AZ-204 Implement Azure security Practice Question
You are deploying a function app that processes sensitive data. You need to ensure that all function app secrets (e.g., connection strings) are stored securely and automatically rotated. Which service should you use?
⚠ Common exam trap
It's easy for candidates to confuse Azure Managed Identity (an authentication method) with a secret storage service, or they assume Azure App Configuration can handle secret rotation, when in fact it lacks the security guarantees and rotation features of Key Vault.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure Key Vault
Azure Key Vault is the correct service because it provides centralized, hardware-backed storage for secrets such as connection strings, API keys, and certificates. It supports automatic rotation policies via integration with Azure Event Grid and can be triggered by expiration events or custom logic, ensuring secrets are rotated without manual intervention. Function apps can securely reference Key Vault secrets using a managed identity, eliminating the need to store secrets in code or configuration files.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Azure Key Vault
Why this is correct
Azure Key Vault stores connection strings as secrets with versioning, access policies and optional automatic rotation, so the function app retrieves them at runtime via managed identity rather than embedding them in configuration. This satisfies secure storage and rotation for sensitive data.
- ✗
Azure Managed Identity
Why it's wrong here
Managed Identity issues tokens for accessing Azure resources without stored credentials; it does not store or rotate connection strings. It is tempting because it removes secrets from code, but Azure Key Vault stores the secrets and performs automatic rotation, which the scenario explicitly requires.
- ✗
Azure App Configuration
Why it's wrong here
App Configuration stores application settings and feature flags, but its key vault references still rely on Key Vault for secret storage and rotation. It is tempting as centralised configuration, yet it lacks native secret rotation, which the scenario requires from Azure Key Vault.
- ✗
Azure DevOps Variable Groups
Why it's wrong here
Variable Groups hold pipeline variables for build and release automation, not runtime secrets for a deployed function app, and they perform no automatic rotation. It is tempting because values can be masked, but Azure Key Vault stores and rotates the function app's connection strings.
Go deeper
Related to this question
Learn chapter
Custom RBAC Roles in Azure
Key term
Managed identity
A managed identity is an automatically managed service principal in Azure that allows your code to authenticate to any service that supports Microsoft Entra ID authentication without storing credentials.
Key term
Azure Event Grid
Azure Event Grid is a fully managed event routing service that allows applications and services to react to events in real time using a publish-subscribe model.
About these practice questions
One of 883 original AZ-204 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.