AZ-204 Implement Azure security Practice Question
You are developing a serverless function app that processes credit card payments. The function app must securely store the payment gateway API key. Which Azure service should you use to store the key?
⚠ Common exam trap
A common mix-up: candidates choose application settings (Option D) because they are convenient and commonly used for non-sensitive configuration, but they fail to recognize that secrets like API keys require the dedicated security and access control provided by Key Vault.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Store the key in Azure Key Vault and retrieve it using a managed identity.
Azure Key Vault is the designated service for securely storing and managing secrets, keys, and certificates. By using a managed identity, the function app can authenticate to Key Vault without embedding any credentials in code or configuration, ensuring the API key is never exposed in plaintext.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Store the key in an Azure Storage queue and read it at runtime.
Why it's wrong here
Azure Storage queues are designed for asynchronous message passing between application components, not for secure storage of sensitive data like API keys. Messages in a queue are typically transient and lack the robust access control, auditing, and encryption at rest features required for secrets management. Storing a key here would expose it to any process with queue access and would not provide the necessary lifecycle management or rotation capabilities.
- ✓
Store the key in Azure Key Vault and retrieve it using a managed identity.
Why this is correct
Azure Key Vault is purpose-built for securely storing and managing cryptographic keys, secrets, and certificates, offering strong encryption at rest, access policies, and comprehensive auditing. Utilizing a managed identity for the function app allows it to authenticate to Azure AD and then to Key Vault without any hardcoded credentials in the application code or configuration. This establishes a secure, credential-less connection, adhering to the principle of least privilege and simplifying secret rotation.
- ✗
Store the key in Azure Cosmos DB with client-side encryption.
Why it's wrong here
Azure Cosmos DB is a globally distributed, multi-model database service optimized for high-throughput and low-latency data access, not for secure secret management. While client-side encryption can protect data within Cosmos DB, it introduces significant operational complexity by requiring the application to manage the encryption keys used for the client-side encryption itself. This approach essentially shifts the secret storage problem rather than solving it securely and efficiently, as those encryption keys would still need secure storage.
- ✗
Store the key in the function app's application settings.
Why it's wrong here
Storing sensitive keys directly in a function app's application settings is insecure because these settings are stored unencrypted and are easily viewable by anyone with contributor access to the Azure subscription via the Azure portal, Azure CLI, or PowerShell. This method lacks the robust security controls, auditing, and secret rotation capabilities essential for protecting sensitive credentials. It creates a significant security vulnerability, making it unsuitable for production environments.
Quick reference
Cloud Service Model Comparison
| Model | You Manage | Provider Manages | Examples |
|---|---|---|---|
| IaaS | OS, runtime, apps, data | Hardware, hypervisor, networking | EC2, Azure VMs, GCP Compute Engine |
| PaaS | Apps and data | OS, runtime, middleware, hardware | Elastic Beanstalk, Azure App Service |
| SaaS | Data and settings only | Everything else | Microsoft 365, Salesforce, Workday |
| FaaS / Serverless | Function code only | Infra, scaling, runtime | Lambda, Azure Functions, Cloud Run |
| CaaS | Containers and apps | Kubernetes, OS, hardware | EKS, AKS, GKE |
Go deeper
Related to this question
Learn chapter
Azure Functions Development
Key term
Key Vault Secrets
Key Vault Secrets are secure containers in Microsoft Azure that store sensitive information like passwords, connection strings, and API keys, keeping them encrypted and accessible only to authorized applications and users.
Key term
Managed identity
A managed identity is an automatically managed service principal in Azure that allows your code to authenticate to any service that supports Azure AD authentication without storing credentials.
About these practice questions
One of 881 original AZ-204 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.