Connect to and consume Azure services and third-party services →mediumMultiple ChoiceObjective-mapped
AZ-204 Practice Question: Connect to and consume Azure services and third-party services
You are developing a mobile app that uses Azure Cognitive Services to analyze images. The app must authenticate to the Computer Vision API using a key that is rotated monthly. What is the best practice for handling the key?
⚠ Common exam trap
Candidates often assume managed identity works directly for client-side applications like mobile apps, or that Cognitive Services APIs can be directly authenticated with a managed identity without first acquiring a key or an Azure AD token. While a backend service can use a managed identity to acquire a token or retrieve a key, a mobile app itself does not use a system-assigned managed identity.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Store the key in Azure App Configuration with Key Vault references and retrieve it at runtime
Azure App Configuration with Key Vault references provides a secure, centralized way to store and rotate secrets like API keys without embedding them in code or requiring redeployment. A secure backend service (e.g., an Azure Function or App Service) that the mobile app interacts with would retrieve the key at runtime via a managed identity, ensuring the key is never stored locally on the mobile device and can be rotated monthly by updating Key Vault, with App Configuration automatically fetching the latest version. The mobile app would then call this backend service, which in turn authenticates to Cognitive Services.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Store the key in Azure App Configuration with Key Vault references and retrieve it at runtime
Why this is correct
Storing the key in Azure App Configuration with Key Vault references and retrieving it at runtime provides a robust and secure solution. A backend service, not the mobile app directly, would fetch the secret from App Configuration, which in turn securely retrieves it from Key Vault. This architecture enables dynamic key rotation in Key Vault without requiring any redeployment of the backend service or updates to the mobile application, significantly enhancing security posture and operational agility by centralizing secret management.
- ✗
Use a system-assigned managed identity and acquire a token for Cognitive Services
Why it's wrong here
Using a system-assigned managed identity directly from a mobile app is fundamentally incorrect because managed identities are assigned to Azure resources, not client applications. While a backend service could use a managed identity to authenticate with some Azure services, not all Cognitive Services currently support managed identity authentication, often still requiring API keys. Furthermore, even if supported, the mobile app would still need a secure way to authenticate with the backend service, and the backend would then handle the managed identity authentication, making this option misapplied for a direct mobile app context.
- ✗
Prompt the user to enter the key on first launch
Why it's wrong here
Prompting the user to enter the key on first launch is a severe security vulnerability and a poor user experience. This approach exposes the sensitive API key directly to the end-user, who could then misuse it or inadvertently compromise it. Furthermore, it places an unnecessary burden on the user to manage a technical secret, which is neither user-friendly nor scalable for application distribution and maintenance.
- ✗
Store the key in the mobile app's local secure storage after initial retrieval
Why it's wrong here
Storing the key in the mobile app's local secure storage, even after initial retrieval, introduces significant security risks and operational challenges. While local secure storage offers some protection against casual access, it remains vulnerable to sophisticated attacks like reverse engineering or jailbreaking, potentially exposing the key. Moreover, any requirement for key rotation would necessitate a new version of the mobile app to be developed, tested, and distributed to all users, leading to cumbersome updates and potential service disruptions.
Go deeper
Related to this question
Learn chapter
Azure Functions Development
Key term
Managed identity
A managed identity is an automatically managed service principal in Azure that allows your code to authenticate to any service that supports Azure AD authentication without storing credentials.
Key term
Key Vault Secrets
Key Vault Secrets are secure containers in Microsoft Azure that store sensitive information like passwords, connection strings, and API keys, keeping them encrypted and accessible only to authorized applications and users.
About these practice questions
Courseiva writes every AZ-204 question from scratch — 881 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.