AZ-204 Implement Azure security Practice Question
A developer needs to grant an Azure Function read access to secrets in Azure Key Vault without storing any credentials in the function code or configuration. Which approach should they use?
⚠ Common exam trap
Many exam-takers confuse managed identity with a service principal, thinking a certificate or client secret is always required, but managed identity eliminates the need for any stored credentials by leveraging Azure's automatic identity management.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Managed identity
Managed identity (B) is the correct approach because it allows the Azure Function to authenticate to Azure Key Vault without storing any credentials in code or configuration. Azure automatically manages the identity, and the function can obtain an access token from Azure AD to read secrets, eliminating the need for secrets, certificates, or keys in the application.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Service principal with a certificate
Why it's wrong here
Using a service principal with a certificate for an Azure Function to access Key Vault introduces significant management overhead. While a service principal can be granted access, the certificate itself is a credential that requires secure storage, regular rotation, and lifecycle management. This approach does not eliminate the need for managing a secret (the certificate) and its associated operational tasks, making it less ideal for a solution aiming to minimize credential management.
- ✓
Managed identity
Why this is correct
Managed identity is the optimal solution as it completely eliminates the need for developers to manage any credentials for their Azure Function. Azure automatically provisions and manages an identity in Azure Active Directory for the Function App. This identity can then be granted specific access policies or RBAC roles on the Azure Key Vault, allowing the Function to securely obtain tokens and access secrets without storing any secrets, certificates, or connection strings within the application code or configuration.
- ✗
Access policy with a client secret
Why it's wrong here
An access policy with a client secret, while granting permissions to Key Vault, still necessitates the client secret to be stored and managed by the application. A client secret is a string-based credential for an Azure AD application (service principal) that must be securely configured within the Function App's environment variables or application settings. This method directly contradicts the goal of eliminating stored credentials, as the secret itself needs protection and rotation.
- ✗
Shared access signature (SAS)
Why it's wrong here
Shared Access Signatures (SAS) are fundamentally designed for delegated access to resources within Azure Storage accounts, such as blobs, files, queues, or tables. They provide time-limited, granular permissions to specific storage resources. SAS tokens have no mechanism or applicability for authenticating or authorizing access to secrets, keys, or certificates stored within Azure Key Vault, making this option entirely unsuitable for the stated requirement.
Go deeper
Related to this question
Learn chapter
Azure Functions Development
Key term
Key Vault Secrets
Key Vault Secrets are secure containers in Microsoft Azure that store sensitive information like passwords, connection strings, and API keys, keeping them encrypted and accessible only to authorized applications and users.
Key term
Managed identity
A managed identity is an automatically managed service principal in Azure that allows your code to authenticate to any service that supports Azure AD authentication without storing credentials.
About these practice questions
This AZ-204 question is part of Courseiva's 881-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.