AZ-204 Practice Question: Connect to and consume Azure services and third-party services
You are developing a solution that needs to retrieve secrets from Azure Key Vault. The solution will run as an Azure App Service managed identity. Which authentication method should you use?
⚠ Common exam trap
A common mix-up: candidates choose ClientSecretCredential because they think a secret is required, but they overlook that DefaultAzureCredential automatically handles managed identity authentication without needing to store any credentials.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
DefaultAzureCredential
DefaultAzureCredential is the correct choice because it automatically chains multiple authentication sources, including managed identity, environment variables, and Visual Studio credentials. When running in an Azure App Service with a managed identity enabled, DefaultAzureCredential will first attempt to authenticate using the managed identity endpoint, making it the most seamless and recommended approach for this scenario.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
SharedAccessSignatureCredential
Why it's wrong here
This credential type is specifically designed for authenticating requests to Azure Storage services, such as Blob Storage, Queue Storage, or Table Storage, by providing time-limited, delegated access to specific resources. A Shared Access Signature (SAS) token grants permissions to a client without sharing the account key. However, Azure Key Vault utilizes identity-based access control (Azure AD identities, Managed Identities, or service principals) and access policies, not SAS tokens, for secure secret retrieval. Therefore, SharedAccessSignatureCredential is fundamentally incompatible with Key Vault.
- ✗
InteractiveBrowserCredential
Why it's wrong here
InteractiveBrowserCredential is primarily intended for client-side applications, such as desktop applications or development environments, where a human user can interact with a web browser to complete an authentication flow. This credential type opens a browser window, prompts the user for their Azure AD credentials, and then obtains an access token. It is entirely unsuitable for server-side applications, background services, or automated processes running in Azure, as these environments lack a user interface for interaction and require non-interactive authentication methods.
- ✓
DefaultAzureCredential
Why this is correct
DefaultAzureCredential offers a robust and flexible authentication strategy by attempting to authenticate using a chain of credential types in a predefined order. When deployed in Azure, it automatically prioritizes and leverages Managed Identities (system-assigned or user-assigned) associated with the hosting resource (e.g., Azure App Service, VM, Function App), eliminating the need for explicit credential management. For local development, it intelligently falls back to environment variables, Azure CLI, or Visual Studio credentials, providing a seamless experience across different environments without code changes.
- ✗
ClientSecretCredential
Why it's wrong here
ClientSecretCredential authenticates an application using its client ID and a secret string, typically associated with an Azure AD application registration (service principal). While functional, this method requires developers to securely manage, store, and regularly rotate the client secret, which introduces security risks if the secret is compromised or hardcoded. For Azure-hosted services, using Managed Identities with DefaultAzureCredential is a superior and more secure approach, as it completely removes the burden of credential management from the developer.
Go deeper
Related to this question
Learn chapter
Azure Functions Development
Key term
Key Vault Secrets
Key Vault Secrets are secure containers in Microsoft Azure that store sensitive information like passwords, connection strings, and API keys, keeping them encrypted and accessible only to authorized applications and users.
Key term
Managed identity
A managed identity is an automatically managed service principal in Azure that allows your code to authenticate to any service that supports Azure AD authentication without storing credentials.
About these practice questions
This AZ-204 question is part of Courseiva's 881-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.