AZ-204 Practice Question: Connect to and consume Azure services and third-party services
You are building an Azure Logic App that must call a third-party REST API. The API requires an API key passed as a query parameter. You need to store the API key securely and automatically add it to each request. Which approach should you use?
⚠ Common exam trap
Watch out — candidates often think storing the key in an Azure Storage Table or using environment variables is sufficient, but Azure Key Vault is the only option that provides secure, auditable, and managed secret storage with built-in integration for Logic Apps.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use Azure Key Vault and the Key Vault connector to retrieve the secret dynamically.
Azure Key Vault provides a secure, centralized service for storing secrets like API keys, and the Key Vault connector in Logic Apps allows you to dynamically retrieve the secret at runtime without exposing it in the workflow definition. This approach ensures the API key is never hardcoded or stored in plaintext, meeting security best practices for accessing third-party APIs.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Hardcode the API key in the Logic App definition.
Why it's wrong here
Hardcoding the API key directly within the Logic App definition, whether in the workflow JSON or a custom connector, is a severe security vulnerability. This practice embeds sensitive credentials directly into source control, making them accessible to anyone with repository access and difficult to rotate or revoke without redeploying the entire Logic App. It violates the principle of least privilege and secure secret management, significantly increasing the risk of unauthorized access if the code repository is compromised.
- ✓
Use Azure Key Vault and the Key Vault connector to retrieve the secret dynamically.
Why this is correct
Azure Key Vault is the industry-standard solution for securely storing and managing cryptographic keys, secrets, and certificates. By using the Key Vault connector in a Logic App, the API key is retrieved dynamically at runtime, typically leveraging a Managed Identity assigned to the Logic App for authentication to Key Vault. This approach ensures the secret is never exposed in the Logic App's definition, source control, or logs, facilitating secure rotation and auditing while adhering to robust security and compliance standards.
- ✗
Store the API key in an Azure Storage Table and reference it from the Logic App.
Why it's wrong here
Storing an API key in an Azure Storage Table is inappropriate for sensitive data because, while Azure Storage provides encryption at rest for all data by default, it lacks the fine-grained access control, secret rotation capabilities, and audit trails specifically designed for managing secrets. A Storage Table is primarily for structured non-relational data storage, not for secure secret management, and directly exposing it to a Logic App would require broader permissions than necessary for a secret, increasing the attack surface. It does not offer the same level of protection against unauthorized access or compromise as a dedicated secret management service.
- ✗
Use an environment variable in the Logic App.
Why it's wrong here
Logic Apps, unlike some other Azure compute services such as Azure Functions or App Services, do not natively support environment variables for configuration or secret management. Even if they did, storing sensitive API keys directly as environment variables is generally not considered a secure practice for production environments. Environment variables typically lack encryption at rest, robust access control, auditing capabilities, and secure rotation mechanisms that are essential for managing high-value secrets, making them susceptible to exposure through process inspection or misconfiguration.
Go deeper
Related to this question
About these practice questions
One of 881 original AZ-204 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.