AZ-204 Practice Question: Connect to and consume Azure services and third-party services
A developer needs to deploy a web app that uses Azure SQL Database. They want to connect to the database using a connection string without storing it in code. Which feature of Azure App Service should they use?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Key Vault references
Key Vault references in Azure App Service allow the web app to securely retrieve secrets, such as connection strings, from Azure Key Vault. This is considered a best practice for managing sensitive information, as Key Vault provides centralized secret management, access control, auditing, and secret rotation capabilities. The App Service can resolve these references at runtime, injecting the secret into the application as an environment variable without storing it directly in the App Service configuration or code. Option C (Application settings) can store connection strings and are encrypted at rest, but Key Vault offers superior security and management features specifically for secrets. Option B (Environment variables) are not a persistent or managed solution for configuration in App Service. Option D (Azure App Configuration) is a centralized configuration service, but Key Vault is specifically designed for secrets and is more directly integrated for this purpose with App Service via references.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Key Vault references
Why this is correct
Key Vault references are a feature of Azure App Service that allow referencing secrets from Azure Key Vault. While they can be used for connection strings, they require additional setup and are not the simplest built-in feature for this purpose.
- ✗
Environment variables
Why it's wrong here
Environment variables in Azure App Service are not a persistent configuration feature; they are typically set through application settings. Directly setting environment variables at runtime does not persist across restarts, making them unreliable for connection strings.
- ✗
Application settings
Why it's wrong here
Application settings in Azure App Service allow storing connection strings and other configuration values as key-value pairs that are encrypted at rest. They are injected as environment variables at runtime, making them accessible without hard-coding. This is the simplest built-in feature for storing connection strings.
- ✗
Azure App Configuration
Why it's wrong here
Azure App Configuration fails here because it is a centralised configuration store, but retrieving secrets like connection strings from it generally requires application code to query its API or integration with Azure Key Vault for secure access. It does not directly inject the connection string into the App Service's runtime environment variables without code interaction. This option is tempting as it manages configuration, and it is ideal for dynamic configuration management, feature flags, and centralising settings across multiple applications or microservices.
Visual reference
Go deeper
Related to this question
Learn chapter
Azure Functions Development
Key term
Azure App Configuration
Azure App Configuration is a managed Azure service that stores and manages application settings and feature flags separately from your code, allowing you to update them without redeploying or restarting your application.
Key term
Key Vault Secrets
Key Vault Secrets are secure containers in Microsoft Azure that store sensitive information like passwords, connection strings, and API keys, keeping them encrypted and accessible only to authorized applications and users.
About these practice questions
This AZ-204 question is part of Courseiva's 881-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.