AZ-204 Practice Question: System-assigned managed identity for Function App…
The team is writing an Azure Function that needs to retrieve secrets from Azure Key Vault at runtime. The security policy prohibits storing client secrets, connection strings, or certificates in application settings or source code. What is the recommended approach?
⚠ Common exam trap
Test-takers frequently think a client secret or SAS token is acceptable if stored in an Application Setting, but the policy explicitly prohibits storing any secrets in settings or code, making managed identity the only compliant option.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable a system-assigned managed identity on the Function App and grant it Key Vault Secrets User (or Get/List access policy) permission on the vault
A system-assigned managed identity provides a secure, credential-free way for an Azure Function to authenticate to Key Vault. Azure automatically manages the identity's lifecycle and tokens, eliminating the need to store any secrets in application settings or code. The Function App uses the managed identity to obtain an Azure AD token, which it presents to Key Vault to retrieve secrets, fully complying with the security policy.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Enable a system-assigned managed identity on the Function App and grant it Key Vault Secrets User (or Get/List access policy) permission on the vault
Why this is correct
The managed identity removes all credential management from the developer. DefaultAzureCredential automatically detects the managed identity context and requests tokens from the Azure Instance Metadata Service. No secret is ever stored anywhere the developer can access or accidentally expose.
- ✗
Create an App Registration, generate a client secret, store the secret in an Application Setting, and authenticate using ClientSecretCredential
Why it's wrong here
This approach works but violates the security policy — the client secret lives in application settings, which is a form of stored credential. Application settings are visible to anyone with Contributor access to the Function App.
- ✗
Generate a Key Vault SAS token and embed it in the function's connection string setting
Why it's wrong here
Key Vault does not support Shared Access Signature (SAS) tokens for authentication. SAS tokens are a security mechanism specific to Azure Storage accounts, providing delegated access to resources with granular permissions and an expiry time. Key Vault, conversely, relies on Azure Active Directory (Azure AD) for identity-based access control, utilizing OAuth 2.0 bearer tokens for authentication and authorization. Attempting to generate or use a SAS token with Azure Key Vault is fundamentally incompatible with its security model.
- ✗
Use the Key Vault REST API with the vault's access key embedded in the code
Why it's wrong here
Key Vault does not expose access keys in the same way storage accounts do. Access is controlled by Azure AD identity and permissions. Embedding any static credential in code violates the security policy and creates secret rotation and leakage risks.
Go deeper
Related to this question
Learn chapter
Azure Functions Development
Key term
Managed identity
A managed identity is an automatically managed service principal in Azure that allows your code to authenticate to any service that supports Azure AD authentication without storing credentials.
Key term
Key Vault Secrets
Key Vault Secrets are secure containers in Microsoft Azure that store sensitive information like passwords, connection strings, and API keys, keeping them encrypted and accessible only to authorized applications and users.
About these practice questions
One of 881 original AZ-204 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.