AZ-204 Implement Azure security Practice Question
You are designing a solution to store application secrets. You need to ensure that secrets are encrypted at rest and access is audited. Which TWO Azure services should you use?
⚠ Common exam trap
Watch out — candidates often confuse Azure App Configuration with Key Vault, but App Configuration is for non-sensitive settings (e.g., feature flags) and lacks the encryption-at-rest and auditing guarantees required for secrets, while Key Vault is the dedicated service for secure secret storage and access logging.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure Monitor
Azure Monitor is correct because it provides the auditing and logging capabilities required to track access to secrets. By enabling diagnostic settings on Key Vault, you can send audit events (e.g., secret get, set, delete) to a Log Analytics workspace, storage account, or Event Hub, which are then queryable via Azure Monitor Logs. This satisfies the requirement for access auditing.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Azure SQL Database
Why it's wrong here
Azure SQL Database is primarily designed for relational data storage and querying, not for secure application secret management. While data can be encrypted at rest, it lacks the specialized features of a dedicated secret store, such as granular access policies for individual secrets, automatic secret rotation, and comprehensive audit logging specifically tailored for secret access. Storing secrets directly in a database would complicate key management and increase the attack surface, making it an unsuitable choice for this purpose.
- ✓
Azure Monitor
Why this is correct
Azure Monitor is a comprehensive solution for collecting, analyzing, and acting on telemetry from Azure and on-premises environments. While it does not store application secrets itself, it is crucial for monitoring the security and access patterns of a dedicated secret store like Azure Key Vault. By integrating with Key Vault diagnostic logs, Azure Monitor enables auditing of secret access, detection of anomalous behavior, and alerting on security incidents, thereby enhancing the overall security posture of the secret management solution.
- ✓
Azure Key Vault
Why this is correct
Azure Key Vault is the recommended service for securely storing and managing application secrets, cryptographic keys, and certificates. It encrypts secrets at rest and in transit, providing hardware security module (HSM)-backed protection for keys. Key Vault offers robust access control through Azure Role-Based Access Control (RBAC) and access policies, along with comprehensive audit logs that detail all operations performed on secrets, ensuring strong governance and compliance for sensitive application data.
- ✗
Azure Storage Account with encryption
Why it's wrong here
Azure Storage Accounts are designed for storing large amounts of unstructured data like blobs, files, queues, and tables, and they offer encryption at rest and in transit. However, they are not optimized for managing application secrets due to their lack of granular, secret-specific access policies and robust audit logging capabilities tailored for individual secret access. While data can be secured, a storage account does not provide the specialized secret lifecycle management or the fine-grained control over who can access *specific* secrets that a dedicated secret store offers.
- ✗
Azure App Configuration
Why it's wrong here
Azure App Configuration is designed to centralize application settings and feature flags, providing dynamic configuration management for applications. While it can store configuration values, it is not intended as a secure secret store and does not encrypt values by default. For sensitive information, App Configuration typically integrates with Azure Key Vault to reference secrets, rather than storing them directly, as it lacks the dedicated security features like hardware-backed protection, granular secret-specific access policies, and comprehensive audit trails for secret access.
Go deeper
Related to this question
About these practice questions
This AZ-204 question is part of Courseiva's 881-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.