AZ-204 Implement Azure security Practice Question
You are designing a solution that uses Azure Event Hubs to ingest telemetry data. The data must be encrypted at rest and in transit. Additionally, you need to ensure that only authorized applications can publish messages to the event hub. Which combination of features should you use?
⚠ Common exam trap
The trap here is that candidates often over-engineer the solution by selecting advanced features like customer-managed keys or Private Link, when the default encryption and simple authentication mechanisms already satisfy the stated requirements.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use SAS tokens or managed identities for authentication, and rely on default encryption at rest and in transit.
Azure Event Hubs automatically encrypts data at rest with Azure Storage Service Encryption (SSE) and in transit with TLS 1.2. For authorization, SAS tokens or managed identities provide the necessary application-level authentication to publish messages. This combination meets all stated requirements without additional configuration.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use managed identities for applications and enable encryption at rest using customer-managed keys.
Why it's wrong here
While managed identities are a valid authentication mechanism for Azure resources, enabling encryption at rest using customer-managed keys (CMK) is an optional enhancement, not a fundamental requirement for basic security, as Event Hubs already provides default encryption at rest using Microsoft-managed keys. The question implies a general solution design, and CMK adds complexity without being strictly necessary for "encryption at rest" itself, which is already handled by default. This option combines a correct authentication method with an unnecessary or overly specific encryption method for a general design.
- ✓
Use SAS tokens or managed identities for authentication, and rely on default encryption at rest and in transit.
Why this is correct
This option correctly identifies the standard and recommended security practices for Azure Event Hubs. Both Shared Access Signatures (SAS) and Managed Identities are valid and widely used mechanisms for authenticating applications to Event Hubs, providing robust authorization. Furthermore, Azure Event Hubs automatically encrypts data at rest using Microsoft-managed keys and encrypts all data in transit using Transport Layer Security (TLS), fulfilling essential encryption requirements without requiring additional configuration.
- ✗
Use Azure Private Link to connect applications to Event Hubs.
Why it's wrong here
Azure Private Link establishes a private endpoint for the Event Hubs namespace within a virtual network, ensuring network isolation and preventing data exposure to the public internet. While crucial for network security and compliance, Private Link primarily addresses network connectivity and access control at the network layer, not the authentication and authorization of individual applications or users accessing the Event Hubs data plane. It doesn't replace the need for authentication mechanisms like SAS tokens or managed identities.
- ✗
Enable Azure Firewall on the Event Hubs namespace and use IP filtering.
Why it's wrong here
Azure Firewall is a managed, cloud-based network security service that protects Azure Virtual Network resources. While Event Hubs namespaces can utilize IP filtering rules to restrict incoming connections to specific IP addresses or ranges, this mechanism controls network access to the service endpoint, not the authentication or authorization of the applications attempting to send or receive events. IP filtering is a network-level control and does not validate the identity or permissions of the connecting client.
Go deeper
Related to this question
Learn chapter
Azure Functions Development
Key term
Azure Storage Encryption
Azure Storage Encryption is the process of protecting data stored in Azure cloud storage by converting it into an unreadable format using encryption keys, ensuring only authorized parties can access it.
Key term
Azure Event Hubs
Azure Event Hubs is a cloud-based service that ingests and processes millions of events per second from devices, applications, and services in real time.
About these practice questions
This AZ-204 question is part of Courseiva's 881-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.