AZ-204 Implement Azure security Practice Question
A developer is implementing least-privilege storage access. The application runs on Azure App Service and must avoid stored credentials. Which design should be used? The design must avoid adding custom operational scripts.
⚠ Common exam trap
Test-takers frequently think storing a client secret in source control (Option C) is acceptable if the repository is private, but the question explicitly requires avoiding stored credentials, and any secret in source control is a security risk that violates the principle of credentialless access.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable managed identity and grant least-privilege access to the target resource
Azure Managed Identity provides an automatically managed identity in Azure AD that allows the App Service to authenticate to any service supporting Azure AD authentication without storing any credentials. By granting the managed identity only the specific permissions required (least-privilege) on the target storage resource (e.g., Storage Blob Data Reader), the application avoids stored credentials and eliminates the need for custom operational scripts. This aligns with the principle of zero standing credentials and is the recommended approach for Azure App Service.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use a shared administrator account
Why it's wrong here
A shared administrator account grants excessive permissions, violating the principle of least privilege by providing more access than required for the application's function. Furthermore, shared credentials lack individual accountability, making it impossible to audit which specific application instance or user performed an action, which is critical for security incident response and compliance. This approach introduces significant security risks and operational overhead.
- ✗
Disable authentication for the target resource
Why it's wrong here
Disabling authentication for a target resource, such as an Azure Storage account, completely removes all security barriers, making the data publicly accessible to anyone with the endpoint URL. This constitutes a severe security vulnerability, exposing sensitive information to unauthorized access and potential data breaches, directly contradicting any secure design principles for cloud applications.
- ✗
Store a client secret in source control
Why it's wrong here
Storing a client secret directly in source control exposes sensitive credentials to anyone with access to the repository, including developers, build systems, and potentially external parties. This practice makes the secret highly vulnerable to compromise and extremely difficult to manage securely, as rotation requires updating the code, redeploying, and ensuring all instances are updated, increasing the risk of leakage during the lifecycle.
- ✓
Enable managed identity and grant least-privilege access to the target resource
Why this is correct
Enabling managed identity for an Azure-hosted application provides an automatically managed identity in Azure Active Directory (Azure AD), allowing the application to authenticate to Azure services securely without needing to store or manage any credentials in code or configuration. By then granting only the necessary, least-privilege access to the target resource via Azure RBAC, the application adheres to security best practices, minimizing the attack surface and simplifying credential management.
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
Azure Functions Development
Key term
Microsoft Identity Platform
Microsoft Identity Platform is a unified authentication and authorization service that enables applications to sign in users and access resources using Microsoft Entra ID and modern protocols.
Key term
Key Vault Secrets
Key Vault Secrets are secure containers in Microsoft Azure that store sensitive information like passwords, connection strings, and API keys, keeping them encrypted and accessible only to authorized applications and users.
About these practice questions
Courseiva writes every AZ-204 question from scratch — 881 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.