Azure Key Vault Secret Rotation for Connection Strings
You have an Azure App Service web app that uses Azure SQL Database. The connection string is stored in Azure Key Vault. You need to automatically rotate the database password every 30 days without app downtime. Which solution should you implement?
Quick Answer
The correct solution is to store the connection string as a Key Vault reference in App Service application settings and use Key Vault’s auto-rotation feature. This works because Key Vault references are resolved at runtime by the App Service platform, so when the secret rotates in Key Vault, the app picks up the new value instantly without requiring a restart or redeployment. On the AZ-204 exam, this scenario tests your understanding of how to manage secrets in a serverless or PaaS environment while maintaining zero downtime—a common trap is assuming you must update the connection string in code or via CLI, which would break the automatic rotation requirement. Remember that Key Vault references in App Service settings act as a live pointer, not a static copy, so the app always pulls the latest secret. Memory tip: think “reference, not refresh”—the app references the vault, so rotation is seamless.
⚠ Common exam trap
A common mix-up: candidates think Managed Identity (Option C) is a valid rotation solution, but it eliminates the password entirely rather than rotating it, failing the explicit requirement to rotate the database password every 30 days.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Store the connection string as a Key Vault reference in App Service application settings and use Key Vault's auto-rotation.
Key Vault references in App Service application settings allow the web app to dynamically retrieve the connection string from Key Vault at runtime. By enabling Key Vault's auto-rotation feature (e.g., using a rotation function or event grid trigger), the database password can be rotated every 30 days without any app downtime, as the app reads the latest secret on each request or after a cached secret expires.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Store the connection string as a Key Vault reference in App Service application settings and use Key Vault's auto-rotation.
Why this is correct
Key Vault reference updates automatically without restart.
- ✗
Use Azure CLI to update the connection string in App Service settings.
Why it's wrong here
Requires manual update, no automatic rotation.
- ✗
Use Managed Identity to access SQL Database instead of a password.
Why it's wrong here
Avoids password but does not rotate it.
- ✗
Update the connection string in the application code and redeploy.
Why it's wrong here
Requires redeployment, causes downtime.
Go deeper
Related to this question
About these practice questions
One of 881 original AZ-204 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on AZ-204
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company uses Azure Functions with an HTTP trigger and Azure Cosmos DB. They need to securely store connection strings for Cosmos DB and rotate them automatically every 90 days. Which service should they use?
medium- ✓ A.Azure Key Vault
- B.Managed Identity
- C.Azure App Configuration
- D.Microsoft Entra ID
Why A: Azure Key Vault is the correct service because it provides a centralized, secure store for secrets like connection strings and supports automatic rotation policies. By storing the Cosmos DB connection string in Key Vault and configuring a rotation policy (e.g., every 90 days), the Azure Function can retrieve the latest secret at runtime via a Key Vault reference in its application settings, ensuring the secret is rotated without code changes or downtime.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.