AZ-204 Implement Azure security Practice Question
A developer is implementing Key Vault certificate retrieval. The application runs on Azure App Service and must avoid stored credentials. Which design should be used?
⚠ Common exam trap
The trap here is that candidates might think storing a client secret in source control is acceptable if the repo is private, but Azure explicitly forbids this in security best practices, and the question requires 'avoid stored credentials' entirely.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable managed identity and grant least-privilege access to the target resource
Azure App Service supports Managed Identity, which allows the application to authenticate to Key Vault without storing any credentials in code or configuration. By enabling a system-assigned or user-assigned managed identity and granting it least-privilege access (e.g., via an access policy with `Get` permission for secrets), the app can securely retrieve certificates using the Azure Identity SDK's `DefaultAzureCredential` class, which automatically obtains an access token from Microsoft Entra ID.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use a shared administrator account
Why it's wrong here
Using a shared administrator account for application authentication is a severe security anti-pattern. It eliminates individual accountability for actions performed by the application, making auditing and incident response extremely difficult. Furthermore, it inherently violates the principle of least privilege by granting excessive permissions beyond what the application requires, significantly expanding the attack surface if compromised. This approach introduces unnecessary risk and complexity into identity management.
- ✗
Store a client secret in source control
Why it's wrong here
Storing client secrets directly within source control repositories, even private ones, creates a critical security vulnerability. These secrets become accessible to anyone with repository access, including past versions, and are highly susceptible to accidental exposure or compromise. Managing their rotation securely becomes a complex and error-prone process, as every instance of the secret must be updated across potentially numerous environments and deployments, leading to operational overhead and increased risk.
- ✓
Enable managed identity and grant least-privilege access to the target resource
Why this is correct
Enabling managed identity for an Azure-hosted application provides a highly secure and recommended method for authenticating to Azure resources like Key Vault. This approach eliminates the need for developers to manage, store, or rotate any credentials or client secrets within their code or configuration. By assigning the managed identity specific, least-privilege access roles to the target Key Vault, the application can securely retrieve certificates while adhering to robust security principles, significantly reducing the attack surface.
- ✗
Disable authentication for the target resource
Why it's wrong here
Disabling authentication for a target resource, such as Azure Key Vault, is an extremely insecure practice that completely negates any security controls. This action would expose sensitive certificates and cryptographic keys to unauthorized access by any entity, internal or external, that can reach the resource. Such a configuration violates fundamental security principles, regulatory compliance requirements, and data protection best practices, making it an unacceptable solution for any production environment.
Go deeper
Related to this question
Learn chapter
Microsoft Entra External ID (B2C)
Key term
Key Vault Secrets
Key Vault Secrets are secure containers in Microsoft Azure that store sensitive information like passwords, connection strings, and API keys, keeping them encrypted and accessible only to authorized applications and users.
Key term
Managed identity
A managed identity is an automatically managed service principal in Azure that allows your code to authenticate to any service that supports Microsoft Entra ID authentication without storing credentials.
About these practice questions
One of 883 original AZ-204 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.