, where you store the SQL connection string and storage account key. Use the Key Vault SDK in the function code to retrieve them. Enable Key Vault audit logging.

Answer

Store the SQL connection string and storage account key in Azure Key Vault. Use Key Vault references in function app settings to retrieve them at runtime. Enable Key Vault audit logging.

Question 17

You are deploying a multi-tier application: a frontend web app (Azure App Service) that calls a backend API (another Azure App Service). Both apps use Microsoft Entra ID for authentication. The frontend needs to authenticate to the backend on behalf of the signed-in user. You need to configure the OAuth 2.0 flow correctly. You have already registered both applications in Microsoft Entra ID. Which configuration should you apply?

Accepted Answer

In the frontend app registration, grant API permissions for the backend using the 'Delegated permissions' type. In the backend app registration, expose an API scope. The frontend uses the on-behalf-of flow (OBO) to exchange the user's token for a token to call the backend.. Option B is correct because the on-behalf-of flow (OBO) is designed for this scenario: the frontend receives a token for the user, then exchanges it for a token to call the backend. This requires exposing an API in the backend app registration and granting API permissions from the frontend. Option A is wrong because the client credentials flow is for non-interactive scenarios, not on behalf of a user. Option C is wrong because the authorization code flow alone does not allow the frontend to pass the user's identity to the backend. Option D is wrong because the implicit grant flow is deprecated.

Answer

In the frontend app registration, enable the implicit grant flow for access tokens. The frontend gets a token for the backend directly from the authorization endpoint.

Answer

In the frontend app registration, set the redirect URI to the backend URL. The frontend uses the authorization code flow to get a token for the backend directly.

Answer

In the frontend app registration, grant API permissions for the backend using the 'Application permissions' type. In the backend app registration, expose an API scope. The frontend uses the client credentials flow to get a token for the backend.

Question 18

Your company deploys a microservices architecture on Azure Kubernetes Service (AKS). The application consists of a frontend service, an order service, and a payment service. The order service writes messages to an Azure Service Bus queue, and the payment service processes them. You need to ensure that the payment service can scale independently based on the queue length, and that the processing is fault-tolerant: if the payment service crashes during message processing, the message should not be lost and should be retried. You also need to minimize cost by reducing the number of idle instances. You configure the payment service as an Azure Function triggered by the Service Bus queue. Which configuration options should you set?

Accepted Answer

Set maxDeliveryCount to 5 in the Service Bus queue. Configure the Azure Function's scaling mode to 'Scale based on the number of messages in the queue'.. Setting maxDeliveryCount to 5 ensures that messages are retried up to 5 times if processing fails, which provides fault tolerance. Setting the function scaling mode to 'Scale based on the number of messages in the queue' allows the function to scale out based on queue length, reducing idle instances. Option A is the correct combination. Option B is wrong because using a storage queue instead of Service Bus would require different scaling. Option C is wrong because a fixed instance count would not minimize cost. Option D is wrong because disabling retries would lead to message loss.

Answer

Use an Azure Storage Queue instead of Service Bus. Set the function's batchSize to 10.

Answer

Disable retries completely to avoid duplicate processing.

Answer

Set the function to run on a fixed instance count of 3.

Question 19

Contoso is building a serverless application using Azure Functions. One function needs to read messages from an Azure Event Hub and store them in Azure Blob Storage. The function uses the Event Hubs trigger. The team wants to authenticate to both Event Hubs and Blob Storage using managed identities. The Function app has system-assigned managed identity enabled. Which role assignments are required on the Event Hubs namespace and the storage account?

Accepted Answer

Assign the 'Azure Event Hubs Data Receiver' role to the managed identity on the Event Hubs namespace. Assign the 'Storage Blob Data Contributor' role to the managed identity on the storage account.. For Event Hubs, the managed identity needs 'Azure Event Hubs Data Receiver' role. For Blob Storage, it needs 'Storage Blob Data Contributor' role. Option A is correct. Option B has wrong roles. Option C uses wrong roles. Option D has wrong roles.

Answer

Assign the 'Azure Event Hubs Data Sender' role and 'Storage Blob Data Reader' role.

Answer

Assign the 'Azure Event Hubs Data Reader' role (which does not exist) and 'Storage Blob Data Contributor' role.

Answer

Assign the 'Azure Event Hubs Data Owner' role and 'Storage Blob Data Owner' role.

Question 20

You are a developer at Contoso Ltd. The company has an existing .NET Core web application hosted on Azure App Service that allows users to upload images. The application currently stores images directly to Azure Blob Storage using connection strings stored in the Web.config file. The security team has mandated that all secrets must be stored in Azure Key Vault and rotated automatically. Additionally, the application must be able to access the Key Vault without storing any credentials in the application code or configuration files. The application uses Microsoft Entra ID for user authentication. You need to modify the application to meet these requirements with minimal changes to the application code. You have the following resources: an Azure Key Vault instance with the secrets (storage account connection string) already stored; a managed identity enabled for the App Service. You want to use the Key Vault references feature of Azure App Configuration or direct Key Vault access. Which approach should you take?

Accepted Answer

In the Azure portal, update the App Service application settings to reference the Key Vault secrets using the Key Vault references feature. Enable the system-assigned managed identity for the App Service and grant it Get and List permissions on the Key Vault.. The correct approach is to use Key Vault references in the App Service application settings. This allows you to reference a secret stored in Key Vault using a syntax like @Microsoft.KeyVault(SecretUri=...). The App Service will automatically retrieve the secret using the system-assigned managed identity, and no code changes are required. Option A is correct. Option B is incorrect because using App Configuration would require additional setup and code changes to reference the configuration. Option C is incorrect because manually retrieving secrets via SDK requires code changes. Option D is incorrect because environment variables set directly are not rotated automatically.

Answer

Set the connection string as an environment variable in the App Service using the Azure CLI and rely on the Key Vault backup.

Answer

Create an Azure App Configuration store, import the secrets from Key Vault, and change the application to use the App Configuration provider.

Answer

Modify the application code to use the Azure Identity SDK to authenticate to Key Vault via managed identity and retrieve the connection string.