AZ-204 Implement Azure security Practice Question
You are developing an application that stores user secrets. You need to ensure that the secrets are encrypted at rest and rotated automatically. Which Azure service should you integrate?
⚠ Common exam trap
Test-takers frequently confuse Azure Storage's built-in encryption at rest with the need for a dedicated secrets management service, overlooking that Key Vault alone provides both encryption at rest and automated rotation for secrets.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure Key Vault.
Azure Key Vault is the correct choice because it provides centralized management of secrets, keys, and certificates with built-in encryption at rest using FIPS 140-2 Level 2 validated hardware security modules (HSMs). It also supports automatic rotation of secrets through integration with Azure Event Grid and Azure Functions, enabling you to schedule or trigger key rotation policies without manual intervention.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Azure Storage.
Why it's wrong here
While Azure Storage services, such as Blob or File Storage, encrypt data at rest using platform-managed or customer-managed keys, they are fundamentally designed for general data persistence, not dedicated secret management. Azure Storage lacks built-in capabilities for automatic secret rotation, versioning, or fine-grained access policies specifically tailored for sensitive credentials, making it an unsuitable choice for robust secret lifecycle management in applications.
- ✓
Azure Key Vault.
Why this is correct
Azure Key Vault is purpose-built for the secure storage and management of cryptographic keys, secrets, and certificates. It provides robust protection for secrets using FIPS 140-2 Level 2 validated Hardware Security Modules (HSMs), offers fine-grained access control through Azure RBAC and Key Vault access policies, and supports automatic secret rotation, versioning, and comprehensive auditing. This dedicated design ensures the confidentiality and integrity of sensitive user secrets throughout their lifecycle.
- ✗
Azure Security Center.
Why it's wrong here
Azure Security Center, now integrated into Microsoft Defender for Cloud, is a unified infrastructure security management system focused on strengthening the security posture of cloud and hybrid workloads. Its primary functions include providing security recommendations, offering threat protection, and monitoring regulatory compliance. It does not provide any mechanism for storing or managing application secrets; instead, it might recommend using services like Key Vault for proper secret management.
- ✗
Microsoft Entra ID.
Why it's wrong here
Microsoft Entra ID (formerly Azure Active Directory) is Microsoft's cloud-based identity and access management service, primarily used for authenticating users and applications and managing their access to resources. While it manages user identities and can store user attributes, it is not designed to securely store application-specific secrets or credentials that applications use to access other services. Its core function is identity governance, not secure secret storage for applications.
Quick reference
Cloud Service Model Comparison
| Model | You Manage | Provider Manages | Examples |
|---|---|---|---|
| IaaS | OS, runtime, apps, data | Hardware, hypervisor, networking | EC2, Azure VMs, GCP Compute Engine |
| PaaS | Apps and data | OS, runtime, middleware, hardware | Elastic Beanstalk, Azure App Service |
| SaaS | Data and settings only | Everything else | Microsoft 365, Salesforce, Workday |
| FaaS / Serverless | Function code only | Infra, scaling, runtime | Lambda, Azure Functions, Cloud Run |
| CaaS | Containers and apps | Kubernetes, OS, hardware | EKS, AKS, GKE |
Go deeper
Related to this question
Learn chapter
Azure Functions Development
Key term
Azure Event Grid
Azure Event Grid is a fully managed event routing service that allows applications and services to react to events in real time using a publish-subscribe model.
Key term
Azure Functions Bindings
Azure Functions Bindings are declarative connections that link your serverless function code to Azure services or external resources, handling input and output data automatically without writing extra networking or authentication code.
About these practice questions
Courseiva writes every AZ-204 question from scratch — 881 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.