AZ-204 Implement Azure security Practice Question
Which TWO methods can you use to authenticate an Azure App Service web app to Azure SQL Database without storing credentials in code? (Choose two.)
⚠ Common exam trap
Candidates often confuse 'storing credentials in code' with 'storing credentials in configuration' and may incorrectly select Option D (service principal with client secret) thinking it is secure, but the secret is still stored in app settings, which is not credential-free.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Store the SQL connection string in Azure Key Vault and use a Key Vault reference in the app settings.
Azure App Service supports Key Vault references in application settings, allowing you to reference secrets stored in Azure Key Vault without hardcoding credentials. This pattern uses the Managed Service Identity (MSI) of the App Service to authenticate to Key Vault at runtime, retrieving the SQL connection string securely. Option B is correct because enabling a system-assigned managed identity on the App Service and granting it access to the Azure SQL Database via an Azure AD user or contained database user eliminates the need for any stored credentials, as the app authenticates directly to SQL using the managed identity token.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Store the SQL connection string in Azure Key Vault and use a Key Vault reference in the app settings.
Why this is correct
This method significantly enhances security by storing sensitive connection strings and other secrets in Azure Key Vault, a robust, centralized secret management service. The App Service then uses Key Vault references (e.g., @Microsoft.KeyVault(SecretUri=...)) in its application settings. At runtime, the App Service securely resolves these references, fetching the secret directly from Key Vault without exposing it in configuration files or code, thus preventing hardcoding and simplifying credential rotation.
- ✓
Enable a system-assigned managed identity on the App Service and grant it access to the database.
Why this is correct
Enabling a system-assigned managed identity provides an automatically managed identity for the Azure App Service within Azure Active Directory. This identity can then be granted specific Azure RBAC roles or SQL permissions directly on the Azure SQL Database. The App Service uses this identity to authenticate with Azure AD-enabled services like Azure SQL Database, completely eliminating the need for developers to manage any connection strings, usernames, or passwords in the application code or configuration.
- ✗
Use a connection string with a SQL username and password.
Why it's wrong here
Storing a SQL connection string directly within the application's configuration files (e.g., web.config, appsettings.json) or embedding it in source code is a significant security vulnerability. This approach exposes sensitive usernames and passwords, making them susceptible to unauthorized access if the configuration files are compromised or the code repository is breached. It also complicates credential rotation and management, as changes require application redeployment.
- ✗
Use a service principal with a client secret stored in app settings.
Why it's wrong here
While a service principal provides an identity for applications, storing its client secret directly in the App Service's application settings introduces a similar security risk to hardcoding user credentials. The client secret, which acts as a password for the service principal, becomes part of the application's configuration. If these settings are compromised, the service principal's identity can be misused, potentially granting broad access to Azure resources.
- ✗
Use a client certificate installed on the App Service.
Why it's wrong here
Using a client certificate for authentication requires the certificate to be securely installed and managed on the App Service instance. This approach introduces operational complexities related to certificate lifecycle management, including issuance, renewal, and revocation. Improper handling or storage of the private key associated with the certificate can lead to security breaches, making it less ideal than managed identity or Key Vault for simplified, secure authentication.
Go deeper
Related to this question
Learn chapter
Azure Functions Development
Key term
Key Vault Secrets
Key Vault Secrets are secure containers in Microsoft Azure that store sensitive information like passwords, connection strings, and API keys, keeping them encrypted and accessible only to authorized applications and users.
Key term
Managed identity
A managed identity is an automatically managed service principal in Azure that allows your code to authenticate to any service that supports Azure AD authentication without storing credentials.
About these practice questions
This AZ-204 question is part of Courseiva's 881-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.