Connect to and consume Azure services and third-party services →mediumMultiple ChoiceObjective-mapped
AZ-204 Practice Question: Connect to and consume Azure services and third-party services
You are deploying a microservices application to Azure Kubernetes Service (AKS). One service needs to retrieve configuration values from Azure App Configuration. The configuration includes sensitive values that must be stored in Azure Key Vault. The solution should not require application code changes to reference Key Vault. What should you use?
⚠ Common exam trap
A common mix-up: candidates assume managed identity (Option B) is the correct answer because it avoids storing credentials, but they overlook that it still requires code changes to call Key Vault directly, whereas Key Vault references in App Configuration provide a code-free integration.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Store the configuration values as Key Vault references in Azure App Configuration.
Azure App Configuration supports Key Vault references, which allow you to store a reference to a secret in Key Vault rather than the secret itself. When the application retrieves the configuration value, App Configuration automatically resolves the reference and fetches the secret from Key Vault, requiring no code changes. This satisfies the requirement of storing sensitive values in Key Vault while keeping the application code unchanged.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Store the configuration values as Key Vault references in Azure App Configuration.
Why this is correct
Storing configuration values as Key Vault references in Azure App Configuration is the most robust solution for microservices. Azure App Configuration automatically resolves these references at runtime, fetching the actual secret value from Key Vault using its own managed identity. This centralizes configuration management, enhances security by keeping secrets out of application code, and allows for dynamic updates without redeploying microservices.
- ✗
Use Azure AD managed identity to access Key Vault directly from the service.
Why it's wrong here
While using an Azure AD managed identity to access Key Vault directly from the service provides secure authentication, it still requires each microservice to implement custom code to interact with the Key Vault SDK. This approach introduces direct coupling between the application and Key Vault, necessitating application-level logic for secret retrieval, caching, and refresh. It fails to centralize configuration management and adds development complexity.
- ✗
Store the secrets in Kubernetes Secrets and mount them as environment variables.
Why it's wrong here
Storing secrets in Kubernetes Secrets and mounting them as environment variables is less secure and lacks centralized management. Kubernetes Secrets are only base64 encoded by default, not encrypted at rest without specific cluster configurations, making them vulnerable if the cluster is compromised. This method also provides no integration with Azure's identity and access management and complicates secret rotation and auditing across multiple services.
- ✗
Use the Azure Key Vault SDK directly in the service to retrieve secrets.
Why it's wrong here
Using the Azure Key Vault SDK directly within each service to retrieve secrets tightly couples the application code to the secret management solution. This requires developers to write boilerplate code in every microservice for authentication, secret retrieval, and error handling. Such an approach hinders maintainability, increases development effort, and makes it difficult to change secret sources or update configurations dynamically across the application.
Visual reference
Go deeper
Related to this question
Learn chapter
Azure Functions Development
Key term
Key Vault Secrets
Key Vault Secrets are secure containers in Microsoft Azure that store sensitive information like passwords, connection strings, and API keys, keeping them encrypted and accessible only to authorized applications and users.
Key term
Azure App Configuration
Azure App Configuration is a managed Azure service that stores and manages application settings and feature flags separately from your code, allowing you to update them without redeploying or restarting your application.
About these practice questions
This AZ-204 question is part of Courseiva's 881-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.