Connect to and consume Azure services and third-party services →mediumMultiple SelectObjective-mapped
Three Steps to Authenticate to Key Vault from App Service
Which THREE actions should you take to securely access Azure Key Vault from an Azure App Service? (Choose three.)
Quick Answer
The correct answer is to use DefaultAzureCredential in the application code, enable managed identity on the App Service, and grant that identity the Key Vault Secrets User role. This approach works because managed identity eliminates the need for storing credentials in code or configuration—Azure automatically rotates the identity’s tokens, while DefaultAzureCredential seamlessly picks up the App Service’s managed identity at runtime without any explicit connection strings. On the AZ-204 exam, this scenario tests your understanding of identity-based authentication versus secret-based methods; a common trap is choosing to store a connection string in app settings, which violates the principle of zero-trust secrets management. Remember that managed identity plus DefaultAzureCredential is the modern, secure pattern for Azure resources talking to each other. A useful memory tip: “M.I.D. for Key Vault”—Managed Identity, IAM role assignment, and DefaultAzureCredential.
⚠ Common exam trap
A common mix-up: candidates think network restrictions (Option A) are sufficient for security, but they overlook the dynamic nature of App Service outbound IPs and the need for identity-based access control, leading them to choose a less secure and less reliable option.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Grant the managed identity the 'Key Vault Secrets User' role.
Granting the managed identity the 'Key Vault Secrets User' role uses Azure RBAC to authorize the App Service to read secrets from Key Vault without requiring any keys or secrets to be stored in the application. This aligns with the principle of least privilege and eliminates the need for client secrets or certificates in code or configuration.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Configure network restrictions on the Key Vault to allow only the App Service's outbound IP.
Why it's wrong here
Network restrictions are not required; managed identity and RBAC provide sufficient security.
- ✓
Grant the managed identity the 'Key Vault Secrets User' role.
Why this is correct
This role allows reading secrets from Key Vault.
- ✓
Enable managed identity on the App Service.
Why this is correct
Managed identity allows the App Service to authenticate to Key Vault without credentials.
- ✓
Use DefaultAzureCredential in the application code.
Why this is correct
DefaultAzureCredential automatically uses the managed identity when running in Azure.
- ✗
Store the Key Vault URL and a client secret in App Service application settings.
Why it's wrong here
Storing client secrets in settings defeats the purpose of using managed identity.
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
Azure Functions Development
Key term
Managed identity
A managed identity is an automatically managed service principal in Azure that allows your code to authenticate to any service that supports Azure AD authentication without storing credentials.
Key term
Key Vault Secrets
Key Vault Secrets are secure containers in Microsoft Azure that store sensitive information like passwords, connection strings, and API keys, keeping them encrypted and accessible only to authorized applications and users.
About these practice questions
This AZ-204 question is part of Courseiva's 881-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on AZ-204
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. You are developing an ASP.NET Core application that needs to access Azure Key Vault to retrieve secrets. You have enabled a managed identity for the App Service. Which Azure SDK class should you use to authenticate to Key Vault?
easy- ✓ A.DefaultAzureCredential
- B.ClientSecretCredential
- C.ManagedIdentityCredential
- D.InteractiveBrowserCredential
Why A: DefaultAzureCredential is the recommended approach because it provides a chained authentication mechanism that attempts multiple credential types in order, including ManagedIdentityCredential, EnvironmentCredential, and others. When running in an Azure App Service with a managed identity enabled, DefaultAzureCredential will automatically use the managed identity to authenticate to Key Vault, making it the most flexible and future-proof choice for this scenario.
Variation 2. A web app needs to access Azure Key Vault secrets for database credentials. The app runs as a managed identity in Azure App Service. Which authentication method should be used to retrieve secrets without storing credentials in the app code?
easy- ✓ A.Managed identity
- B.Access key
- C.Client certificate
- D.Shared access signature (SAS) token
Why A: Managed identity is the correct authentication method because it allows the Azure App Service web app to authenticate to Azure Key Vault without storing any credentials in code or configuration. Azure automatically manages the identity, and the app uses a token from the Azure Instance Metadata Service (IMDS) endpoint to access Key Vault secrets. This aligns with the principle of zero-trust and eliminates the security risk of hardcoded secrets.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.