AZ-204 Practice Question: Connect to and consume Azure services and third-party services
You are a developer at Contoso Ltd. The company has an existing .NET Core web application hosted on Azure App Service that allows users to upload images. The application currently stores images directly to Azure Blob Storage using connection strings stored in the Web.config file. The security team has mandated that all secrets must be stored in Azure Key Vault and rotated automatically. Additionally, the application must be able to access the Key Vault without storing any credentials in the application code or configuration files. The application uses Microsoft Entra ID for user authentication. You need to modify the application to meet these requirements with minimal changes to the application code. You have the following resources: an Azure Key Vault instance with the secrets (storage account connection string) already stored; a managed identity enabled for the App Service. You want to use the Key Vault references feature of Azure App Configuration or direct Key Vault access. Which approach should you take?
⚠ Common exam trap
It's easy for candidates to assume that using the Azure Identity SDK (Option D) is the only way to integrate with Key Vault, overlooking the built-in Key Vault references feature in App Service that requires zero code changes and automatically handles secret rotation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
In the Azure portal, update the App Service application settings to reference the Key Vault secrets using the Key Vault references feature. Enable the system-assigned managed identity for the App Service and grant it Get and List permissions on the Key Vault.
It uses the Key Vault references feature in Azure App Service, which allows you to reference secrets stored in Key Vault directly from application settings without any code changes. By enabling the system-assigned managed identity and granting it Get and List permissions on the Key Vault, the App Service can authenticate to Key Vault without storing any credentials in code or configuration files. This approach meets the security team's mandate for automatic secret rotation (Key Vault references are resolved at runtime, so rotated secrets are automatically picked up) and requires minimal changes to the application code.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Set the connection string as an environment variable in the App Service using the Azure CLI and rely on the Key Vault backup.
Why it's wrong here
Setting a connection string directly as an environment variable in App Service, even if initially sourced from Key Vault, bypasses Key Vault's core security benefits. Environment variables are static and do not automatically rotate or refresh when the secret in Key Vault changes, requiring manual updates. Relying on Key Vault backup is irrelevant to how the App Service consumes the secret, as it only protects the Key Vault data itself, not the App Service's access method. This approach fails to provide secure, dynamic secret management.
- ✗
Create an Azure App Configuration store, import the secrets from Key Vault, and change the application to use the App Configuration provider.
Why it's wrong here
While Azure App Configuration can centralize configuration and integrate with Key Vault for secrets, this solution introduces an additional Azure service and necessitates significant application code changes. The application would need to be re-architected to use the App Configuration SDK and provider, which goes beyond simply managing a connection string. This complexity and the required code modifications make it an overly intrusive solution compared to direct Key Vault integration for App Service.
- ✓
In the Azure portal, update the App Service application settings to reference the Key Vault secrets using the Key Vault references feature. Enable the system-assigned managed identity for the App Service and grant it Get and List permissions on the Key Vault.
Why this is correct
This is the recommended and most secure approach. Azure App Service's Key Vault references feature allows application settings to dynamically retrieve secrets from Key Vault at runtime without modifying application code. By enabling a system-assigned managed identity for the App Service and granting it 'Get' and 'List' permissions on the Key Vault, the App Service securely authenticates to Key Vault. This method ensures secrets are never exposed in application settings, supports automatic secret rotation, and adheres to the principle of least privilege.
- ✗
Modify the application code to use the Azure Identity SDK to authenticate to Key Vault via managed identity and retrieve the connection string.
Why it's wrong here
Modifying the application code to directly interact with Key Vault using the Azure Identity SDK, while a valid pattern for some scenarios, introduces unnecessary complexity and code changes for this specific requirement. The goal is often to externalize configuration and secrets from code. This approach couples the application logic directly to the secret retrieval mechanism, making it less flexible and requiring redeployment for changes, unlike the platform-managed Key Vault references feature.
Visual reference
Quick reference
Azure Blob Storage Tier Comparison
| Tier | Storage Cost | Retrieval Cost | Latency | Use Case |
|---|---|---|---|---|
| Hot | Highest | Lowest | Immediate | Active data, frequent reads |
| Cool | Lower | Higher | Immediate | Data accessed < once / month |
| Cold | Lower still | Higher | Immediate | Data accessed < once / quarter |
| Archive | Lowest | Highest + rehydration delay | Hours | Long-term compliance retention |
Go deeper
Related to this question
Learn chapter
Azure Functions Development
Key term
Managed identity
A managed identity is an automatically managed service principal in Azure that allows your code to authenticate to any service that supports Azure AD authentication without storing credentials.
Key term
Key Vault Secrets
Key Vault Secrets are secure containers in Microsoft Azure that store sensitive information like passwords, connection strings, and API keys, keeping them encrypted and accessible only to authorized applications and users.
About these practice questions
One of 881 original AZ-204 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.