AZ-204 Develop Azure compute solutions Practice Question
Network Topology
You are creating an Azure Container Instance using the Azure CLI command shown in the exhibit. The container needs to connect to a SQL database. After running the command, you notice that the DB_PASSWORD environment variable is visible in the container's logs. What is the most likely reason?
⚠ Common exam trap
Many candidates assume `--secure-environment-variables` fully protects the variable from any exposure, but it only masks it in Azure's management plane, not from the container's own logging or process environment.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The container image logs environment variables at startup, exposing the secure variable.
The `--secure-environment-variables` flag in Azure CLI for Azure Container Instances does not prevent the values from being logged by the container itself. The flag only masks the values in the Azure portal and CLI output, but if the container image explicitly logs environment variables at startup (e.g., via a startup script or application code), the secure variable will be exposed in the container logs. The issue is not with Azure's handling but with the container image's behavior.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The --secure-environment-variables flag is misspelled.
Why it's wrong here
The flag `--secure-environment-variables` is correctly spelled and is a valid parameter when creating an Azure Container Instance (ACI) via the Azure CLI. Its purpose is specifically to prevent the values of the specified environment variables from being displayed in the Azure portal, Azure CLI, or ACI logs generated by the Azure platform itself. Therefore, the premise that the flag is misspelled is incorrect, as it adheres to the standard naming convention for CLI parameters.
- ✗
The --secure-environment-variables flag is not supported for ACI.
Why it's wrong here
The `--secure-environment-variables` flag is indeed fully supported for Azure Container Instances. This feature is crucial for injecting sensitive information, such as database passwords or API keys, into a container securely without exposing them in the Azure portal's configuration views or through standard `az container show` commands. Its availability ensures that ACI deployments can adhere to security best practices by protecting secrets at the platform level.
- ✗
The DB_PASSWORD value contains special characters that were not escaped.
Why it's wrong here
While it is generally good practice to escape special characters in shell commands or configuration files to prevent parsing issues, the `--secure-environment-variables` flag in Azure CLI handles the secure injection of values, including those with special characters, without requiring manual escaping for the *platform* to process them correctly. The core issue here is not a failure of the ACI platform to parse the variable due to unescaped characters, but rather the potential for the *container application itself* to expose the value after it has been securely provided.
- ✓
The container image logs environment variables at startup, exposing the secure variable.
Why this is correct
Although the `--secure-environment-variables` flag prevents the `DB_PASSWORD` from being visible in the Azure portal, Azure CLI output, or platform-generated logs, it does not prevent the application *running inside the container* from accessing and subsequently logging that variable. If the container's startup script or application code is configured to print all environment variables or specifically the `DB_PASSWORD` to `stdout` or `stderr`, this sensitive information will then appear in the container's application logs, effectively circumventing the platform's security measure. This scenario represents a common vulnerability where application-level logging exposes data that was securely injected.
Go deeper
Related to this question
About these practice questions
Courseiva writes every AZ-204 question from scratch — 881 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.