AZ-204 Develop Azure compute solutions Practice Question
You are deploying a Node.js application to Azure Web Apps for Containers. The application needs to read configuration settings from Azure App Configuration. What is the recommended method to securely connect the app to the configuration store?
⚠ Common exam trap
Many exam-takers confuse Key Vault references (which are for retrieving secrets from Key Vault) with the method to connect to App Configuration, leading them to choose Option B, but managed identity is the recommended and most secure way to authenticate to App Configuration directly.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use managed identity.
Using a managed identity allows the Node.js application running in Azure Web Apps for Containers to authenticate to Azure App Configuration without storing any secrets. Managed identities provide an automatically managed service principal in Azure AD, enabling secure, code-free access to the configuration store via Azure AD authentication, which is the recommended approach for production workloads.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Store connection string in environment variables.
Why it's wrong here
Storing sensitive connection strings directly in environment variables, while common for general configuration, is not the most secure practice for production Azure Web Apps. These variables can be easily inspected by anyone with access to the container instance or underlying host, increasing the risk of unauthorized disclosure. Unlike dedicated secret management solutions, environment variables lack features like auditing, versioning, or automatic rotation, making them less suitable for managing critical secrets.
- ✗
Use Key Vault references in App Settings.
Why it's wrong here
Using Key Vault references in App Settings is a robust and secure method for retrieving secrets from Azure Key Vault. However, for accessing Azure App Configuration specifically, this approach introduces an unnecessary dependency and complexity. Azure App Configuration itself supports authentication via managed identity, which is a more direct and secure mechanism that eliminates the need to store its connection string in Key Vault or any other location.
- ✓
Use managed identity.
Why this is correct
Managed identities provide an Azure Active Directory identity for Azure resources, such as an Azure Web App for Containers. This allows the application to authenticate securely to other Azure services, like Azure App Configuration, without requiring any explicit credentials or connection strings to be stored in the application code or configuration. The Azure platform automatically manages the identity's lifecycle and authentication tokens, enabling secure, secret-less access based on assigned Azure RBAC roles.
- ✗
Hardcode the connection string.
Why it's wrong here
Hardcoding connection strings directly into the application's source code or container image is a critical security vulnerability and is strongly discouraged. This practice embeds sensitive information, making it immutable without a code change and redeployment, and exposes the secret to anyone with access to the codebase or compiled artifact. Hardcoding violates fundamental security principles, complicates secret rotation, and significantly increases the risk of data breaches.
Go deeper
Related to this question
Learn chapter
Azure Functions Development
Key term
Managed identity
A managed identity is an automatically managed service principal in Azure that allows your code to authenticate to any service that supports Azure AD authentication without storing credentials.
Key term
Key Vault Secrets
Key Vault Secrets are secure containers in Microsoft Azure that store sensitive information like passwords, connection strings, and API keys, keeping them encrypted and accessible only to authorized applications and users.
About these practice questions
Courseiva writes every AZ-204 question from scratch — 881 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.