AZ-204 Develop Azure compute solutions Practice Question
An Azure Container Instance running a webhook processor requires a password at startup. The password must not be visible in the portal or container logs. What should be used?
⚠ Common exam trap
Watch out — candidates often confuse secure environment variables with plain environment variables, assuming both are equally hidden, but only secure environment variables are encrypted and excluded from portal and log visibility.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Secure environment variable
Secure environment variables in Azure Container Instances are encrypted at rest and in transit, and they are not visible in the Azure portal or container logs. This ensures the password is available to the container at startup without exposing it through the portal interface or log output, meeting the security requirement.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Secure environment variable
Why this is correct
A secure environment variable injects the password into the container at runtime without exposing it in the Azure portal or container logs. It satisfies the requirement that the credential stays hidden from both the management interface and log output.
- ✗
Container command-line argument
Why it's wrong here
Command-line arguments are stored in the container configuration and exposed through the portal and logs, violating the secrecy requirement. It tempts because passing parameters at startup is a familiar pattern, and would be correct for non-sensitive configuration values that need to vary between container groups.
- ✗
Public blob containing the password
Why it's wrong here
A public blob exposes the password to anyone with the URL, and retrieval would still surface it in logs or environment configuration. It tempts because blob storage is a convenient external configuration store, and would be correct for non-secret artefacts such as model weights or static configuration files.
- ✗
Plain environment variable
Why it's wrong here
A plain environment variable is readable through the portal's container properties and appears in logs, exposing the password. Environment variables suit non-sensitive configuration such as feature flags or endpoint URLs. The requirement for concealment needs a secure secret reference instead.
Go deeper
Related to this question
About these practice questions
This AZ-204 question is part of Courseiva's 883-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.