AZ-204 Implement Azure security Practice Question
You are deploying a web app on Azure App Service that stores secrets in Azure Key Vault. The app uses managed identity to access Key Vault. During testing, you get a 403 Forbidden error when the app tries to read a secret. What is the most likely cause?
⚠ Common exam trap
Test-takers frequently confuse authentication (401) with authorization (403) and may incorrectly assume the managed identity is not assigned (Option A) when the actual issue is a missing access policy permission (Option C).
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The Key Vault access policy does not grant the managed identity the 'Get' permission for secrets.
The 403 Forbidden error indicates that the request was authenticated but not authorized. Since the app uses managed identity to access Key Vault, the most likely cause is that the Key Vault access policy does not grant the managed identity the 'Get' permission for secrets. Without this specific permission, the identity can authenticate but cannot retrieve secret values, resulting in a 403 response.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The managed identity is not assigned to the app.
Why it's wrong here
If a managed identity is not assigned to the Azure App Service app, the application would fail at the initial authentication step when attempting to acquire an access token for Azure Key Vault. This failure would typically manifest as an authentication error or a token acquisition failure, preventing any subsequent authorization checks. A 403 Forbidden error, however, indicates that authentication was successful, but the authenticated identity lacks the necessary permissions to perform the requested operation.
- ✗
The Key Vault has soft-delete enabled.
Why it's wrong here
Enabling soft-delete on an Azure Key Vault is a data protection feature that retains deleted keys, secrets, and certificates for a specified period, allowing for recovery. This configuration setting primarily affects the lifecycle and recoverability of Key Vault objects, not the runtime access permissions for an authenticated identity. Therefore, soft-delete being enabled would not cause an application to receive a 403 Forbidden error when attempting to retrieve a secret.
- ✓
The Key Vault access policy does not grant the managed identity the 'Get' permission for secrets.
Why this is correct
When an Azure App Service app, authenticated via a managed identity, attempts to retrieve a secret from Key Vault, the Key Vault's access policy is consulted for authorization. If the managed identity is not explicitly granted the 'Get' permission for secrets within that Key Vault's access policy, the request will be denied. This specific denial of a permitted action, despite successful authentication, directly results in an HTTP 403 Forbidden status code.
- ✗
The Key Vault firewall is set to allow only selected networks.
Why it's wrong here
An Azure Key Vault firewall configured to allow only selected networks operates at the network layer, restricting which IP addresses or virtual networks can establish a connection to the Key Vault. If the App Service app's outbound IP address is not included in the allowed list, the connection attempt would be blocked at the network perimeter. This would typically result in a network-level error, such as a connection timeout or host unreachable, rather than an HTTP 403 Forbidden response, which is an application-level authorization error returned by the Key Vault service itself.
Go deeper
Related to this question
Learn chapter
Azure Functions Development
Key term
Managed identity
A managed identity is an automatically managed service principal in Azure that allows your code to authenticate to any service that supports Azure AD authentication without storing credentials.
Key term
Key Vault Secrets
Key Vault Secrets are secure containers in Microsoft Azure that store sensitive information like passwords, connection strings, and API keys, keeping them encrypted and accessible only to authorized applications and users.
About these practice questions
This AZ-204 question is part of Courseiva's 881-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.