Question 319 of 997

Implement Azure security →mediumMultiple ChoiceObjective-mapped

Quick Answer

The correct approach is to store the connection string in an App Setting and use Key Vault references, enabling automatic rotation without redeploying the app. This works because Azure App Service resolves Key Vault references at runtime, meaning the app always fetches the latest secret value from Key Vault each time it starts or refreshes its settings. By configuring a Key Vault policy to automatically rotate the secret every 30 days—using a scheduled rotation or event-driven trigger—the password changes seamlessly, and the App Service picks up the new value without any code changes or redeployment. On the AZ-204 exam, this scenario tests your understanding of managed identity, Key Vault integration, and runtime configuration resolution; a common trap is assuming you must update the App Setting manually or use environment variables that require a restart. Remember the memory tip: “KV refs are live links, not static copies”—the app never stores the password, it just points to where the password lives.

AZ-204 Implement Azure security Practice Question

This AZ-204 practice question tests your understanding of implement azure security. Match the stated requirement to the specific cloud service, access model, or configuration option — many options are valid in isolation but not for this scenario. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.

You are developing an ASP.NET Core web app that uses Azure SQL Database. The SQL connection string contains a password that must be rotated every 30 days. The app runs on Azure App Service. You want to store the connection string securely and enable automatic rotation without redeploying the app. Which approach should you use?

Question 1mediummultiple choice

Full question →

A
Store the connection string in an App Setting and use Key Vault references. Configure a Key Vault policy to automatically rotate the secret.
This approach uses a Key Vault reference in the App Setting, which the runtime resolves automatically. The secret can have an expiration date, and you can automate its renewal using Azure automation or functions, enabling rotation without redeployment.
B
Store the connection string in an App Setting as a plain text value and use deployment slots to swap when the password changes.
Why wrong: Plain text storage violates security best practices and does not enable automatic rotation. Slot swaps require manual updates and redeployment.
C
Use a managed identity to access the SQL database directly, bypassing the connection string entirely.
Why wrong: Managed identity can be used for Azure SQL if the identity is granted access, but the question specifically requires storing a connection string (which implies a password-based auth) and rotating it. Managed identity eliminates the need for a connection string password.
D
Store the connection string in Azure Key Vault and use an ARM template with a secret reference at deployment time.
Why wrong: ARM template references are resolved at deployment time, not runtime, so the secret is baked into the deployment. Rotating the secret would require redeployment.

Full breakdown with real-world context →

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Store the connection string in an App Setting and use Key Vault references. Configure a Key Vault policy to automatically rotate the secret.

Option A is correct because Azure App Service supports Key Vault references in App Settings, allowing you to securely store the connection string in Key Vault and reference it without exposing the password. By configuring a Key Vault policy to automatically rotate the secret (e.g., using a scheduled rotation or event-driven trigger), the password can be rotated every 30 days without redeploying the app, as the App Service runtime resolves the reference at runtime.

Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
Store the connection string in an App Setting and use Key Vault references. Configure a Key Vault policy to automatically rotate the secret.
Why this is correct
This approach uses a Key Vault reference in the App Setting, which the runtime resolves automatically. The secret can have an expiration date, and you can automate its renewal using Azure automation or functions, enabling rotation without redeployment.
Related concept
Read the scenario before looking for a memorised answer.
✗
Store the connection string in an App Setting as a plain text value and use deployment slots to swap when the password changes.
Why it's wrong here
Plain text storage violates security best practices and does not enable automatic rotation. Slot swaps require manual updates and redeployment.
✗
Use a managed identity to access the SQL database directly, bypassing the connection string entirely.
Why it's wrong here
Managed identity can be used for Azure SQL if the identity is granted access, but the question specifically requires storing a connection string (which implies a password-based auth) and rotating it. Managed identity eliminates the need for a connection string password.
✗
Store the connection string in Azure Key Vault and use an ARM template with a secret reference at deployment time.
Why it's wrong here
ARM template references are resolved at deployment time, not runtime, so the secret is baked into the deployment. Rotating the secret would require redeployment.

Common exam traps

Common exam trap: answer the scenario, not the keyword

The trap here is that candidates often confuse Key Vault references with ARM template secret references, assuming both are resolved at runtime, but ARM template references are only evaluated during deployment, not dynamically.

Detailed technical explanation

How to think about this question

Key Vault references in App Service use the `@Microsoft.KeyVault(SecretUri=...)` syntax, which is resolved by the App Service runtime on each request, not cached indefinitely, ensuring that secret rotations are picked up within minutes. Under the hood, the App Service uses its managed identity to authenticate to Key Vault and retrieve the secret, so the app itself never stores the password in memory or disk. In a real-world scenario, you can combine this with Azure SQL Database's automatic password rotation policies (e.g., via Azure AD authentication or custom rotation logic) to achieve zero-downtime compliance.

KKey Concepts to Remember

Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.

TExam Day Tips

Watch for words such as best, first, most likely and least administrative effort.
Review why wrong options are wrong, not only why the correct option is correct.

Key takeaway

Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.

Real-world example

How this comes up in practice

A company's IT admin needs to give a contractor read-only access to production logs without sharing account credentials. Using role-based access control (RBAC) and temporary scoped permissions — not a permanent shared password — is the correct pattern. Questions like this test whether you can apply least-privilege access across cloud identity services.

What to study next

Got this wrong? Here's your next step.

Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.

Related AZ-204 practice-question pages

Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.

Develop Azure compute solutions practice questions

Practise AZ-204 questions linked to Develop Azure compute solutions.

Develop for Azure storage practice questions

Practise AZ-204 questions linked to Develop for Azure storage.

Implement Azure security practice questions

Practise AZ-204 questions linked to Implement Azure security.

Connect to and consume Azure services and third-party services practice questions

Practise AZ-204 questions linked to Connect to and consume Azure services and third-party services.

Monitor, troubleshoot, and optimize Azure solutions practice questions

Practise AZ-204 questions linked to Monitor, troubleshoot, and optimize Azure solutions.

AZ-204 fundamentals practice questions

Practise AZ-204 questions linked to AZ-204 fundamentals.

AZ-204 scenario practice questions

Practise AZ-204 questions linked to AZ-204 scenario.

AZ-204 troubleshooting practice questions

Practise AZ-204 questions linked to AZ-204 troubleshooting.

Practice this exam

Start a free AZ-204 practice session

Short sessions build daily habit. Longer sessions build exam-day stamina. Try a timed session to simulate real conditions.

10 questions 20 questions 30 questions 50 questions Timed 30

AZ-204 practice-test guide →Study guide →Browse all practice tests

FAQ

Questions learners often ask

What does this AZ-204 question test?

Implement Azure security — This question tests Implement Azure security — Read the scenario before looking for a memorised answer..

What is the correct answer to this question?

The correct answer is: Store the connection string in an App Setting and use Key Vault references. Configure a Key Vault policy to automatically rotate the secret. — Option A is correct because Azure App Service supports Key Vault references in App Settings, allowing you to securely store the connection string in Key Vault and reference it without exposing the password. By configuring a Key Vault policy to automatically rotate the secret (e.g., using a scheduled rotation or event-driven trigger), the password can be rotated every 30 days without redeploying the app, as the App Service runtime resolves the reference at runtime.

What should I do if I get this AZ-204 question wrong?

Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.

What is the key concept behind this question?

Read the scenario before looking for a memorised answer.

About these practice questions

Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

Keep practising

Question Discussion

Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.

Loading comments…

This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.