Connect to and consume Azure services and third-party services →mediumMultiple ChoiceObjective-mapped
AZ-204 Practice Question: Connect to and consume Azure services and third-party services
You are building an Azure Logic App that processes orders. When an order is placed, the Logic App must send a message to an Azure Service Bus queue. The queue is secured using managed identity. Which connector action should you use?
⚠ Common exam trap
It's easy for candidates to confuse the HTTP action with SAS token as a valid way to use managed identity, but managed identity requires Azure AD authentication, not SAS, and the Service Bus connector explicitly supports this authentication type.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Service Bus connector with managed identity authentication
The Service Bus connector with managed identity authentication is correct because it allows the Logic App to authenticate to the Azure Service Bus queue using an Azure AD managed identity, eliminating the need for secrets or SAS tokens. This is the recommended approach for securing Service Bus resources when using Azure services, as it leverages Azure RBAC for fine-grained access control and aligns with the principle of least privilege.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
HTTP action with SAS token
Why it's wrong here
Using an HTTP action with a Shared Access Signature (SAS) token for Service Bus authentication is technically feasible but highly discouraged for production workloads. This approach necessitates manual generation, secure storage, and diligent rotation of the SAS token, introducing significant operational overhead and potential security vulnerabilities if the token is compromised or expires unexpectedly. Managed identities offer a superior, secret-less authentication mechanism integrated directly with Azure Active Directory.
- ✓
Service Bus connector with managed identity authentication
Why this is correct
This is the optimal and recommended approach. The Azure Service Bus connector natively supports managed identity authentication, allowing the Logic App to securely authenticate with Azure Service Bus using an identity managed by Azure Active Directory. This eliminates the need to store or manage connection strings, SAS tokens, or other credentials within the Logic App, significantly enhancing security and simplifying credential rotation and lifecycle management through Azure RBAC.
- ✗
Azure Functions connector
Why it's wrong here
The Azure Functions connector is designed specifically to invoke an Azure Function, passing data to it and optionally receiving a response. While an Azure Function could subsequently send a message to Azure Service Bus, using this connector solely for that purpose introduces an unnecessary intermediary layer of compute and complexity. Direct integration via the Service Bus connector is more efficient and straightforward when the primary goal is message queuing.
- ✗
Event Grid connector
Why it's wrong here
The Event Grid connector is utilized for publishing events to an Azure Event Grid topic or domain, facilitating event-driven architectures where events are routed to various subscribers. Event Grid operates on a publish-subscribe model for discrete events, which is distinct from the message queuing and brokering capabilities of Azure Service Bus. Therefore, this connector cannot be used to directly send messages to a Service Bus queue or topic.
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
Azure Functions Development
Key term
Key Vault Secrets
Key Vault Secrets are secure containers in Microsoft Azure that store sensitive information like passwords, connection strings, and API keys, keeping them encrypted and accessible only to authorized applications and users.
Key term
Azure Service Bus
Azure Service Bus is a cloud-based message broker that allows applications, services, and devices to send and receive messages reliably, even when they are not all running at the same time.
About these practice questions
One of 881 original AZ-204 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.