Courseiva
Implement Azure securityhardMultiple ChoiceObjective-mapped

AZ-204 Implement Azure security Practice Question

You are designing a solution that uses Azure Event Hubs to ingest telemetry data. The data must be encrypted at rest and in transit. Additionally, you need to ensure that only authorized applications can publish messages to the event hub. Which combination of features should you use?

⚠ Common exam trap

The trap here is that candidates often over-engineer the solution by selecting advanced features like customer-managed keys or Private Link, when the default encryption and simple authentication mechanisms already satisfy the stated requirements.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

Use SAS tokens or managed identities for authentication, and rely on default encryption at rest and in transit.

Azure Event Hubs automatically encrypts data at rest with Azure Storage Service Encryption (SSE) and in transit with TLS 1.2. For authorization, SAS tokens or managed identities provide the necessary application-level authentication to publish messages. This combination meets all stated requirements without additional configuration.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

  • Use managed identities for applications and enable encryption at rest using customer-managed keys.

    Why it's wrong here

    While managed identities are a valid authentication mechanism for Azure resources, enabling encryption at rest using customer-managed keys (CMK) is an optional enhancement, not a fundamental requirement for basic security, as Event Hubs already provides default encryption at rest using Microsoft-managed keys. The question implies a general solution design, and CMK adds complexity without being strictly necessary for "encryption at rest" itself, which is already handled by default. This option combines a correct authentication method with an unnecessary or overly specific encryption method for a general design.

  • Use SAS tokens or managed identities for authentication, and rely on default encryption at rest and in transit.

    Why this is correct

    This option correctly identifies the standard and recommended security practices for Azure Event Hubs. Both Shared Access Signatures (SAS) and Managed Identities are valid and widely used mechanisms for authenticating applications to Event Hubs, providing robust authorization. Furthermore, Azure Event Hubs automatically encrypts data at rest using Microsoft-managed keys and encrypts all data in transit using Transport Layer Security (TLS), fulfilling essential encryption requirements without requiring additional configuration.

  • Use Azure Private Link to connect applications to Event Hubs.

    Why it's wrong here

    Azure Private Link establishes a private endpoint for the Event Hubs namespace within a virtual network, ensuring network isolation and preventing data exposure to the public internet. While crucial for network security and compliance, Private Link primarily addresses network connectivity and access control at the network layer, not the authentication and authorization of individual applications or users accessing the Event Hubs data plane. It doesn't replace the need for authentication mechanisms like SAS tokens or managed identities.

  • Enable Azure Firewall on the Event Hubs namespace and use IP filtering.

    Why it's wrong here

    Azure Firewall is a managed, cloud-based network security service that protects Azure Virtual Network resources. While Event Hubs namespaces can utilize IP filtering rules to restrict incoming connections to specific IP addresses or ranges, this mechanism controls network access to the service endpoint, not the authentication or authorization of the applications attempting to send or receive events. IP filtering is a network-level control and does not validate the identity or permissions of the connecting client.

About these practice questions

This AZ-204 question is part of Courseiva's 881-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

JA

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.