Connect to and consume Azure services and third-party services →mediumMultiple ChoiceObjective-mapped
AZ-204 Practice Question: Connect to and consume Azure services and third-party services
You are building an Azure Logic App that must send email notifications via Office 365 when a new order is placed. You need to securely store the Office 365 credentials and reference them in the Logic App. Which approach should you use?
⚠ Common exam trap
Many candidates confuse using a Key Vault action with a username/password connection (Option B) as secure, when in fact the connection itself still stores credentials, whereas a managed identity eliminates credential storage entirely.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use an Azure Key Vault connector with a managed identity assigned to the Logic App
Using an Azure Key Vault connector with a managed identity assigned to the Logic App allows you to securely store Office 365 credentials in Key Vault and authenticate to it without hardcoding secrets or managing credentials. The managed identity provides an Azure AD-backed identity for the Logic App, eliminating the need for username/password in connection strings and enabling secure, auditable access to secrets.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Store the credentials in a variable within the Logic App designer
Why it's wrong here
Storing credentials directly in a variable within the Logic App designer is highly insecure because they are exposed as plain text within the workflow definition. This method lacks any form of encryption at rest or in transit, making the sensitive information easily accessible to anyone with read access to the Logic App resource. It fundamentally violates security best practices for secret management, increasing the risk of credential compromise.
- ✗
Use an Azure Key Vault action with a connection that uses a username and password
Why it's wrong here
While Azure Key Vault is designed for secure secret storage, using a username and password to authenticate the Logic App to Key Vault introduces a 'chicken and egg' problem. The credentials required to access Key Vault would themselves need to be stored somewhere, likely in the Logic App definition or another insecure location. This approach merely shifts the secret management problem rather than solving it securely, as the Key Vault access credentials remain vulnerable.
- ✓
Use an Azure Key Vault connector with a managed identity assigned to the Logic App
Why this is correct
Using an Azure Key Vault connector with a managed identity assigned to the Logic App is the most secure and recommended approach. The Logic App receives an identity from Azure Active Directory, which is then granted specific access policies on Key Vault. This eliminates the need for any developer-managed secrets or connection strings for Key Vault authentication, establishing a secure, credential-less connection to retrieve the Office 365 credentials at runtime.
- ✗
Store the credentials in an Azure Storage table and fetch them in the Logic App
Why it's wrong here
Azure Storage tables are not designed for secure secret storage and should not be used for credentials due to their lack of specialized security features. While data in Storage is encrypted at rest by default, tables do not offer the granular access control, secret rotation, or auditing capabilities specifically tailored for sensitive credentials that a dedicated secret management service like Key Vault provides. Storing credentials here makes them vulnerable to unauthorized access if the storage account key is compromised or if access policies are misconfigured.
Go deeper
Related to this question
Learn chapter
Azure Functions Development
Key term
Key Vault Secrets
Key Vault Secrets are secure containers in Microsoft Azure that store sensitive information like passwords, connection strings, and API keys, keeping them encrypted and accessible only to authorized applications and users.
Key term
Managed identity
A managed identity is an automatically managed service principal in Azure that allows your code to authenticate to any service that supports Azure AD authentication without storing credentials.
About these practice questions
This AZ-204 question is part of Courseiva's 881-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.