AZ-204 Implement Azure security Practice Question
You are developing an ASP.NET Core web API hosted on Azure App Service. The API needs to read secrets from Azure Key Vault at startup. You have enabled a system-assigned managed identity for the App Service. Which code should you use to create the Key Vault SecretClient?
⚠ Common exam trap
Many exam-takers choose `ClientSecretCredential` (Option B) because they are accustomed to using service principals with secrets, forgetting that managed identities eliminate the need for any hardcoded credentials.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
new SecretClient(new Uri(keyVaultUrl), new DefaultAzureCredential())
`DefaultAzureCredential` automatically attempts to authenticate using the environment's managed identity when running on Azure App Service. Since a system-assigned managed identity is enabled, `DefaultAzureCredential` will chain through available credential sources and successfully use the managed identity endpoint to obtain a token for Key Vault, without requiring any explicit tenant ID, client ID, or secret.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
new SecretClient(new Uri(keyVaultUrl), new DefaultAzureCredential())
Why this is correct
This is the recommended and most secure approach for Azure App Services. DefaultAzureCredential automatically detects the execution environment and attempts various authentication methods, prioritizing managed identities when available. For an ASP.NET Core Web API hosted on Azure App Service, it will seamlessly leverage the App Service's system-assigned or user-assigned managed identity to authenticate with Azure Key Vault, eliminating the need to manage secrets or credentials in code. This adheres to the principle of least privilege and enhances security by avoiding hardcoded credentials.
- ✗
new SecretClient(new Uri(keyVaultUrl), new ClientSecretCredential(tenantId, clientId, clientSecret))
Why it's wrong here
Using ClientSecretCredential requires explicitly providing a client ID and client secret (or certificate) for an Azure AD application registration. While functional, this method is less secure for an App Service because it necessitates storing these sensitive credentials either directly in code, configuration files, or environment variables. This approach bypasses the inherent security benefits of managed identities, which automatically handle credential rotation and lifecycle, increasing the risk of credential compromise and making secret management more complex.
- ✗
new SecretClient(new Uri(keyVaultUrl), new ChainedTokenCredential())
Why it's wrong here
ChainedTokenCredential is designed to combine multiple TokenCredential instances, allowing the application to attempt authentication with each in a specified order until one succeeds. However, it is a low-level construct that requires you to explicitly define and provide the individual credential types to chain. It is not a credential provider itself, nor does it automatically detect the environment like DefaultAzureCredential. For most scenarios, DefaultAzureCredential is preferred as it internally implements this chaining logic and handles environment detection automatically, simplifying development.
- ✗
new SecretClient(new Uri(keyVaultUrl), new InteractiveBrowserCredential())
Why it's wrong here
InteractiveBrowserCredential is designed for client-side applications or development environments where user interaction is possible and expected. It opens a web browser to prompt the user for their Azure Active Directory credentials, facilitating interactive authentication. This method is entirely unsuitable for a server-side application like an ASP.NET Core Web API hosted on Azure App Service, as there is no user interface or interactive session available to display a browser prompt, making it impossible to authenticate.
Go deeper
Related to this question
Learn chapter
Azure Functions Development
Key term
Key Vault Secrets
Key Vault Secrets are secure containers in Microsoft Azure that store sensitive information like passwords, connection strings, and API keys, keeping them encrypted and accessible only to authorized applications and users.
Key term
Managed identity
A managed identity is an automatically managed service principal in Azure that allows your code to authenticate to any service that supports Azure AD authentication without storing credentials.
About these practice questions
One of 881 original AZ-204 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.