AZ-204 Implement Azure security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Use a shared administrator account

  Why it's wrong here

  Using a shared administrator account for application authentication is a severe security anti-pattern. It eliminates individual accountability for actions performed by the application, making auditing and incident response extremely difficult. Furthermore, it inherently violates the principle of least privilege by granting excessive permissions beyond what the application requires, significantly expanding the attack surface if compromised. This approach introduces unnecessary risk and complexity into identity management.

• ✗

  Store a client secret in source control

  Why it's wrong here

  Storing client secrets directly within source control repositories, even private ones, creates a critical security vulnerability. These secrets become accessible to anyone with repository access, including past versions, and are highly susceptible to accidental exposure or compromise. Managing their rotation securely becomes a complex and error-prone process, as every instance of the secret must be updated across potentially numerous environments and deployments, leading to operational overhead and increased risk.

• ✓

  Enable managed identity and grant least-privilege access to the target resource

  Why this is correct

  Enabling managed identity for an Azure-hosted application provides a highly secure and recommended method for authenticating to Azure resources like Key Vault. This approach eliminates the need for developers to manage, store, or rotate any credentials or client secrets within their code or configuration. By assigning the managed identity specific, least-privilege access roles to the target Key Vault, the application can securely retrieve certificates while adhering to robust security principles, significantly reducing the attack surface.

• ✗

  Disable authentication for the target resource

  Why it's wrong here

  Disabling authentication for a target resource, such as Azure Key Vault, is an extremely insecure practice that completely negates any security controls. This action would expose sensitive certificates and cryptographic keys to unauthorized access by any entity, internal or external, that can reach the resource. Such a configuration violates fundamental security principles, regulatory compliance requirements, and data protection best practices, making it an unacceptable solution for any production environment.