Connect to and consume Azure services and third-party services →mediumMultiple ChoiceObjective-mapped
AZ-204 Practice Question: Connect to and consume Azure services and third-party services
A company uses Azure Logic Apps to integrate with a third-party CRM system. The CRM API requires OAuth 2.0 authentication. The developer needs to securely store the client secret and refresh token. Which Azure service should the developer use?
⚠ Common exam trap
Candidates often confuse Azure Managed Identity with a secret storage solution, not realizing that Managed Identity is an authentication mechanism for Azure resources, not a service for storing arbitrary secrets like OAuth client secrets or refresh tokens.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure Key Vault
Azure Key Vault is the correct service because it provides a secure, centralized store for secrets such as client secrets and refresh tokens. By storing these sensitive values in Key Vault, the developer can reference them in the Logic App workflow using the Key Vault connector, ensuring that secrets are never exposed in code or configuration. This aligns with the OAuth 2.0 requirement to protect long-lived credentials like refresh tokens.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Azure App Configuration
Why it's wrong here
Azure App Configuration is designed for centralized management of application settings and feature flags, allowing for dynamic configuration updates without redeploying applications. While it stores configuration data, it is not built with the same level of security and access control mechanisms as a dedicated secret store like Key Vault, making it unsuitable for highly sensitive data such as third-party OAuth secrets or API keys. Its primary purpose is configuration, not cryptographic protection of credentials.
- ✓
Azure Key Vault
Why this is correct
Azure Key Vault is the dedicated Azure service for securely storing and managing cryptographic keys, certificates, and secrets, including API keys, connection strings, and OAuth tokens. It provides robust security features such as hardware security module (HSM)-backed protection, granular access policies, and comprehensive auditing capabilities. Logic Apps can seamlessly integrate with Key Vault to retrieve these secrets at runtime, ensuring credentials are never exposed in application code or configuration.
- ✗
Azure Managed Identity
Why it's wrong here
Azure Managed Identity provides an automatically managed identity for Azure services in Azure Active Directory, enabling them to authenticate to other Azure AD-protected services without developers needing to manage credentials. However, Managed Identity itself is an identity provider, not a secret storage solution. It would typically be used to grant a Logic App access to retrieve secrets from Key Vault, rather than storing third-party OAuth secrets directly within the Managed Identity service.
- ✗
Azure SQL Database
Why it's wrong here
Azure SQL Database is a relational database service primarily used for storing structured data, executing queries, and managing transactional workloads. While it can technically store any data, it lacks the specialized security features, access controls, and audit trails specifically designed for the secure management of highly sensitive secrets like OAuth tokens. Using a database for secret storage is a security anti-pattern, as it does not provide the necessary protection against unauthorized access or compromise.
Go deeper
Related to this question
About these practice questions
This AZ-204 question is part of Courseiva's 881-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.