This AZ-204 practice question tests your understanding of implement azure security. Match the stated requirement to the specific cloud service, access model, or configuration option — many options are valid in isolation but not for this scenario. A key principle to apply: managed Identities provide an identity for Azure resources in Azure AD.. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A developer is implementing Key Vault certificate retrieval. The application runs on Azure App Service and must avoid stored credentials. Which design should be used? The design must avoid adding custom operational scripts.
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable managed identity and grant least-privilege access to the target resource
Managed identity (system-assigned or user-assigned) allows the App Service to authenticate to Key Vault without any stored credentials, because Azure automatically rotates the identity's service principal and provides an access token via the Azure Instance Metadata Service (IMDS) endpoint. By granting least-privilege access (e.g., a Key Vault access policy with only 'Get' on secrets), the design meets the requirement to avoid stored credentials and custom operational scripts.
Key principle: Managed Identities provide an identity for Azure resources in Azure AD.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
Use a shared administrator account
Why it's wrong here
Shared accounts remove accountability and violate least privilege.
✗
Store a client secret in source control
Why it's wrong here
Source-controlled secrets are exposed and difficult to rotate safely.
✓
Enable managed identity and grant least-privilege access to the target resource
Why this is correct
Managed identity lets Azure-hosted apps authenticate without stored secrets.
Related concept
Managed Identities provide an identity for Azure resources in Azure AD.
✗
Disable authentication for the target resource
Why it's wrong here
Removing authentication is not a secure design.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates may think storing a client secret in Azure App Service application settings (Option B) is acceptable because it's not in source control, but the question explicitly requires avoiding stored credentials entirely, and managed identity is the only zero-credential solution.
Detailed technical explanation
How to think about this question
Under the hood, managed identity works by provisioning a service principal in Azure AD automatically tied to the App Service resource. At runtime, the App Service host environment injects the identity's client ID and certificate into the instance's local file system, and the Azure SDK (e.g., DefaultAzureCredential) uses the IMDS endpoint (169.254.169.254/metadata/identity/oauth2/token) to obtain an OAuth 2.0 access token for Key Vault. A real-world scenario where this matters is when an app must rotate secrets frequently; managed identity eliminates the need to update connection strings or client secrets in app settings.
KKey Concepts to Remember
Managed Identities provide an identity for Azure resources in Azure AD.
They eliminate the need for developers to manage credentials.
Managed Identities authenticate using Azure AD tokens.
Least-privilege access should always be granted to the managed identity.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Managed Identities provide an identity for Azure resources in Azure AD.
Real-world example
How this comes up in practice
A company's IT admin needs to give a contractor read-only access to production logs without sharing account credentials. Using role-based access control (RBAC) and temporary scoped permissions — not a permanent shared password — is the correct pattern. Questions like this test whether you can apply least-privilege access across cloud identity services.
Related glossary terms
Concepts from this question explained
These glossary pages explain the core terms tested in this AZ-204 question in full detail.
Review managed Identities provide an identity for Azure resources in Azure AD., then practise related AZ-204 questions on the same topic to reinforce the concept.
Implement Azure security — This question tests Implement Azure security — Managed Identities provide an identity for Azure resources in Azure AD..
What is the correct answer to this question?
The correct answer is: Enable managed identity and grant least-privilege access to the target resource — Managed identity (system-assigned or user-assigned) allows the App Service to authenticate to Key Vault without any stored credentials, because Azure automatically rotates the identity's service principal and provides an access token via the Azure Instance Metadata Service (IMDS) endpoint. By granting least-privilege access (e.g., a Key Vault access policy with only 'Get' on secrets), the design meets the requirement to avoid stored credentials and custom operational scripts.
What should I do if I get this AZ-204 question wrong?
Review managed Identities provide an identity for Azure resources in Azure AD., then practise related AZ-204 questions on the same topic to reinforce the concept.
What is the key concept behind this question?
Managed Identities provide an identity for Azure resources in Azure AD.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.