AZ-204 Practice Question: Connect to and consume Azure services and third-party services
Fabrikam Inc. has an Azure Function app that processes image uploads. Each time a blob is added to a container in Azure Blob Storage, the function is triggered. The function resizes the image and stores the result in another container. Currently, the function uses an Azure Storage account connection string stored in application settings. The security team requires that no connection strings or access keys be stored in application settings. The function must use managed identity to access the storage account. The storage account is in the same subscription. Which action should the team take?
⚠ Common exam trap
The trap here is that candidates often overcomplicate the solution by choosing user-assigned managed identities or Key Vault integrations, when the simplest and most secure approach for a single-resource scenario is to use a system-assigned managed identity with DefaultAzureCredential, which requires zero stored secrets or identifiers in application settings.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable system-assigned managed identity on the Function app. Assign the 'Storage Blob Data Contributor' role to the managed identity on the storage account. Remove the connection string from application settings. Update the code to use DefaultAzureCredential to authenticate to Blob Storage.
It uses a system-assigned managed identity, which is automatically tied to the Function app's lifecycle, and assigns the 'Storage Blob Data Contributor' role to that identity on the storage account. This eliminates the need for any connection strings or access keys in application settings. The code then uses DefaultAzureCredential, which automatically discovers and uses the managed identity when running in Azure, providing secure, passwordless authentication to Azure Blob Storage.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Generate a SAS token for the storage account and store it in Key Vault. Retrieve the SAS token at runtime and use it to create the BlobServiceClient.
Why it's wrong here
While storing a Shared Access Signature (SAS) token in Azure Key Vault improves security over hardcoding it, this approach still relies on a secret that needs to be managed and rotated. SAS tokens grant specific, time-limited access and do not leverage the inherent identity of the Azure Function app. This method introduces credential management overhead and doesn't align with the principle of "no secrets in code or configuration" that managed identities aim to achieve.
- ✗
Create a user-assigned managed identity, assign it to the Function app, and grant it 'Storage Blob Data Contributor' role. Store the client ID in app settings. Use ManagedIdentityCredential with the client ID in code.
Why it's wrong here
This option fails because a system-assigned managed identity, which is generally preferred for a single resource like this Function app needing access, requires no client ID or other identifier to be stored in application settings. The Azure platform automatically provides the identity context to the Function app, eliminating the need for any app setting. User-assigned managed identities, which necessitate storing the client ID for the code to identify them, are typically used when multiple resources need to share the same identity or when a resource requires multiple distinct identities.
- ✗
Keep the connection string in app settings but encrypt it using Azure Key Vault. Use Key Vault references to retrieve it.
Why it's wrong here
Using Azure Key Vault references to retrieve a storage account connection string from app settings is a secure way to manage secrets, preventing them from being directly exposed in configuration. However, this method still fundamentally relies on a connection string, which is a secret (often containing an account key or SAS token) that grants broad access. It does not eliminate the need for a secret entirely, nor does it leverage the Function app's inherent identity for authentication, which is the more secure and modern approach.
- ✓
Enable system-assigned managed identity on the Function app. Assign the 'Storage Blob Data Contributor' role to the managed identity on the storage account. Remove the connection string from application settings. Update the code to use DefaultAzureCredential to authenticate to Blob Storage.
Why this is correct
This option correctly implements the recommended secure pattern for Azure services. Enabling a system-assigned managed identity provides the Function app with an automatically managed identity in Azure Active Directory, eliminating the need for any secrets or connection strings. Assigning the 'Storage Blob Data Contributor' role via RBAC grants only the necessary permissions to the storage account. Finally, `DefaultAzureCredential` in the code automatically detects and uses this managed identity for authentication, ensuring a robust, secret-less, and least-privilege access model.
Quick reference
Azure Blob Storage Tier Comparison
| Tier | Storage Cost | Retrieval Cost | Latency | Use Case |
|---|---|---|---|---|
| Hot | Highest | Lowest | Immediate | Active data, frequent reads |
| Cool | Lower | Higher | Immediate | Data accessed < once / month |
| Cold | Lower still | Higher | Immediate | Data accessed < once / quarter |
| Archive | Lowest | Highest + rehydration delay | Hours | Long-term compliance retention |
Go deeper
Related to this question
Learn chapter
Azure Functions Development
Key term
Managed identity
A managed identity is an automatically managed service principal in Azure that allows your code to authenticate to any service that supports Azure AD authentication without storing credentials.
Key term
Key Vault Secrets
Key Vault Secrets are secure containers in Microsoft Azure that store sensitive information like passwords, connection strings, and API keys, keeping them encrypted and accessible only to authorized applications and users.
About these practice questions
One of 881 original AZ-204 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.