AZ-204 Practice Question: Connect to and consume Azure services and third-party services
You are developing an application that needs to retrieve secrets from Azure Key Vault. The application will run as an Azure Functions app. Which authentication method should you use to access Key Vault?
⚠ Common exam trap
Watch out — candidates often confuse Key Vault authentication with storage account access methods, or assume that a connection string or certificate is required, when in fact managed identities are the preferred and most secure approach for Azure-hosted services.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use a system-assigned managed identity
A system-assigned managed identity is the recommended authentication method for Azure Functions to access Key Vault because it eliminates the need to store credentials in code or configuration. When enabled, Azure automatically creates a service principal in Azure AD for the function app, and the function can authenticate to Key Vault using this identity via the Azure Identity SDK (e.g., DefaultAzureCredential). This approach is secure, fully managed, and aligns with the principle of least privilege.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use a client certificate stored in the function app
Why it's wrong here
While client certificates can be used for authentication in some Azure services, they introduce significant operational overhead for lifecycle management, including issuance, renewal, and revocation. For accessing Azure Key Vault from an Azure Function, a client certificate would need to be securely stored and referenced within the function app, which is less secure and more complex than leveraging a managed identity, which provides automatic credential management by Azure.
- ✓
Use a system-assigned managed identity
Why this is correct
A system-assigned managed identity provides an Azure Function with an automatically managed identity in Microsoft Entra ID, directly tied to the resource's lifecycle. This identity can then be granted specific, fine-grained permissions to access Azure Key Vault secrets, certificates, or keys without needing to store any credentials (like connection strings or client certificates) in the function app's configuration. This approach adheres to the principle of least privilege and significantly enhances security by eliminating the burden of credential rotation.
- ✗
Use the Key Vault connection string from app settings
Why it's wrong here
Azure Key Vault does not utilize connection strings for authentication; its access model is fundamentally different from services that rely on them. Unlike some other Azure services (e.g., Azure Storage or Azure SQL Database), Key Vault relies exclusively on identity-based authentication through Microsoft Entra ID. Attempting to use a 'connection string' for Key Vault would be an incorrect approach, as its security model is built around service principals or managed identities, not string-based credentials.
- ✗
Use the storage account access key from the function app
Why it's wrong here
Storage account access keys are highly privileged credentials specifically designed for authenticating to an Azure Storage account, granting full control over that particular storage resource. They are entirely irrelevant and ineffective for authenticating to Azure Key Vault. Key Vault authentication requires a Microsoft Entra ID identity (such as a managed identity or service principal) with appropriate access policies defined on the Key Vault itself, making the use of a storage key a fundamental misunderstanding of Azure's distinct authentication mechanisms.
Quick reference
Cloud Service Model Comparison
| Model | You Manage | Provider Manages | Examples |
|---|---|---|---|
| IaaS | OS, runtime, apps, data | Hardware, hypervisor, networking | EC2, Azure VMs, GCP Compute Engine |
| PaaS | Apps and data | OS, runtime, middleware, hardware | Elastic Beanstalk, Azure App Service |
| SaaS | Data and settings only | Everything else | Microsoft 365, Salesforce, Workday |
| FaaS / Serverless | Function code only | Infra, scaling, runtime | Lambda, Azure Functions, Cloud Run |
| CaaS | Containers and apps | Kubernetes, OS, hardware | EKS, AKS, GKE |
Go deeper
Related to this question
Learn chapter
Azure Functions Development
Key term
Managed identity
A managed identity is an automatically managed service principal in Azure that allows your code to authenticate to any service that supports Azure AD authentication without storing credentials.
Key term
Azure Functions Bindings
Azure Functions Bindings are declarative connections that link your serverless function code to Azure services or external resources, handling input and output data automatically without writing extra networking or authentication code.
About these practice questions
Courseiva writes every AZ-204 question from scratch — 881 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.