AZ-204 Practice Question: Connect to and consume Azure services and third-party services
You are implementing a custom API that calls a downstream API secured with OAuth 2.0. The downstream API requires a client credentials grant flow. You need to securely store the client secret and obtain an access token. What should you use?
⚠ Common exam trap
Watch out — candidates often confuse Azure App Configuration with Azure Key Vault, assuming App Configuration's encryption is sufficient for secrets, or they mistakenly believe managed identity can be used to authenticate to any OAuth 2.0-secured API, when in fact managed identity only works with Microsoft Entra ID-integrated services and not arbitrary downstream APIs.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure Key Vault to store the secret and MSAL to obtain the token
Azure Key Vault provides secure, auditable storage for client secrets, and MSAL (Microsoft Authentication Library) is the recommended SDK for implementing OAuth 2.0 client credentials grant flows in Azure. MSAL handles token acquisition, caching, and renewal, while Key Vault ensures the secret is never exposed in code or configuration files.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Azure App Configuration to store the secret and the Azure Identity SDK to obtain the token
Why it's wrong here
Azure App Configuration is designed for managing application settings and feature flags, not for the secure storage of sensitive secrets like API client secrets. While it can store strings, it lacks the robust security features, access policies, and auditing capabilities inherent to dedicated secret management services. Furthermore, while the Azure Identity SDK can obtain tokens, it typically relies on a secure credential source or managed identity, not a secret directly retrieved from App Configuration for client credentials flow.
- ✗
Managed identity to access the downstream API directly
Why it's wrong here
Managed identities provide an Microsoft Entra ID identity for Azure resources, enabling them to authenticate to services that support Microsoft Entra ID authentication without managing credentials. However, this approach is incorrect because the *downstream API* might not be an Microsoft Entra ID-protected resource or may not support Microsoft Entra ID authentication directly via a managed identity. The question implies a custom API calling a downstream API, often requiring a client secret for the client credentials flow, which a managed identity alone doesn't directly provide for external, non-Microsoft Entra ID integrated APIs.
- ✓
Azure Key Vault to store the secret and MSAL to obtain the token
Why this is correct
Azure Key Vault is the recommended and secure service for storing cryptographic keys, certificates, and sensitive secrets like API client secrets. It provides robust access control, auditing, and encryption at rest and in transit, ensuring the secret's confidentiality. The Microsoft Authentication Library (MSAL) is the appropriate SDK for acquiring tokens from Microsoft identity platform, including implementing the client credentials flow where an application uses its own identity (client ID and secret retrieved from Key Vault) to obtain an access token for a downstream API.
- ✗
Azure Certificate Manager to store the secret and the HttpClient to obtain the token
Why it's wrong here
The option refers to "Azure Certificate Manager," which is not a recognized Azure service for storing secrets. While Azure Key Vault does manage certificates, a dedicated "Certificate Manager" service for general secret storage does not exist. Furthermore, directly using `HttpClient` to obtain an access token would require manually implementing the complex OAuth 2.0 client credentials flow, including token caching and refresh logic, which is error-prone and less secure than leveraging a robust authentication library like MSAL.
Go deeper
Related to this question
Learn chapter
Azure Table Storage Query Performance
Key term
Key Vault Secrets
Key Vault Secrets are secure containers in Microsoft Azure that store sensitive information like passwords, connection strings, and API keys, keeping them encrypted and accessible only to authorized applications and users.
Key term
Microsoft Identity Platform
Microsoft Identity Platform is a unified authentication and authorization service that enables applications to sign in users and access resources using Microsoft Entra ID and modern protocols.
About these practice questions
Courseiva writes every AZ-204 question from scratch — 883 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.