AZ-204 Implement Azure security Practice Question
You are building an Azure Function that processes messages from an Azure Service Bus queue. The function must read a secret from Azure Key Vault at startup. The Key Vault has public network access disabled and is reachable only through a private endpoint in the same virtual network as the function's virtual network integration. The function's managed identity has been granted the Key Vault Secrets User role. The function fails to retrieve the secret at runtime. What should you do?
⚠ Common exam trap
The trap here is treating a private-endpoint connectivity failure as a permissions problem and changing RBAC roles instead of fixing DNS and virtual network integration.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Ensure the function app has virtual network integration enabled and that its DNS resolution uses the private endpoint's private DNS zone.
When Key Vault public network access is disabled, clients must connect through the private endpoint, which requires virtual network integration for outbound traffic and DNS resolution to the private IP. The managed identity and role assignment are already correct, so the missing pieces are network integration and private DNS configuration.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Grant the function's managed identity the Key Vault Contributor role instead of Secrets User.
Why it's wrong here
The Secrets User role already permits reading secret values, so a permissions change is unnecessary and Contributor would not fix a network connectivity problem. The error is caused by the function being unable to reach the Key Vault endpoint, not by insufficient role permissions. Changing roles does not affect private endpoint reachability or DNS.
- ✗
Add the function's outbound IP addresses to the Key Vault firewall allow list.
Why it's wrong here
Adding outbound IPs to the firewall is appropriate when Key Vault permits public access with IP restrictions. Here public network access is disabled and access is only via private endpoint, so firewall allow lists have no effect. The failure is caused by the function not resolving the private endpoint, not by an IP restriction.
- ✓
Ensure the function app has virtual network integration enabled and that its DNS resolution uses the private endpoint's private DNS zone.
Why this is correct
With public network access disabled, the function must reach Key Vault through the private endpoint. That requires virtual network integration for outbound traffic and correct DNS resolution to the private IP via the privatelink.vaultcore.azure.net private DNS zone. Without these, the function resolves the public endpoint, which is blocked, causing the failure.
- ✗
Enable the Key Vault soft-delete and purge protection features to allow secret retrieval.
Why it's wrong here
Soft-delete and purge protection govern deletion and recovery of vault objects, not read access. They have no bearing on whether a function can connect to the vault. Enabling them would not resolve a connectivity failure caused by private endpoint DNS resolution, so this does not address the actual runtime problem.
Visual reference
Go deeper
Related to this question
Learn chapter
App Service Auto-Scaling
Key term
Key Vault Secrets
Key Vault Secrets are secure containers in Microsoft Azure that store sensitive information like passwords, connection strings, and API keys, keeping them encrypted and accessible only to authorized applications and users.
Key term
Azure Service Bus
Azure Service Bus is a cloud-based message broker that allows applications, services, and devices to send and receive messages reliably, even when they are not all running at the same time.
About these practice questions
This AZ-204 question is part of Courseiva's 883-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Microsoft exam blueprint
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.