AI-102 Implement an agentic solution Practice Question
You are developing an agentic solution that uses Azure AI Agent Service with a custom function calling tool. The agent needs to call a function that requires authentication to an external API. How should you securely pass the API key to the function?
⚠ Common exam trap
Many candidates choose environment variables (Option C) because they seem 'secure enough' in local development, but Azure explicitly tests that environment variables are not considered secure for production secrets in cloud-native solutions, especially when audit trails and fine-grained access control are required.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use Azure Key Vault to store the API key and reference it in the function
Azure Key Vault provides a secure, centralized service for storing and managing secrets like API keys. In Azure AI Agent Service, you can configure the function to retrieve the API key at runtime from Key Vault using managed identities, ensuring the key is never exposed in code, configuration, or prompts. This follows the principle of least privilege and aligns with Azure's security best practices for agentic solutions.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Hardcode the API key in the function code
Why it's wrong here
Hardcoding is a security risk and not recommended.
- ✓
Use Azure Key Vault to store the API key and reference it in the function
Why this is correct
Key Vault provides secure secret storage and retrieval.
- ✗
Store the API key in an environment variable
Why it's wrong here
Environment variables can be exposed in logs or configurations.
- ✗
Pass the API key as part of the agent's system prompt
Why it's wrong here
Passing secrets in prompts is insecure and may be logged.
Go deeper
Related to this question
About these practice questions
This AI-102 question is part of Courseiva's 945-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AI-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AI-102 exam.