AZ-204 Implement Azure security Practice Question
A company uses Azure Functions to process sensitive customer data. The functions are triggered by Service Bus messages. The security requirements mandate that all function code must be encrypted in transit and at rest, and that access to the function must be authenticated using Microsoft Entra ID. Which TWO configurations should be implemented? (Choose two.)
⚠ Common exam trap
A common mix-up: candidates confuse 'HTTP/2' with encryption, but HTTP/2 does not mandate TLS; it can run over cleartext (h2c), whereas 'HTTPS Only' is the specific setting that enforces encryption in transit.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure the function app's authentication to 'Microsoft Entra ID' with 'Require authentication' set to 'On'.
Option B is correct because configuring the function app's authentication provider to Microsoft Entra ID with 'Require authentication' set to On ensures that all inbound requests to the function are authenticated via Entra ID, satisfying the mandate that access to the function be authenticated using Microsoft Entra ID. Option C is correct because enabling the 'HTTPS Only' setting forces all traffic to the function app to use TLS, thereby enforcing encryption in transit as required. Option A is incorrect because setting the action to 'Allow anonymous requests' would permit unauthenticated access, directly violating the Entra ID authentication requirement. Option D is incorrect because using Service Bus managed identity with access keys does not authenticate access to the function itself with Entra ID, and access keys are a shared-secret mechanism rather than Entra ID authentication. Option E is incorrect because setting HTTP version to HTTP/2 does not provide encryption; HTTP/2 can run over plaintext, and encryption in transit is achieved through HTTPS/TLS, not the HTTP protocol version.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable 'App Service Authentication' and set the action to 'Allow anonymous requests'.
Why it's wrong here
Enabling App Service Authentication is a correct first step, but setting the action to 'Allow anonymous requests' fundamentally defeats the purpose of securing sensitive data. This configuration permits unauthenticated access to the function app, meaning any client can invoke the function without proving its identity. For processing sensitive customer data, this approach introduces a critical security vulnerability, as it provides no mechanism to restrict access to authorized users or services.
- ✓
Configure the function app's authentication to 'Microsoft Entra ID' with 'Require authentication' set to 'On'.
Why this is correct
Configuring the function app to use Microsoft Entra ID for authentication, combined with setting 'Require authentication' to 'On', is a robust security measure. This ensures that only requests presenting a valid token issued by Microsoft Entra ID will be authorized to invoke the function. By integrating with Entra ID, the function app leverages a centralized identity management system, allowing granular control over who can access the sensitive customer data processing logic, thereby enforcing strong authentication and authorization policies.
- ✓
Set the function app's 'HTTPS Only' setting to 'On' to enforce encryption in transit.
Why this is correct
Setting the function app's 'HTTPS Only' configuration to 'On' is essential for protecting sensitive customer data by enforcing encryption for all data transmitted between clients and the function app. This ensures that all communication occurs over TLS/SSL, preventing eavesdropping and tampering with data in transit. Without HTTPS enforcement, data could be intercepted and read in plain text, compromising the confidentiality and integrity of sensitive information during its journey across the network.
- ✗
Use Service Bus managed identity with access keys for authentication.
Why it's wrong here
While managed identities are a secure way for Azure services to authenticate to other Azure services (like a Function App accessing Service Bus), this option incorrectly suggests using Service Bus managed identity *with access keys* for *function app authentication*. Access keys are static credentials that are difficult to manage securely and do not leverage Microsoft Entra ID for client authentication to the function app itself. This approach introduces security risks by relying on shared secrets instead of robust identity-based authentication for incoming requests to the function.
- ✗
Set the function app's 'HTTP version' to 'HTTP/2' to improve encryption.
Why it's wrong here
Setting the function app's 'HTTP version' to 'HTTP/2' primarily improves performance through features like multiplexing and header compression, but it does not inherently improve or enforce encryption. Encryption is provided by the underlying TLS/SSL protocol, which is enabled by HTTPS. Relying on HTTP/2 alone without enforcing HTTPS would still leave sensitive data vulnerable to interception and exposure, as HTTP/2 can operate over both secure (HTTPS) and insecure (HTTP) connections.
Quick reference
Cloud Service Model Comparison
| Model | You Manage | Provider Manages | Examples |
|---|---|---|---|
| IaaS | OS, runtime, apps, data | Hardware, hypervisor, networking | EC2, Azure VMs, GCP Compute Engine |
| PaaS | Apps and data | OS, runtime, middleware, hardware | Elastic Beanstalk, Azure App Service |
| SaaS | Data and settings only | Everything else | Microsoft 365, Salesforce, Workday |
| FaaS / Serverless | Function code only | Infra, scaling, runtime | Lambda, Azure Functions, Cloud Run |
| CaaS | Containers and apps | Kubernetes, OS, hardware | EKS, AKS, GKE |
Go deeper
Related to this question
Learn chapter
App Service VNet Integration and Private Endpoints
Key term
Managed identity
A managed identity is an automatically managed service principal in Azure that allows your code to authenticate to any service that supports Microsoft Entra ID authentication without storing credentials.
Key term
Azure Functions Bindings
Azure Functions Bindings are declarative connections that link your serverless function code to Azure services or external resources, handling input and output data automatically without writing extra networking or authentication code.
About these practice questions
This AZ-204 question is part of Courseiva's 883-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.