AZ-204 Practice Question: Connect to and consume Azure services and third-party services
A company uses Azure Event Hubs to ingest telemetry data from IoT devices. The data is processed by a stream analytics job that outputs to Azure Data Lake Storage Gen2. The developer needs to ensure that the stream analytics job can authenticate to Event Hubs without storing connection strings in code. Which authentication method should the developer use?
⚠ Common exam trap
Many candidates confuse SAS tokens with managed identities, thinking SAS tokens are 'secret-free' because they are generated at runtime, but they still require the SAS key to be stored or generated from a stored key, whereas managed identities eliminate all secret storage entirely.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use Managed Identity
Managed Identity allows the Azure Stream Analytics job to authenticate to Event Hubs without storing any credentials in code or configuration. By enabling a system-assigned or user-assigned managed identity on the Stream Analytics job, it can securely obtain an Azure AD token to access the Event Hubs namespace. This eliminates the need for connection strings or SAS tokens, aligning with the requirement to avoid storing secrets.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use a connection string with the Event Hubs namespace
Why it's wrong here
Using a connection string directly embeds sensitive credentials, typically a Shared Access Key, within application code or configuration files. This practice poses a significant security risk, as these secrets could be exposed if the code repository is compromised or if the application's deployment environment is not adequately secured. Best practices dictate avoiding hardcoding secrets and instead using more secure credential management solutions.
- ✗
Use a client certificate
Why it's wrong here
Authenticating with a client certificate requires the certificate file and its private key to be securely stored and accessible to the application. Managing the lifecycle of these certificates, including their secure distribution, storage in a certificate store (like Azure Key Vault), and timely rotation, introduces operational complexity and potential security vulnerabilities if not handled meticulously. This method still necessitates a secure mechanism for certificate management.
- ✗
Use a Shared Access Signature (SAS) token
Why it's wrong here
A Shared Access Signature (SAS) token grants time-limited, granular access to Azure resources, but it is still a credential that must be generated and securely transmitted to the consuming application. Storing a SAS token directly in application code or configuration files, even if short-lived, exposes it to the same risks as connection strings. The secure generation and distribution of these tokens remain a critical challenge that must be addressed.
- ✓
Use Managed Identity
Why this is correct
Managed Identity for Azure resources provides an automatically managed identity in Azure Active Directory (Azure AD) for Azure services. This eliminates the need for developers to manage credentials, as Azure handles the authentication process securely behind the scenes. The service instance authenticates with Azure AD, which then grants access to other Azure resources like Event Hubs based on assigned roles, significantly enhancing security and simplifying credential management.
Go deeper
Related to this question
Learn chapter
Azure Functions Development
Key term
Key Vault Secrets
Key Vault Secrets are secure containers in Microsoft Azure that store sensitive information like passwords, connection strings, and API keys, keeping them encrypted and accessible only to authorized applications and users.
Key term
Managed identity
A managed identity is an automatically managed service principal in Azure that allows your code to authenticate to any service that supports Azure AD authentication without storing credentials.
About these practice questions
Courseiva writes every AZ-204 question from scratch — 881 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.