AZ-204 Practice Question: Connect to and consume Azure services and third-party services
A web app needs to access Azure Key Vault secrets for database credentials. The app runs as a managed identity in Azure App Service. Which authentication method should be used to retrieve secrets without storing credentials in the app code?
⚠ Common exam trap
Watch out — candidates often confuse managed identity with other credential-based methods like access keys or client certificates, not realizing that managed identity is the only option that completely eliminates the need to store any credentials in the app code or configuration.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Managed identity
Managed identity is the correct authentication method because it allows the Azure App Service web app to authenticate to Azure Key Vault without storing any credentials in code or configuration. Azure automatically manages the identity, and the app uses a token from the Azure Instance Metadata Service (IMDS) endpoint to access Key Vault secrets. This aligns with the principle of zero-trust and eliminates the security risk of hardcoded secrets.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Managed identity
Why this is correct
Managed identities for Azure resources provide an automatically managed identity in Azure Active Directory (Azure AD) for applications to use when connecting to resources that support Azure AD authentication. This eliminates the need for developers to manage credentials, as Azure handles the lifecycle of the identity. The web app can be granted specific permissions to Key Vault secrets directly via Azure AD role-based access control (RBAC), ensuring secure and credential-free access. This is the recommended and most secure approach for Azure-hosted applications.
- ✗
Access key
Why it's wrong here
Using an access key would involve generating a static secret or key directly for the web app and storing it within the application's configuration, such as app settings or environment variables. This approach introduces significant security vulnerabilities, as these keys could be accidentally exposed in source control, logs, or compromised during deployment. Furthermore, managing the rotation and revocation of these static keys adds unnecessary operational overhead and increases the risk of outages if not handled meticulously.
- ✗
Client certificate
Why it's wrong here
Authenticating with a client certificate requires the web app to possess and present a valid X.509 certificate, including its private key, to Azure Key Vault. While certificates offer strong authentication, they introduce considerable operational complexity related to their lifecycle management, including secure issuance, timely renewal, and proper revocation. The private key itself must be securely stored and protected within the application environment, which can be challenging and less secure than Azure-managed credentials.
- ✗
Shared access signature (SAS) token
Why it's wrong here
A Shared Access Signature (SAS) token is a security mechanism specifically designed for granting time-limited, delegated access to resources within Azure Storage accounts, such as blobs, queues, tables, and files. It provides granular control over what a client can access and for how long, without sharing the storage account key. However, Azure Key Vault operates on a fundamentally different security model, primarily relying on Azure Active Directory (Azure AD) for authentication and authorization, and does not support SAS tokens for accessing its secrets, keys, or certificates.
Go deeper
Related to this question
Learn chapter
Azure Functions Development
Key term
Key Vault Secrets
Key Vault Secrets are secure containers in Microsoft Azure that store sensitive information like passwords, connection strings, and API keys, keeping them encrypted and accessible only to authorized applications and users.
Key term
Managed identity
A managed identity is an automatically managed service principal in Azure that allows your code to authenticate to any service that supports Azure AD authentication without storing credentials.
About these practice questions
One of 881 original AZ-204 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.