Connect to and consume Azure services and third-party services →mediumMultiple ChoiceObjective-mapped
AZ-204 Practice Question: Connect to and consume Azure services and third-party services
Coho Vineyard has an Azure Logic App that processes orders. The workflow must call a third-party API that uses Basic authentication. The credentials (username and password) must be stored securely in Azure Key Vault. The Logic App uses a system-assigned managed identity. The managed identity has been granted 'Get' permission on the Key Vault secrets. Which approach should the team use to pass the credentials to the third-party API?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Add a Key Vault connector step to retrieve the secret containing the password. Then use an HTTP connector with 'Basic' authentication type. In the authentication parameters, reference the secret for the password.
The correct approach is to add a Key Vault connector step to retrieve the secret containing the password, then use an HTTP connector with 'Basic' authentication type. In the authentication parameters, reference the secret for the password field. Option A is incorrect because Active Directory OAuth is not compatible with Basic authentication. Option B is incorrect because the third-party API does not support managed identity authentication. Option C is insecure as it stores credentials directly in the Logic App configuration. Option D is correct.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use an HTTP connector with 'Active Directory OAuth' authentication. Provide the client ID and client secret.
Why it's wrong here
Active Directory OAuth authentication is specifically designed for securing access to resources protected by Azure Active Directory, typically involving service principals and client credentials. Since the third-party API explicitly requires 'Basic' authentication, attempting to use AD OAuth would result in authentication failures because the API would not understand or process the OAuth tokens. This method is fundamentally incompatible with the API's expected authentication mechanism.
- ✗
Use managed identity authentication on the HTTP connector. The third-party API must support managed identity.
Why it's wrong here
Managed identities for Azure resources provide an identity for Azure services to authenticate to other Azure services that support Azure AD authentication, eliminating the need to manage credentials. While highly secure and recommended for Azure-to-Azure communication, this method is unsuitable for a third-party API unless that API is specifically designed to integrate with Azure AD and accept managed identity tokens. The problem statement indicates the third-party API does not support managed identity, rendering this option invalid.
- ✗
Store the username and password directly in the Logic App's connection settings for the HTTP connector.
Why it's wrong here
Storing sensitive credentials like usernames and passwords directly within the Logic App's connection settings or definition is a significant security vulnerability. These credentials would be exposed in the Logic App's configuration, potentially in plaintext or easily retrievable forms, violating security best practices. This approach lacks proper credential management, auditability, and rotation capabilities, making it an unacceptable solution for production environments.
- ✓
Add a Key Vault connector step to retrieve the secret containing the password. Then use an HTTP connector with 'Basic' authentication type. In the authentication parameters, reference the secret for the password.
Why this is correct
This approach correctly addresses both security and functional requirements. Azure Key Vault provides a secure, centralized store for secrets, ensuring the password is encrypted at rest and access is controlled via Azure RBAC. By retrieving the password from Key Vault at runtime and then using it with the HTTP connector's 'Basic' authentication type, the Logic App securely authenticates to the third-party API without exposing credentials in its definition. This adheres to security best practices for credential management.
Go deeper
Related to this question
Learn chapter
Azure Functions Development
Key term
Managed identity
A managed identity is an automatically managed service principal in Azure that allows your code to authenticate to any service that supports Azure AD authentication without storing credentials.
Key term
Key Vault Secrets
Key Vault Secrets are secure containers in Microsoft Azure that store sensitive information like passwords, connection strings, and API keys, keeping them encrypted and accessible only to authorized applications and users.
About these practice questions
One of 881 original AZ-204 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.