AZ-204 Practice Question: Connect to and consume Azure services and third-party services
You are developing a web app that uses Azure Key Vault to retrieve secrets. The app must authenticate using a system-assigned managed identity. Which endpoint should you use to get an access token for Key Vault?
⚠ Common exam trap
Test-takers frequently confuse the IMDS endpoint with the standard Azure AD OAuth endpoint (Option A), not realizing that managed identity authentication uses a special non-routable IP and requires the 'resource' parameter instead of 'scope'.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
http://169.254.169.254/metadata/identity/oauth2/token?resource=https://vault.azure.net&api-version=2018-02-01
It uses the Azure Instance Metadata Service (IMDS) endpoint, which is the standard way for Azure resources with a system-assigned managed identity to obtain an access token. The request includes the resource parameter set to 'https://vault.azure.net' to specify Key Vault as the target service, and the API version '2018-02-01' is required for the IMDS token endpoint. This token is then used to authenticate to Key Vault without storing any credentials in the application code.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
https://login.microsoftonline.com/{tenantId}/oauth2/v2.0/token
Why it's wrong here
This endpoint is part of the Microsoft identity platform's OAuth 2.0 authorization server, used for acquiring tokens directly from Azure Active Directory (Azure AD). While it supports various flows, including client credentials, it is not the mechanism for Azure resources to obtain tokens using managed identities. Managed identities leverage the Azure Instance Metadata Service (IMDS) for token acquisition, abstracting away the direct interaction with Azure AD.
- ✓
http://169.254.169.254/metadata/identity/oauth2/token?resource=https://vault.azure.net&api-version=2018-02-01
Why this is correct
This is the correct endpoint for acquiring an access token using an Azure Managed Identity. The Azure Instance Metadata Service (IMDS) is a REST endpoint accessible only from within an Azure VM or other Azure compute resource, providing information about the running instance. When a managed identity is enabled, IMDS exposes a specific endpoint (169.254.169.254) that the resource can query to securely obtain an OAuth 2.0 access token for a specified resource, such as Azure Key Vault, without needing to manage credentials.
- ✗
https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups/{rg}/providers/Microsoft.KeyVault/vaults/{vaultName}
Why it's wrong here
This URL represents an Azure Resource Manager (ARM) endpoint, specifically for managing an Azure Key Vault resource itself. It is used for operations like creating, updating, deleting, or retrieving properties of a Key Vault instance. While essential for resource management, this endpoint does not facilitate the acquisition of access tokens for authenticating to services like Key Vault; it is purely for control plane operations on the resource.
- ✗
https://graph.microsoft.com/v1.0/me
Why it's wrong here
This is a specific endpoint within the Microsoft Graph API, designed to retrieve information about the currently authenticated user. Microsoft Graph provides a unified API to access data across Microsoft 365 services, including user profiles, mail, calendar, and files. While it requires an access token to authenticate, this endpoint is for consuming user data, not for obtaining a token to access Azure Key Vault via a managed identity.
Go deeper
Related to this question
Learn chapter
Azure Functions Development
Key term
Key Vault Secrets
Key Vault Secrets are secure containers in Microsoft Azure that store sensitive information like passwords, connection strings, and API keys, keeping them encrypted and accessible only to authorized applications and users.
Key term
Managed identity
A managed identity is an automatically managed service principal in Azure that allows your code to authenticate to any service that supports Azure AD authentication without storing credentials.
About these practice questions
One of 881 original AZ-204 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.