Connect to and consume Azure services and third-party services →mediumMultiple ChoiceObjective-mapped
AZ-204 Practice Question: Connect to and consume Azure services and third-party services
You are building a mobile app backend using Azure Functions. The function must send push notifications to devices using the Notification Hubs service. You need to authenticate the function to Notification Hubs using the principle of least privilege. What should you use?
⚠ Common exam trap
Many exam-takers confuse managed identities with SAS tokens or connection strings, thinking any form of shared secret is acceptable, but the principle of least privilege demands a secretless, identity-based approach that only managed identities provide.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use a managed identity assigned to the Function App to access Notification Hubs.
Using a managed identity assigned to the Function App allows it to authenticate to Azure Notification Hubs without storing any credentials in code or configuration. This follows the principle of least privilege by granting only the necessary permissions (e.g., via Azure RBAC role assignments like 'Notification Hubs Data Sender') and eliminates the risk of connection string leakage. Managed identities are the recommended approach for Azure services to securely access other Azure resources.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Store the Notification Hubs connection string in Application Settings.
Why it's wrong here
Storing the full Notification Hubs connection string in Application Settings grants the Azure Function broad, often unrestricted, access to the hub, typically including management permissions. This approach violates the principle of least privilege, as the function usually only requires specific permissions like sending notifications. Furthermore, it necessitates managing a secret that must be secured, rotated, and protected from exposure, increasing the overall security risk compared to secretless authentication methods.
- ✓
Use a managed identity assigned to the Function App to access Notification Hubs.
Why this is correct
Managed identities provide an automatically managed identity in Microsoft Entra ID for Azure services, eliminating the need for developers to manage credentials. Assigning a system-assigned or user-assigned managed identity to the Function App allows it to authenticate to Azure Notification Hubs without storing any secrets. This approach enables fine-grained access control through Azure RBAC, where specific roles, such as 'Azure Notification Hubs Data Sender' or 'Contributor', can be assigned to the managed identity, ensuring the function operates with the principle of least privilege for its required operations.
- ✗
Create a shared access signature (SAS) token for the Notification Hub.
Why it's wrong here
Creating and managing Shared Access Signature (SAS) tokens directly within the Function App, while a functional method for Notification Hubs, introduces significant security and operational overhead. SAS tokens are time-limited credentials granting specific permissions, which means they must be securely stored, regularly rotated, and their expiration carefully managed. This manual credential lifecycle management increases the risk of exposure and does not leverage Microsoft Entra ID for centralized identity management or fine-grained role-based access control, making it less secure than managed identities.
- ✗
Use Microsoft Entra ID OAuth 2.0 client credentials flow.
Why it's wrong here
Microsoft Entra ID OAuth 2.0 client credentials flow is incorrect because Notification Hubs does not support Microsoft Entra ID authentication for sending push notifications from a backend service like an Azure Function. Instead, Notification Hubs relies on Shared Access Signature (SAS) tokens for this specific operation. This option is tempting as client credentials flow is the standard for secure service-to-service authentication in Azure, adhering to the principle of least privilege, and would be correct if Notification Hubs natively supported it for notification submission.
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
Azure Functions Development
Key term
Managed identity
A managed identity is an automatically managed service principal in Azure that allows your code to authenticate to any service that supports Azure AD authentication without storing credentials.
Key term
Key Vault Secrets
Key Vault Secrets are secure containers in Microsoft Azure that store sensitive information like passwords, connection strings, and API keys, keeping them encrypted and accessible only to authorized applications and users.
About these practice questions
This AZ-204 question is part of Courseiva's 881-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.