Question 319 of 881
AZ-204 Implement Azure security Practice Question
You are developing an ASP.NET Core web app that uses Azure SQL Database. The SQL connection string contains a password that must be rotated every 30 days. The app runs on Azure App Service. You want to store the connection string securely and enable automatic rotation without redeploying the app. Which approach should you use?
⚠ Common exam trap
Candidates often confuse Key Vault references with ARM template secret references, assuming both are resolved at runtime, but ARM template references are only evaluated during deployment, not dynamically.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Store the connection string in an App Setting and use Key Vault references. Configure a Key Vault policy to automatically rotate the secret.
Azure App Service supports Key Vault references in App Settings, allowing you to securely store the connection string in Key Vault and reference it without exposing the password. By configuring a Key Vault policy to automatically rotate the secret (e.g., using a scheduled rotation or event-driven trigger), the password can be rotated every 30 days without redeploying the app, as the App Service runtime resolves the reference at runtime.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Store the connection string in an App Setting and use Key Vault references. Configure a Key Vault policy to automatically rotate the secret.
Why this is correct
This approach uses a Key Vault reference in the App Setting, which the runtime resolves automatically. The secret can have an expiration date, and you can automate its renewal using Azure automation or functions, enabling rotation without redeployment.
- ✗
Store the connection string in an App Setting as a plain text value and use deployment slots to swap when the password changes.
Why it's wrong here
Storing a connection string as plain text in an App Setting is a severe security vulnerability, exposing sensitive credentials to anyone with access to the App Service configuration. While deployment slots allow swapping configurations, this process is manual and does not inherently facilitate automatic secret rotation. Each password change would still require a manual update to the plain text value and a slot swap, failing to meet modern security and automation standards for credential management.
- ✗
Use a managed identity to access the SQL database directly, bypassing the connection string entirely.
Why it's wrong here
Managed identity can be used for Azure SQL if the identity is granted access, but the question specifically requires storing a connection string (which implies a password-based auth) and rotating it. Managed identity eliminates the need for a connection string password.
- ✗
Store the connection string in Azure Key Vault and use an ARM template with a secret reference at deployment time.
Why it's wrong here
Using an ARM template with a secret reference resolves the secret value *at deployment time*, embedding the current secret directly into the deployed resource's configuration. This means the secret becomes a static part of the deployment, not a dynamic reference. Consequently, if the secret in Key Vault is rotated, the deployed application will continue using the old, now invalid, secret until the ARM template is redeployed with the updated reference, making rotation cumbersome and requiring downtime.
Visual reference
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Last reviewed: Jun 11, 2026
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.