AZ-204 Practice Question: Connect to and consume Azure services and third-party services
Avanade is developing a .NET Core console application that runs on an Azure VM. The application needs to read a secret from Azure Key Vault. The VM has a system-assigned managed identity enabled. The managed identity has been granted 'Get' and 'List' permissions on the Key Vault secrets. The code uses the Azure.Identity and Azure.Security.KeyVault.Secrets NuGet packages. Which code snippet should the developer use to authenticate to Key Vault?
⚠ Common exam trap
The trap here is that candidates often pick ManagedIdentityCredential (Option C) thinking it is the most direct choice, but Azure recommends DefaultAzureCredential for production code because it provides automatic fallback and works across local development and Azure environments without code changes.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
var client = new SecretClient(new Uri(keyVaultUrl), new DefaultAzureCredential());
DefaultAzureCredential attempts multiple authentication sources in order, including EnvironmentCredential, ManagedIdentityCredential, and others. Since the VM has a system-assigned managed identity enabled and the code runs in that environment, DefaultAzureCredential will automatically fall through to ManagedIdentityCredential and authenticate using the managed identity's token endpoint. This provides the most flexible and recommended approach for Azure SDK authentication.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
var client = new SecretClient(new Uri(keyVaultUrl), new EnvironmentCredential());
Why it's wrong here
EnvironmentCredential relies solely on specific environment variables (like AZURE_TENANT_ID, AZURE_CLIENT_ID, AZURE_CLIENT_SECRET) for authentication details. It does not inherently detect or utilize a system-assigned managed identity provided by the Azure hosting environment. Therefore, for a console application intended to run on Azure and leverage its managed identity capabilities without manual environment variable setup, this credential type is inappropriate as it lacks the necessary automatic detection mechanisms.
- ✓
var client = new SecretClient(new Uri(keyVaultUrl), new DefaultAzureCredential());
Why this is correct
DefaultAzureCredential is the most robust and recommended choice for applications deployed to Azure. It intelligently attempts to authenticate using a chain of methods, including managed identity, Azure CLI, environment variables, and Visual Studio. When running on an Azure resource with a system-assigned managed identity enabled, it automatically detects and utilizes that identity, eliminating the need for explicit credential management in the application code. This adaptability makes it ideal for production environments.
- ✗
var client = new SecretClient(new Uri(keyVaultUrl), new ManagedIdentityCredential());
Why it's wrong here
Using `ManagedIdentityCredential()` directly is not the most robust approach for a system-assigned managed identity. While it can authenticate using the system-assigned identity if no user-assigned identity is configured via `AZURE_CLIENT_ID`, it lacks the comprehensive fallback mechanisms of `DefaultAzureCredential`. `DefaultAzureCredential` is designed to automatically detect and utilise the environment's available credentials, including system-assigned managed identities on an Azure VM, making it the recommended and most resilient choice for production applications. `ManagedIdentityCredential` is primarily useful when explicitly targeting a specific user-assigned managed identity by its client ID.
- ✗
var client = new SecretClient(new Uri(keyVaultUrl), new ClientSecretCredential(tenantId, clientId, clientSecret));
Why it's wrong here
ClientSecretCredential requires explicit provision of a tenant ID, client ID, and a client secret for authentication. While functional for service principals, this approach necessitates secure storage and rotation of the client secret, introducing operational overhead and potential security risks. It does not leverage the benefits of managed identities, which abstract away credential management and are the preferred secure method for applications hosted on Azure infrastructure.
Go deeper
Related to this question
Learn chapter
Azure Functions Development
Key term
Key Vault Secrets
Key Vault Secrets are secure containers in Microsoft Azure that store sensitive information like passwords, connection strings, and API keys, keeping them encrypted and accessible only to authorized applications and users.
Key term
Blob Storage SDK
The Blob Storage SDK is a set of libraries and tools that lets developers write code to store, access, and manage unstructured data in Microsoft Azure's blob storage service.
About these practice questions
This AZ-204 question is part of Courseiva's 881-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.