AZ-204 Practice Question: Connect to and consume Azure services and third-party services
Adventure Works is developing a payment processing system on Azure. The system uses an Azure Service Bus queue to decouple the frontend from the backend. The frontend sends a message to the queue. A backend service, running as an Azure WebJob, processes the message and calls a third-party payment gateway via HTTPS. The backend must authenticate to the payment gateway using a client certificate stored in Azure Key Vault. The WebJob must be able to access the certificate without storing any secrets in configuration. The WebJob runs in an App Service plan with system-assigned managed identity enabled. Which approach should the team use to retrieve the certificate and authenticate to the payment gateway?
⚠ Common exam trap
Many candidates think storing a certificate thumbprint in application settings is acceptable, but that still requires the certificate to be present in the App Service certificate store, which bypasses Key Vault and introduces a secret management issue.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
In the WebJob code, use SecretClient from Azure.Security.KeyVault.Secrets to retrieve the certificate as a secret. Parse the secret value to X509Certificate2. Use the certificate in HttpClientHandler to call the payment gateway.
The WebJob can use its system-assigned managed identity to authenticate to Azure Key Vault without storing any secrets. The SecretClient from Azure.Security.KeyVault.Secrets retrieves the certificate as a secret, which can be parsed into an X509Certificate2 object. This certificate is then used in an HttpClientHandler to authenticate to the payment gateway via HTTPS, fulfilling all requirements securely.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
In the WebJob code, use SecretClient from Azure.Security.KeyVault.Secrets to retrieve the certificate as a secret. Parse the secret value to X509Certificate2. Use the certificate in HttpClientHandler to call the payment gateway.
Why this is correct
Correct: uses managed identity to retrieve certificate from Key Vault.
- ✗
Store the certificate as a .pfx file in a blob container with a SAS token. Download the blob using the SAS token and load the certificate.
Why it's wrong here
Incorrect: uses SAS token, not managed identity.
- ✗
Create a service principal with a client secret, store the secret in Key Vault. Use ClientSecretCredential to authenticate to Key Vault and retrieve the certificate.
Why it's wrong here
Incorrect: uses service principal with secret, not managed identity.
- ✗
Store the certificate thumbprint in application settings. Use the Azure App Service certificate store to load the certificate by thumbprint.
Why it's wrong here
Incorrect: requires the certificate to be uploaded to App Service, not from Key Vault.
Go deeper
Related to this question
Learn chapter
Azure Functions Development
Key term
Managed identity
A managed identity is an automatically managed service principal in Azure that allows your code to authenticate to any service that supports Azure AD authentication without storing credentials.
Key term
Azure Relay
Azure Relay is a cloud service that securely exposes on-premises web services to the public internet or other cloud applications without opening firewall ports.
About these practice questions
One of 881 original AZ-204 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.