AZ-204 Develop Azure compute solutions Practice Question
You are deploying a sensitive configuration to Azure Container Instances. The configuration must be encrypted at rest and not visible in the container logs. What should you use?
⚠ Common exam trap
Test-takers frequently choose environment variables (Option A) because they are easy to implement, but they overlook the requirement that the configuration must not be visible in container logs, which environment variables inherently violate.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure Key Vault with managed identity and secret volumes
Azure Key Vault with managed identity and secret volumes is the correct choice because it allows you to mount secrets as files into the container without exposing them in environment variables or logs. The secrets are encrypted at rest in Key Vault and are only accessible via a managed identity assigned to the container group, ensuring the configuration remains secure and invisible in container logs.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Environment variables in the container group
Why it's wrong here
Environment variables are often stored in plain text within the container definition or deployment manifest, making them easily discoverable through `docker inspect` or container logs. They lack encryption at rest and robust security controls, rendering them unsuitable for sensitive data like API keys or database connection strings due to the high risk of exposure.
- ✓
Azure Key Vault with managed identity and secret volumes
Why this is correct
Azure Key Vault provides a secure, centralized store for secrets, encrypting them at rest and in transit. A managed identity grants the Azure Container Instance (ACI) secure, authenticated access to Key Vault without needing hardcoded credentials. By mounting secrets as volumes, they are injected directly into the container's filesystem, making them accessible to the application while avoiding exposure in environment variables or logs, thus enhancing security posture.
- ✗
Azure Files volume mounted into the container
Why it's wrong here
Azure Files is primarily a cloud file share service, not designed for secure secret management. While data can be encrypted at rest, storing sensitive configuration directly in a file and mounting it exposes the content on the container's filesystem. This method lacks the granular access control, secret rotation capabilities, and dedicated security features inherent to a specialized secret store, making it vulnerable if the container or host is compromised.
- ✗
ConfigMap in a Kubernetes cluster
Why it's wrong here
ConfigMaps are a native Kubernetes object used to store non-sensitive configuration data as key-value pairs, designed for applications running within a Kubernetes cluster. Azure Container Instances (ACI) is a serverless container service that runs individual containers or container groups directly, without the underlying Kubernetes orchestration layer. Therefore, ACI environments do not have a Kubernetes API server to process or consume ConfigMap resources, making this option fundamentally incompatible with ACI deployments.
Go deeper
Related to this question
Learn chapter
Azure Functions Development
Key term
Key Vault Secrets
Key Vault Secrets are secure containers in Microsoft Azure that store sensitive information like passwords, connection strings, and API keys, keeping them encrypted and accessible only to authorized applications and users.
Key term
Managed identity
A managed identity is an automatically managed service principal in Azure that allows your code to authenticate to any service that supports Azure AD authentication without storing credentials.
About these practice questions
This AZ-204 question is part of Courseiva's 881-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.