Connect to and consume Azure services and third-party services →mediumMultiple SelectObjective-mapped
AZ-204 Practice Question: Connect to and consume Azure services and third-party services
Which TWO approaches can you use to call an external REST API from an Azure Function while ensuring the API key is not exposed in the function code?
⚠ Common exam trap
A common mix-up: candidates confuse storing secrets in environment variables (which is acceptable for app settings) with storing them in source code or CI/CD secrets, and they may overlook that Managed Identity with Key Vault is the recommended enterprise pattern for production-grade secret management.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Store the API key as an environment variable in the function app settings.
Storing the API key in the function app settings (environment variables) keeps it out of the source code and allows the function to access it via the `Environment.GetEnvironmentVariable` method at runtime. Option E is correct because Azure Key Vault, combined with a Managed Identity, provides a secure, auditable, and rotation-friendly way to store secrets without embedding them in code or configuration files.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Store the API key in GitHub repository secrets.
Why it's wrong here
Storing an API key in GitHub repository secrets is primarily intended for use within CI/CD pipelines, such as GitHub Actions, to inject sensitive values during build or deployment processes. These secrets are not directly accessible by a running Azure Function application at runtime for making external API calls. Therefore, this approach is unsuitable for an application's operational secret retrieval.
- ✗
Hardcode the API key in the function code.
Why it's wrong here
Hardcoding an API key directly within the function's source code is a critical security anti-pattern and a severe vulnerability. It embeds sensitive credentials into the application's deployable package, making them easily discoverable through code repositories, decompilation, or even accidental logging. This practice compromises the key's confidentiality and makes rotation difficult, posing a significant security risk.
- ✓
Store the API key as an environment variable in the function app settings.
Why this is correct
Storing the API key as an application setting within the Azure Function App configuration is a standard and secure practice for managing secrets. These settings are exposed to the function code as environment variables at runtime, keeping the sensitive key out of the source code. This approach allows for independent management, updates without code redeployment, and benefits from Azure's platform-level access controls.
- ✗
Pass the API key in an HTTP header and include it in the source code.
Why it's wrong here
While passing an API key in an HTTP header is a common authentication mechanism for external REST APIs, including that key directly in the source code to construct the header still constitutes hardcoding. This method fails to address the fundamental security flaw of embedding sensitive credentials within the application's deployable artifact. Regardless of how the key is transmitted, its presence in the source code remains a significant security exposure.
- ✓
Store the API key in Azure Key Vault and retrieve it using Managed Identity.
Why this is correct
Azure Key Vault is a dedicated, highly secure service designed for storing secrets, cryptographic keys, and certificates. By leveraging Managed Identity, an Azure Function can securely authenticate to Key Vault without any hardcoded credentials in its code. This allows the function to retrieve the API key at runtime, providing the highest level of security, auditability, and simplified secret rotation capabilities.
Go deeper
Related to this question
Learn chapter
Azure Functions Development
Key term
Managed identity
A managed identity is an automatically managed service principal in Azure that allows your code to authenticate to any service that supports Azure AD authentication without storing credentials.
Key term
Key Vault Secrets
Key Vault Secrets are secure containers in Microsoft Azure that store sensitive information like passwords, connection strings, and API keys, keeping them encrypted and accessible only to authorized applications and users.
About these practice questions
This AZ-204 question is part of Courseiva's 881-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.