AZ-204 Practice Question: Connect to and consume Azure services and third-party services
You are developing an ASP.NET Core application that needs to access Azure Key Vault to retrieve secrets. You have enabled a managed identity for the App Service. Which Azure SDK class should you use to authenticate to Key Vault?
⚠ Common exam trap
The trap here is that candidates see 'managed identity' and immediately choose ManagedIdentityCredential, forgetting that DefaultAzureCredential is the recommended and more robust choice that automatically includes managed identity support.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
DefaultAzureCredential
DefaultAzureCredential is the recommended approach because it provides a chained authentication mechanism that attempts multiple credential types in order, including ManagedIdentityCredential, EnvironmentCredential, and others. When running in an Azure App Service with a managed identity enabled, DefaultAzureCredential will automatically use the managed identity to authenticate to Key Vault, making it the most flexible and future-proof choice for this scenario.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
DefaultAzureCredential
Why this is correct
DefaultAzureCredential is the recommended approach because it provides a chained authentication mechanism, automatically attempting various credential types in a specific order. For an ASP.NET Core application deployed to Azure, it will seamlessly leverage the assigned Managed Identity without requiring any code changes or explicit configuration. During local development, it can fall back to credentials from Visual Studio, Azure CLI, or environment variables, offering unparalleled flexibility across different environments.
- ✗
ClientSecretCredential
Why it's wrong here
ClientSecretCredential requires an application registration's client secret to authenticate, which introduces significant security and operational challenges. Storing and managing client secrets securely, especially in a server-side application, necessitates robust key management, rotation policies, and protection against leakage. This approach is generally discouraged for Azure-hosted applications when Managed Identities are available, as it increases the attack surface and management overhead compared to secretless authentication.
- ✗
ManagedIdentityCredential
Why it's wrong here
ManagedIdentityCredential specifically targets Azure Managed Identities for authentication. While it would successfully authenticate the ASP.NET Core application when deployed to Azure with a Managed Identity, it lacks the versatility of DefaultAzureCredential. It does not provide automatic fallback mechanisms for local development environments (e.g., using developer credentials from Visual Studio or Azure CLI), potentially requiring conditional logic or separate credential configurations for different deployment stages.
- ✗
InteractiveBrowserCredential
Why it's wrong here
InteractiveBrowserCredential is designed for user-interactive authentication flows where a user is present to interact with a web browser for login and consent. A server-side ASP.NET Core application running in an Azure environment operates without a user interface or human interaction. Attempting to use this credential type would fail as there is no browser to launch or user to prompt, making it entirely unsuitable for non-interactive, server-to-service authentication scenarios.
Go deeper
Related to this question
Learn chapter
Azure Functions Development
Key term
Managed identity
A managed identity is an automatically managed service principal in Azure that allows your code to authenticate to any service that supports Azure AD authentication without storing credentials.
Key term
Key Vault Secrets
Key Vault Secrets are secure containers in Microsoft Azure that store sensitive information like passwords, connection strings, and API keys, keeping them encrypted and accessible only to authorized applications and users.
About these practice questions
Courseiva writes every AZ-204 question from scratch — 881 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.