AZ-204 Implement Azure security Practice Question
You are deploying a function app that processes sensitive data. You need to ensure that all function app secrets (e.g., connection strings) are stored securely and automatically rotated. Which service should you use?
⚠ Common exam trap
It's easy for candidates to confuse Azure Managed Identity (an authentication method) with a secret storage service, or they assume Azure App Configuration can handle secret rotation, when in fact it lacks the security guarantees and rotation features of Key Vault.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure Key Vault
Azure Key Vault is the correct service because it provides centralized, hardware-backed storage for secrets such as connection strings, API keys, and certificates. It supports automatic rotation policies via integration with Azure Event Grid and can be triggered by expiration events or custom logic, ensuring secrets are rotated without manual intervention. Function apps can securely reference Key Vault secrets using a managed identity, eliminating the need to store secrets in code or configuration files.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Azure Key Vault
Why this is correct
Key Vault securely stores secrets and supports automatic rotation.
- ✗
Azure Managed Identity
Why it's wrong here
Managed Identity provides an identity, not a secret store.
- ✗
Azure App Configuration
Why it's wrong here
App Configuration is for configuration management, not secret rotation.
- ✗
Azure DevOps Variable Groups
Why it's wrong here
Variable groups are for pipeline variables, not production secret management.
Go deeper
Related to this question
Learn chapter
Azure Functions Development
Key term
Managed identity
A managed identity is an automatically managed service principal in Azure that allows your code to authenticate to any service that supports Azure AD authentication without storing credentials.
Key term
Azure Event Grid
Azure Event Grid is a fully managed event routing service that allows applications and services to react to events in real time using a publish-subscribe model.
About these practice questions
One of 881 original AZ-204 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.