Connect to and consume Azure services and third-party services →mediumMultiple ChoiceObjective-mapped
AZ-204 Practice Question: Connect to and consume Azure services and third-party services
A company uses Azure Functions with an HTTP trigger and Azure Cosmos DB. They need to securely store connection strings for Cosmos DB and rotate them automatically every 90 days. Which service should they use?
⚠ Common exam trap
It's easy for candidates to confuse Managed Identity with a secret storage solution, thinking it can store and rotate connection strings, when in reality it only provides an identity for authentication and cannot manage or rotate secrets like a connection string.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure Key Vault
Azure Key Vault is the correct service because it provides a centralized, secure store for secrets like connection strings and supports automatic rotation policies. By storing the Cosmos DB connection string in Key Vault and configuring a rotation policy (e.g., every 90 days), the Azure Function can retrieve the latest secret at runtime via a Key Vault reference in its application settings, ensuring the secret is rotated without code changes or downtime.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Azure Key Vault
Why this is correct
Azure Key Vault is the correct solution for securely storing secrets and managing their lifecycle, including automatic rotation. It provides a centralized, highly secure repository for cryptographic keys, certificates, and secrets like API keys or database connection strings. Azure Functions can securely retrieve these secrets at runtime, and Key Vault's integration capabilities allow for automated secret rotation, enhancing security posture by regularly changing sensitive credentials without manual intervention.
- ✗
Managed Identity
Why it's wrong here
Managed Identity provides an Azure Active Directory identity for Azure resources, allowing them to authenticate to services that support Azure AD authentication without developers needing to manage credentials. While Managed Identities are crucial for securely *accessing* secrets stored in Azure Key Vault, they do not store, manage, or rotate secrets themselves. Their role is solely to provide an identity for authentication, not to handle the lifecycle of secrets.
- ✗
Azure App Configuration
Why it's wrong here
Azure App Configuration is designed for centralizing application settings and feature flags, providing a single place to manage configuration data across various environments. While it can integrate with Azure Key Vault to *reference* secrets, meaning it stores a pointer to a secret in Key Vault, it does not store the secret value itself nor does it offer any capabilities for secret rotation. Its primary function is configuration management, not secure secret storage or lifecycle management.
- ✗
Microsoft Entra ID
Why it's wrong here
Microsoft Entra ID (formerly Azure Active Directory) is Microsoft's cloud-based identity and access management service, responsible for authenticating users and applications and authorizing access to resources. It manages user accounts, groups, and application registrations, providing the foundation for secure access within Azure. However, Entra ID does not provide a mechanism for storing or automatically rotating application-specific secrets like API keys, database connection strings, or other operational credentials; that functionality is handled by services like Azure Key Vault.
Quick reference
Cloud Service Model Comparison
| Model | You Manage | Provider Manages | Examples |
|---|---|---|---|
| IaaS | OS, runtime, apps, data | Hardware, hypervisor, networking | EC2, Azure VMs, GCP Compute Engine |
| PaaS | Apps and data | OS, runtime, middleware, hardware | Elastic Beanstalk, Azure App Service |
| SaaS | Data and settings only | Everything else | Microsoft 365, Salesforce, Workday |
| FaaS / Serverless | Function code only | Infra, scaling, runtime | Lambda, Azure Functions, Cloud Run |
| CaaS | Containers and apps | Kubernetes, OS, hardware | EKS, AKS, GKE |
Go deeper
Related to this question
Learn chapter
Azure Functions Development
Key term
Durable Functions
Durable Functions is an extension of Azure Functions that lets you write stateful workflows in code, managing complex sequences of tasks, retries, and delays automatically.
Key term
Key Vault Secrets
Key Vault Secrets are secure containers in Microsoft Azure that store sensitive information like passwords, connection strings, and API keys, keeping them encrypted and accessible only to authorized applications and users.
About these practice questions
One of 881 original AZ-204 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.