AZ-204 Implement Azure security Practice Question
You are developing an API that uses managed identity to access Azure Key Vault. The API runs in an Azure App Service with system-assigned managed identity enabled. You need to retrieve a secret value. Which API endpoint should your code call?
⚠ Common exam trap
Watch out — candidates often confuse the Key Vault REST API endpoint with the Azure AD token endpoint or the Azure Resource Manager endpoint, forgetting that the vault name is part of the DNS and that an API version is required.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
https://myvault.vault.azure.net/secrets/{secret-name}?api-version=7.0
It uses the full Key Vault REST API endpoint with the specific vault name ('myvault'), the 'secrets' resource path, the secret name, and the required 'api-version' query parameter (7.0). The managed identity in the App Service authenticates via Azure AD, and the code must call this specific endpoint to retrieve the secret value, as the vault name is part of the DNS name and the API version is mandatory.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
https://vault.azure.net/secrets/{secret-name}
Why it's wrong here
This URL is incomplete and therefore incorrect for accessing Azure Key Vault secrets. The Azure Key Vault data plane endpoint requires the specific vault-name as a subdomain (e.g., `myvault`) to uniquely identify the Key Vault instance within the global Azure infrastructure. Without this unique identifier, the URL cannot resolve to a specific Key Vault, making any secret retrieval attempt impossible.
- ✓
https://myvault.vault.azure.net/secrets/{secret-name}?api-version=7.0
Why this is correct
This URL correctly specifies the Azure Key Vault data plane endpoint for retrieving a secret. It includes the unique `vault-name` as a subdomain, followed by the standard `vault.azure.net` domain, and then the `/secrets/{secret-name}` path to target a specific secret. The `?api-version=7.0` query parameter is a crucial best practice for specifying the desired API version, ensuring compatibility and access to specific features.
- ✗
https://login.microsoftonline.com/{tenant}/oauth2/token
Why it's wrong here
This endpoint is part of Azure Active Directory (now Microsoft Entra ID) and is specifically designed for acquiring OAuth 2.0 access tokens. While an API using managed identity will internally interact with such an endpoint to obtain a token for authentication, this URL itself does not directly retrieve a secret from Key Vault. It serves as an authentication endpoint, not a data plane endpoint for resource access.
- ✗
https://management.azure.com/subscriptions/{sub}/...
Why it's wrong here
This URL represents the Azure Resource Manager (ARM) endpoint, which is used for managing Azure resources themselves (e.g., creating, updating, or deleting Key Vaults, virtual machines, etc.). While Key Vaults are provisioned and managed via ARM, accessing the *data* stored within a Key Vault (such as secrets, keys, or certificates) requires interaction with the Key Vault's dedicated data plane endpoint, not the ARM control plane.
Go deeper
Related to this question
Learn chapter
Azure Functions Development
Key term
Managed identity
A managed identity is an automatically managed service principal in Azure that allows your code to authenticate to any service that supports Azure AD authentication without storing credentials.
Key term
Key Vault Secrets
Key Vault Secrets are secure containers in Microsoft Azure that store sensitive information like passwords, connection strings, and API keys, keeping them encrypted and accessible only to authorized applications and users.
About these practice questions
Courseiva writes every AZ-204 question from scratch — 881 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.