Connect to and consume Azure services and third-party services →mediumMultiple ChoiceObjective-mapped
AZ-204 Practice Question: Connect to and consume Azure services and third-party services
A web app uses Azure Key Vault to store secrets. The app runs in a production environment and needs to authenticate to Key Vault without storing connection strings in configuration files. Which authentication method should be used?
⚠ Common exam trap
Test-takers frequently choose a certificate stored in Key Vault (Option D) thinking it is more secure, but they overlook that managed identity eliminates the need to manage any credential at all, which is the core requirement of the question.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Managed identity
Managed identity (Option B) is correct because it allows the web app to authenticate to Azure Key Vault without storing any credentials in code or configuration files. Azure automatically manages the identity for the app, and the app uses the Azure Identity SDK to obtain tokens via the Azure Instance Metadata Service (IMDS) endpoint, which eliminates the need for connection strings or secrets.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Client secret stored in app settings
Why it's wrong here
Storing a client secret directly in application settings, such as environment variables or configuration files, creates a significant security vulnerability. These secrets require manual rotation, are susceptible to accidental exposure through source control commits, or can be accessed by unauthorized personnel with access to the application's hosting environment. This approach shifts the burden of secret management to the developer and introduces a persistent credential that must be meticulously protected throughout its lifecycle.
- ✓
Managed identity
Why this is correct
Managed identity provides an automatically managed identity in Azure Active Directory (AAD) for Azure services, enabling them to authenticate to other AAD-protected services like Key Vault without requiring developers to manage any credentials. Azure automatically handles the creation, rotation, and secure provisioning of these identities, eliminating the need for secrets in application code or configuration. This approach significantly enhances security by removing the burden of credential management and reducing the attack surface.
- ✗
Storage account access keys
Why it's wrong here
Storage account access keys are high-privilege credentials that grant full administrative control over an entire Azure Storage account, including blobs, queues, tables, and files. These keys are specifically designed for authenticating to Azure Storage services and are completely irrelevant for authenticating to Azure Key Vault. Key Vault authentication relies on Azure Active Directory identities and role-based access control (RBAC), not storage-specific access keys.
- ✗
Certificate stored in Key Vault
Why it's wrong here
While certificates can be used for authentication to Azure Key Vault, this method still introduces a bootstrapping problem for the application. The web app would still require a secure mechanism to initially access and present the certificate, which itself might involve a secret or a complex provisioning process. This initial credential management challenge makes certificates less ideal than managed identities, which completely abstract away the credential management for the application.
Go deeper
Related to this question
Learn chapter
Azure Functions Development
Key term
Managed identity
A managed identity is an automatically managed service principal in Azure that allows your code to authenticate to any service that supports Azure AD authentication without storing credentials.
Key term
Key Vault Secrets
Key Vault Secrets are secure containers in Microsoft Azure that store sensitive information like passwords, connection strings, and API keys, keeping them encrypted and accessible only to authorized applications and users.
About these practice questions
One of 881 original AZ-204 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.