AZ-204 Implement Azure security Practice Question
A company stores secrets in Azure Key Vault. Developers need to retrieve secrets from a web app without storing connection strings in code. Which authentication method should the web app use?
⚠ Common exam trap
Watch out — candidates often confuse managed identities with service principals, assuming a service principal with a client secret is the simplest approach, but they overlook that the client secret itself must be stored somewhere, violating the 'no secrets in code' requirement.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable a managed identity for the web app
Managed identities for Azure resources provide an automatically managed identity in Azure AD, allowing the web app to authenticate to Key Vault without any credentials in code. The web app obtains an Azure AD access token directly from the Azure Instance Metadata Service (IMDS) endpoint, which Key Vault accepts. This eliminates the need to store connection strings, client secrets, or certificates in the application.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Register a service principal and use a client secret
Why it's wrong here
Registering a service principal and using a client secret for authentication to Azure Key Vault is a valid method, but it introduces a significant security vulnerability. The client secret itself becomes a credential that must be securely stored and rotated within the web application's configuration, potentially exposing it if not handled meticulously. This approach defeats the primary benefit of Key Vault, which is to centralize and secure secrets without embedding them directly in application code or configuration.
- ✓
Enable a managed identity for the web app
Why this is correct
Enabling a managed identity for the web app is the recommended and most secure approach for accessing Azure Key Vault. A managed identity provides an automatically managed identity in Azure Active Directory for the application, allowing it to authenticate to Key Vault without any developer needing to manage credentials, secrets, or certificates. Azure handles the lifecycle of this identity, including its authentication tokens, significantly reducing the attack surface and operational overhead associated with secret management.
- ✗
Use a shared access signature (SAS) token
Why it's wrong here
Shared Access Signature (SAS) tokens are a mechanism specifically designed to grant limited, time-bound access to resources within Azure Storage accounts, such as blobs, queues, tables, or files. They provide a way to delegate access without sharing account keys. However, SAS tokens are not a valid authentication or authorization mechanism for Azure Key Vault, which relies on Azure Active Directory for identity-based access control to its secrets, keys, and certificates.
- ✗
Use a certificate thumbprint in the app settings
Why it's wrong here
While certificates can be used for authentication with Azure Active Directory, specifically when configuring a service principal for certificate-based authentication, merely placing a certificate thumbprint in the app settings is insufficient. The application would still require access to the private key of the corresponding certificate to establish its identity. Storing the private key securely and managing its lifecycle within the application itself introduces similar credential management challenges as client secrets, making it less ideal than managed identities.
Go deeper
Related to this question
Learn chapter
Azure Functions Development
Key term
Managed identity
A managed identity is an automatically managed service principal in Azure that allows your code to authenticate to any service that supports Azure AD authentication without storing credentials.
Key term
Key Vault Secrets
Key Vault Secrets are secure containers in Microsoft Azure that store sensitive information like passwords, connection strings, and API keys, keeping them encrypted and accessible only to authorized applications and users.
About these practice questions
Courseiva writes every AZ-204 question from scratch — 881 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.