AZ-204 Practice Question: Connect to and consume Azure services and third-party services
A developer needs to call a third-party REST API from an Azure Function app. The API requires OAuth2 client credentials flow. Which approach should they use to securely store and retrieve the client secret?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Store in Azure Key Vault
Azure Key Vault is the secure store for secrets like client secrets. Option A is wrong because environment variables are not secure. Option B is wrong because App Configuration is for configuration. Option D is wrong because Managed Identity does not store secrets; it provides identity.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Store in application settings as environment variable
Why it's wrong here
Storing the client secret in application settings as an environment variable is not secure because environment variables can be exposed through runtime diagnostics, logs, or configuration dumps. Azure Key Vault should be used instead.
- ✗
Store in Azure App Configuration
Why it's wrong here
Azure App Configuration is designed for configuration management, not secret storage. It lacks fine-grained access control and auditing capabilities necessary for securing client secrets.
- ✓
Store in Azure Key Vault
Why this is correct
Azure Key Vault is the correct service for securely storing and managing client secrets. It provides access policies, auditing, and integration with Azure Functions via managed identity or direct access.
- ✗
Use Managed Identity
Why it's wrong here
Managed Identity provides an identity for the function app to authenticate to Azure services, but it does not store secrets. The client secret must be stored in a secure vault like Azure Key Vault, and the managed identity can be used to access it.
Go deeper
Related to this question
Learn chapter
Azure Functions Development
Key term
Managed identity
A managed identity is an automatically managed service principal in Azure that allows your code to authenticate to any service that supports Azure AD authentication without storing credentials.
Key term
Key Vault Secrets
Key Vault Secrets are secure containers in Microsoft Azure that store sensitive information like passwords, connection strings, and API keys, keeping them encrypted and accessible only to authorized applications and users.
About these practice questions
Courseiva writes every AZ-204 question from scratch — 881 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on AZ-204
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. You need to call a third-party REST API from your Azure Function app. The API requires an API key in the header. Where should you store the API key to keep it secure?
easy- A.Environment variable in the hosting plan
- ✓ B.Azure Key Vault
- C.Connection string in the Function app
- D.App settings in the Function app configuration
Why B: Azure Key Vault is the correct choice because it provides a centralized, secure store for secrets like API keys, with access control via Azure AD and automatic rotation capabilities. The Function app can securely retrieve the key at runtime using a managed identity, avoiding hardcoding or exposing the secret in configuration files or environment variables.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.