Connect to and consume Azure services and third-party services →mediumMultiple ChoiceObjective-mapped
AZ-204 Practice Question: Connect to and consume Azure services and third-party services
Contoso Ltd. is migrating a legacy on-premises application to Azure. The application processes customer orders and sends confirmation emails. The new solution must use Azure Functions with an HTTP trigger to receive orders, store order data in Azure Cosmos DB, and send emails via SendGrid. Security requirements: All connections must use managed identities where possible. No secrets should be stored in code or configuration files. Cosmos DB and SendGrid API keys must be retrieved at runtime from Azure Key Vault. The Azure Function app must be able to access Key Vault without storing any connection strings or secrets in application settings. The development team plans to use the Azure.Identity and Azure.Security.KeyVault.Secrets libraries. Which approach should the team use to authenticate to Key Vault?
⚠ Common exam trap
Test-takers frequently confuse Key Vault references (Option B) as a valid secretless approach, but they still require storing the Key Vault URI in app settings, and the question explicitly prohibits storing any connection strings or secrets in application settings, making managed identity with DefaultAzureCredential the only fully compliant solution.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable system-assigned managed identity on the Function app. Grant the identity 'Get' and 'List' permissions on Key Vault secrets. Use DefaultAzureCredential in code to authenticate to Key Vault.
It uses a system-assigned managed identity, which eliminates the need to store any secrets or connection strings. The DefaultAzureCredential class automatically attempts authentication via managed identity when running in Azure, and the code retrieves secrets from Key Vault using the Azure.Identity and Azure.Security.KeyVault.Secrets libraries. Granting 'Get' and 'List' permissions on Key Vault secrets allows the function to read the Cosmos DB and SendGrid API keys at runtime, meeting all security requirements.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Upload a client certificate to the Function app's certificate store. Use ClientCertificateCredential to authenticate to Key Vault.
Why it's wrong here
Uploading a client certificate to the Function app's certificate store and using `ClientCertificateCredential` introduces significant operational overhead. Certificates require lifecycle management, including secure storage, renewal, and rotation, which contradicts the goal of a truly secret-free solution. While it avoids storing a password directly, the certificate itself acts as a credential that needs careful handling and can expire, leading to service disruption.
- ✗
Use Key Vault references in application settings. Store the Key Vault URI in app settings and let the Functions runtime resolve secrets.
Why it's wrong here
Key Vault references are a convenient feature for injecting secrets directly into application settings, allowing the Functions runtime to resolve them before the application starts. However, this method is designed for configuration values and does not facilitate direct, code-based secret retrieval using client libraries, which the question implies. Furthermore, while it leverages managed identity behind the scenes, it's a runtime feature, not a programmatic authentication approach within the application code itself.
- ✓
Enable system-assigned managed identity on the Function app. Grant the identity 'Get' and 'List' permissions on Key Vault secrets. Use DefaultAzureCredential in code to authenticate to Key Vault.
Why this is correct
Enabling a system-assigned managed identity on the Function app provides an Azure Active Directory identity that the application can use to authenticate to other Azure services, such as Key Vault, without storing any credentials in code or configuration. Granting this identity 'Get' and 'List' permissions on Key Vault secrets ensures it has the necessary access. The `DefaultAzureCredential` in code then automatically detects and utilizes this managed identity, offering a robust, secret-free authentication mechanism.
- ✗
Create a user-assigned managed identity, assign it to the Function app, and store its client ID in application settings. Grant the identity permissions to Key Vault. Use ClientSecretCredential with the client ID and a secret.
Why it's wrong here
Creating a user-assigned managed identity and assigning it to the Function app is a valid approach for identity management, but using `ClientSecretCredential` explicitly requires a client secret for authentication. While the client ID might be stored, the necessity of a separate client secret means this solution is not truly secret-free, as that secret still needs to be securely managed, stored, and rotated. This method defeats the primary benefit of managed identities for achieving secret-free access.
Quick reference
Cloud Service Model Comparison
| Model | You Manage | Provider Manages | Examples |
|---|---|---|---|
| IaaS | OS, runtime, apps, data | Hardware, hypervisor, networking | EC2, Azure VMs, GCP Compute Engine |
| PaaS | Apps and data | OS, runtime, middleware, hardware | Elastic Beanstalk, Azure App Service |
| SaaS | Data and settings only | Everything else | Microsoft 365, Salesforce, Workday |
| FaaS / Serverless | Function code only | Infra, scaling, runtime | Lambda, Azure Functions, Cloud Run |
| CaaS | Containers and apps | Kubernetes, OS, hardware | EKS, AKS, GKE |
Go deeper
Related to this question
Learn chapter
Azure Functions Development
Key term
Key Vault Secrets
Key Vault Secrets are secure containers in Microsoft Azure that store sensitive information like passwords, connection strings, and API keys, keeping them encrypted and accessible only to authorized applications and users.
Key term
Durable Functions
Durable Functions is an extension of Azure Functions that lets you write stateful workflows in code, managing complex sequences of tasks, retries, and delays automatically.
About these practice questions
One of 881 original AZ-204 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.