AZ-204 Implement Azure security Practice Question
Which TWO actions should you take to securely store and access secrets for a legacy application that cannot be modified? The application runs on an Azure Virtual Machine and needs to read a database connection string. The solution must use Azure Key Vault and adhere to the principle of least privilege.
⚠ Common exam trap
Candidates often think a managed identity alone allows an unmodified application to access Key Vault, but in reality, the application must either use the Azure SDK or rely on the Key Vault extension to write secrets to a local file, since the legacy code cannot be changed to call the Key Vault REST API.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure the application to read the connection string from a local file that is updated by the Key Vault extension.
The legacy application cannot be modified, so it cannot directly call the Key Vault REST API or SDK. The Azure Key Vault VM extension (also known as the Key Vault Sync extension) runs as a daemon on the VM, retrieves secrets from Key Vault using a managed identity, and writes them to a local file. The application reads the connection string from that local file, achieving secure secret access without code changes.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create a new VM and install the Key Vault extension during provisioning.
Why it's wrong here
Creating a new VM solely to install the Key Vault extension is an unnecessary and inefficient approach. The Azure Key Vault VM extension is designed to be installed and configured on *existing* virtual machines, allowing them to securely access secrets from Azure Key Vault without requiring a complete redeployment of the infrastructure. This flexibility ensures that current operational VMs can be integrated with Key Vault.
- ✓
Configure the application to read the connection string from a local file that is updated by the Key Vault extension.
Why this is correct
Configuring the legacy application to read connection strings from a local file is the crucial step for enabling it to consume secrets securely. The Azure Key Vault VM extension facilitates this by periodically fetching secrets from Key Vault and writing them to a designated file path on the VM's local file system. This method allows the application, which lacks native Key Vault integration capabilities, to access sensitive data without code changes or embedding credentials.
- ✗
Assign a managed identity to the legacy application.
Why it's wrong here
Assigning a managed identity directly to a legacy application is incorrect because managed identities are assigned to Azure resources, such as the virtual machine itself, not to the application binaries running within it. A legacy application typically runs as a process or service on the VM and does not possess its own Azure Active Directory identity. The VM's identity is what authenticates with Azure services like Key Vault.
- ✗
Use a user-assigned managed identity and assign it to the VM.
Why it's wrong here
While technically possible to use a user-assigned managed identity, it is not strictly necessary for this scenario, as a system-assigned managed identity would be sufficient and simpler. A system-assigned identity is automatically created and managed by Azure, tied directly to the VM's lifecycle, and provides the necessary authentication context for the Key Vault extension. User-assigned identities are typically preferred for scenarios requiring shared identity across multiple resources or cross-subscription access.
- ✓
Enable the Azure Key Vault VM extension for the virtual machine.
Why this is correct
Enabling the Azure Key Vault VM extension for the virtual machine is a fundamental action, as this extension is the mechanism that securely synchronizes secrets from Azure Key Vault to the VM. It leverages the VM's managed identity to authenticate with Key Vault, then periodically fetches specified secrets and writes them to a local file system location. This allows legacy applications, unable to directly interact with Key Vault APIs, to access sensitive configuration data.
Go deeper
Related to this question
Learn chapter
Azure Functions Development
Key term
Managed identity
A managed identity is an automatically managed service principal in Azure that allows your code to authenticate to any service that supports Azure AD authentication without storing credentials.
Key term
Key Vault Secrets
Key Vault Secrets are secure containers in Microsoft Azure that store sensitive information like passwords, connection strings, and API keys, keeping them encrypted and accessible only to authorized applications and users.
About these practice questions
This AZ-204 question is part of Courseiva's 881-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.