AZ-204 Practice Question: Connect to and consume Azure services and third-party services
A developer needs to deploy a web app that uses Azure SQL Database. They want to connect to the database using a connection string without storing it in code. Which feature of Azure App Service should they use?
⚠ Common exam trap
AZ-204 often tests whether candidates know that App Service application settings are not a secure secret store, and that Key Vault references require a managed identity with appropriate RBAC permissions to resolve.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Key Vault references
Key Vault references in Azure App Service allow an app setting to point to a secret stored in Azure Key Vault, so the connection string is never stored in code or in plaintext app settings. The App Service resolves the reference at runtime using the app's managed identity, which must have GET permission on the Key Vault secret. This is the recommended pattern for injecting secrets into App Service without hardcoding them.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Key Vault references
Why this is correct
Key Vault references are a feature of Azure App Service that allow referencing secrets from Azure Key Vault. While they can be used for connection strings, they require additional setup and are not the simplest built-in feature for this purpose.
- ✗
Environment variables
Why it's wrong here
Environment variables in Azure App Service are not a persistent configuration feature; they are typically set through application settings. Directly setting environment variables at runtime does not persist across restarts, making them unreliable for connection strings.
- ✗
Application settings
Why it's wrong here
Application settings in Azure App Service allow storing connection strings and other configuration values as key-value pairs that are encrypted at rest. They are injected as environment variables at runtime, making them accessible without hard-coding. This is the simplest built-in feature for storing connection strings.
- ✗
Azure App Configuration
Why it's wrong here
Azure App Configuration fails here because it is a centralised configuration store, but retrieving secrets like connection strings from it generally requires application code to query its API or integration with Azure Key Vault for secure access. It does not directly inject the connection string into the App Service's runtime environment variables without code interaction. This option is tempting as it manages configuration, and it is ideal for dynamic configuration management, feature flags, and centralising settings across multiple applications or microservices.
Visual reference
Go deeper
Related to this question
Learn chapter
Service Bus Dead-Letter Queues
Key term
Managed identity
A managed identity is an automatically managed service principal in Azure that allows your code to authenticate to any service that supports Microsoft Entra ID authentication without storing credentials.
Key term
Key Vault Secrets
Key Vault Secrets are secure containers in Microsoft Azure that store sensitive information like passwords, connection strings, and API keys, keeping them encrypted and accessible only to authorized applications and users.
About these practice questions
This AZ-204 question is part of Courseiva's 883-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Microsoft exam blueprint
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.