AZ-204 Practice Question: Connect to and consume Azure services and third-party services
You are designing a solution to send email notifications from an Azure App Service web app. The app must use a third-party email service that requires an API key. You need to minimize management overhead and ensure the key is rotated automatically. What should you do?
⚠ Common exam trap
It's easy for candidates to confuse managed identity as a universal authentication mechanism for any service, when in fact it only works with Azure AD-integrated services, not third-party APIs that require static API keys.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Store the API key in Azure Key Vault and use a managed identity to retrieve it
It uses Azure Key Vault to securely store the third-party API key, and a system-assigned managed identity to authenticate the App Service to Key Vault without managing credentials. This minimizes management overhead by eliminating manual key rotation (Key Vault can rotate secrets automatically) and removes the need to store secrets in code or configuration.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use a system-assigned managed identity to authenticate to the email service
Why it's wrong here
Using a system-assigned managed identity to authenticate directly to a third-party email service is not feasible. Managed identities provide an Azure Active Directory identity for Azure resources, enabling them to authenticate to other Azure AD-protected services without managing credentials. However, most external email services do not support Azure AD authentication directly, instead requiring API keys, OAuth tokens, or service-specific credentials, which managed identities cannot provide for direct external service authentication.
- ✗
Store the API key in the App Service application settings
Why it's wrong here
Storing the API key in App Service application settings is generally not recommended for highly sensitive secrets. While convenient, these settings are not encrypted at rest by default within the App Service configuration files, posing a potential security vulnerability. Furthermore, application settings lack built-in features for automatic key rotation, versioning, or granular access control, making manual management cumbersome and less secure for production environments requiring robust secret management.
- ✗
Create an Azure Logic App to send emails and call it from the web app
Why it's wrong here
Creating an Azure Logic App to send emails and calling it from the web app introduces unnecessary architectural complexity and does not inherently solve the core security problem. This approach merely shifts the responsibility of securely storing and managing the email service's API key from the web app to the Logic App. The Logic App itself would still require a secure mechanism, such as Azure Key Vault, to store its credentials, and this option does not directly address the crucial aspect of API key rotation.
- ✓
Store the API key in Azure Key Vault and use a managed identity to retrieve it
Why this is correct
Storing the API key in Azure Key Vault and using a managed identity to retrieve it is the most secure and recommended approach. Azure Key Vault is designed for secure storage of secrets, offering encryption at rest, auditing, and fine-grained access policies. A system-assigned managed identity for the web app can be granted specific permissions to access the secret in Key Vault, eliminating the need to hardcode credentials and enabling secure, automatic rotation of the API key within Key Vault, adhering to the principle of least privilege.
Go deeper
Related to this question
Learn chapter
Azure Functions Development
Key term
Managed identity
A managed identity is an automatically managed service principal in Azure that allows your code to authenticate to any service that supports Azure AD authentication without storing credentials.
Key term
Key Vault Secrets
Key Vault Secrets are secure containers in Microsoft Azure that store sensitive information like passwords, connection strings, and API keys, keeping them encrypted and accessible only to authorized applications and users.
About these practice questions
This AZ-204 question is part of Courseiva's 881-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.