AZ-204 Develop Azure compute solutions Practice Question
An Azure Container Instance running a claims processing function requires a password at startup. The password must not be visible in the portal or container logs. What should be used?
⚠ Common exam trap
Candidates often confuse 'secure environment variables' with 'plain environment variables' or assume that command-line arguments are not logged, when in fact they are captured in container logs and visible in the portal.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Secure environment variable
Secure environment variables in Azure Container Instances are encrypted at rest and in transit, and are never exposed in the Azure portal, container logs, or to other users. This ensures the password remains confidential while being available to the container at startup, meeting the requirement of not being visible in the portal or logs.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Plain environment variable
Why it's wrong here
Plain environment variables are stored as clear text within the container definition and are readily visible to anyone with access to the Azure portal, API calls, or deployment templates. This direct exposure makes them highly insecure for sensitive data like passwords, as they can be easily retrieved and compromised, violating fundamental security principles for secret management. They offer no protection against accidental or malicious disclosure.
- ✓
Secure environment variable
Why this is correct
Secure environment variables in Azure Container Instances (ACI) are designed to protect sensitive values by encrypting them at rest and masking them from standard display in the Azure portal, logs, and `az container show` output. When defined with the `secureValue` property, ACI ensures that the secret is injected into the container at runtime without being persistently exposed in plain text within the container's configuration. This mechanism significantly reduces the risk of accidental or malicious disclosure, making it the recommended approach for handling secrets directly within ACI.
- ✗
Public blob containing the password
Why it's wrong here
Storing a password in a public Azure Blob Storage container is an extremely insecure practice, as it makes the secret accessible to anyone on the internet who discovers the blob's URL. This approach completely bypasses any container-level security or access controls, essentially broadcasting the sensitive information globally. Such an exposure would lead to an immediate and severe security breach, making it fundamentally unsuitable for secret management in any production environment.
- ✗
Container command-line argument
Why it's wrong here
Passing a password as a command-line argument to a container is highly insecure because these arguments are often visible in process listings (`ps -ef` inside the container or on the host), container logs, and container inspection tools. Anyone with sufficient access to the container runtime environment or its logs could easily retrieve the sensitive information. This method offers no protection against disclosure and is not designed for secure secret handling, making it a significant security vulnerability.
Go deeper
Related to this question
About these practice questions
One of 881 original AZ-204 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.