AZ-204 Implement Azure security Practice Question
You are a developer for a startup that is building a real-time chat application on Azure. The application uses Azure Web PubSub to broadcast messages to clients. The security team requires that only authenticated users can connect to the Web PubSub service. You plan to use Microsoft Entra ID for authentication. The application backend is an Azure Function that generates access tokens. What is the correct course of action to secure the Web PubSub service?
⚠ Common exam trap
Watch out — candidates often confuse generating a client access token from a connection string (Option D) with using managed identity (Option B), not realizing that the connection string is a static secret that does not enforce user-level authentication, whereas managed identity enables secure, identity-based token generation after user authentication.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable managed identity for the Azure Function, assign it the 'Web PubSub Service Owner' role, and use the Web PubSub SDK to generate a client access token after authenticating the user.
It uses managed identity to securely authenticate the Azure Function to the Web PubSub service without exposing any secrets. The Function then generates a client access token only after the user is authenticated via Microsoft Entra ID, ensuring that only authenticated users can connect to the Web PubSub service. This approach follows the principle of least privilege and avoids distributing shared access keys or connection strings to clients.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Configure the Web PubSub service to use a shared access key and distribute it to clients via the Function.
Why it's wrong here
Distributing a shared access key directly to clients is a severe security vulnerability. Shared access keys grant full administrative access to the Web PubSub service, not just client-specific permissions. Providing such a key to untrusted clients would allow them to perform unauthorized operations, compromising the entire service and bypassing any granular access control.
- ✓
Enable managed identity for the Azure Function, assign it the 'Web PubSub Service Owner' role, and use the Web PubSub SDK to generate a client access token after authenticating the user.
Why this is correct
This is the correct and most secure approach. Enabling a managed identity for the Azure Function allows it to authenticate with Azure Entra ID and subsequently with the Web PubSub service without storing any credentials. Assigning the 'Web PubSub Service Owner' role grants the Function the necessary permissions to generate secure, time-limited client access tokens for authenticated users, adhering to the principle of least privilege.
- ✗
Set the Web PubSub service's 'Anonymous mode' to 'Allow anonymous connections' and authenticate users at the application level.
Why it's wrong here
Setting the Web PubSub service to 'Anonymous mode' means the service itself does not enforce any authentication at the connection point, even if the application performs its own user authentication. This bypasses Azure Entra ID integration for the Web PubSub service, preventing the leverage of Entra ID's robust security features for service-level authorization and secure token generation for clients. It relies solely on application-level authentication, which is not integrated with Web PubSub's native security mechanisms.
- ✗
Use the Web PubSub connection string (access key) in the Function to generate a client token, and store the connection string in Azure Key Vault.
Why it's wrong here
While storing the connection string in Azure Key Vault is a good security practice for secrets management, using it means the Azure Function authenticates to Web PubSub via a shared secret (the access key) rather than an Azure Entra ID identity. This approach does not leverage Entra ID for the Function's authentication to the Web PubSub service, which is a key security benefit of managed identities. The access key is a symmetric key, not an Entra ID token, and its use bypasses Entra ID for the server-side authentication.
Go deeper
Related to this question
Learn chapter
Azure Functions Development
Key term
Key Vault Secrets
Key Vault Secrets are secure containers in Microsoft Azure that store sensitive information like passwords, connection strings, and API keys, keeping them encrypted and accessible only to authorized applications and users.
Key term
Managed identity
A managed identity is an automatically managed service principal in Azure that allows your code to authenticate to any service that supports Azure AD authentication without storing credentials.
About these practice questions
One of 881 original AZ-204 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.