AZ-204 Develop Azure compute solutions Practice Question
You are deploying a containerized application to Azure Container Instances (ACI). The application requires a connection string to an Azure SQL Database. The connection string contains a password that is stored as a secret in Azure Key Vault. The container image expects to read the connection string from an environment variable named SQL_CONNECTION_STRING. You want to pass the secret securely without embedding it in the YAML deployment file and without modifying the container image. The ACI container group will use a system-assigned managed identity that has access to the Key Vault secret. Which approach should you use?
⚠ Common exam trap
Watch out — candidates often assume they must write code inside the container to use the managed identity with the Key Vault SDK, but ACI provides a built-in mechanism to inject secrets as environment variables without any code changes.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use a secure environment variable with a Key Vault reference syntax (e.g., secret://myvault/secretname)
Azure Container Instances supports Key Vault references in environment variables using the `secret://` syntax, which allows you to securely inject secrets into containers at runtime without exposing them in the deployment YAML. The system-assigned managed identity is automatically used by the ACI infrastructure to authenticate to Key Vault and retrieve the secret, so no code changes to the container image are required.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Mount a volume from Azure Files containing the connection string
Why it's wrong here
Mounting a volume from Azure Files containing the connection string is a poor security practice. Storing sensitive information directly in a file share, even if the share itself has access controls, creates a new attack surface and management burden. The secret would reside on a persistent storage accessible via standard file protocols, requiring careful management of both the file content and the share's permissions. This method lacks the robust auditing and lifecycle management capabilities inherent to dedicated secret management services like Azure Key Vault.
- ✓
Use a secure environment variable with a Key Vault reference syntax (e.g., secret://myvault/secretname)
Why this is correct
Using a secure environment variable with a Key Vault reference syntax (e.g., secret://myvault/secretname) is the recommended and most secure approach for ACI. Azure Container Instances natively supports resolving these references at runtime. When an ACI container group is configured with a managed identity and appropriate access policies to Azure Key Vault, the ACI platform intercepts this special syntax, uses its managed identity to fetch the secret from Key Vault, and then injects the actual secret value as an environment variable into the container *before* the application starts. This ensures the secret never appears in the deployment definition or container image, adhering to security best practices and requiring no application code changes.
- ✗
Use the managed identity inside the container to call the Key Vault SDK and retrieve the secret
Why it's wrong here
Using the managed identity inside the container to call the Key Vault SDK and retrieve the secret, while a valid pattern for many Azure services, is explicitly ruled out by the constraint of not modifying the container image. This approach requires the application code within the container to be specifically written or modified to include the Key Vault SDK and logic for authenticating with the managed identity and fetching the secret. This would necessitate rebuilding the container image, which is not permitted in this scenario.
- ✗
Store the connection string as an environment variable in ACI configuration but mark it as secure
Why it's wrong here
Storing the connection string as an environment variable in ACI configuration, even when marked as "secure," does not provide the same level of security as Key Vault integration. While "secure" environment variables prevent the value from being displayed in plain text in the Azure portal or CLI output *after* deployment, the secret itself is still part of the ACI resource definition. Any user with sufficient Azure RBAC permissions to view the ACI container group's properties can potentially retrieve the value from the underlying resource configuration, making it less secure for highly sensitive data compared to a Key Vault reference.
Visual reference
Go deeper
Related to this question
Learn chapter
Azure Functions Development
Key term
Managed identity
A managed identity is an automatically managed service principal in Azure that allows your code to authenticate to any service that supports Azure AD authentication without storing credentials.
Key term
Key Vault Secrets
Key Vault Secrets are secure containers in Microsoft Azure that store sensitive information like passwords, connection strings, and API keys, keeping them encrypted and accessible only to authorized applications and users.
About these practice questions
One of 881 original AZ-204 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.