Connect to and consume Azure services and third-party services →mediumMultiple ChoiceObjective-mapped
AZ-204 Practice Question: Connect to and consume Azure services and third-party services
Exhibit
Refer to the exhibit.
```json
{
"type": "Microsoft.Web/sites/config",
"apiVersion": "2022-03-01",
"name": "appsettings",
"properties": {
"MyApiEndpoint": "https://api.contoso.com",
"MyApiKey": "@Microsoft.KeyVault(SecretUri=https://myvault.vault.azure.net/secrets/MyApiKey/)"
}
}
```You are reviewing an ARM template that deploys an Azure App Service. The template sets an app setting 'MyApiKey' that references a Key Vault secret. However, the deployment fails with an error that the app service cannot access the secret. What is the most likely cause?
⚠ Common exam trap
A common mix-up: candidates assume the Key Vault reference syntax is the issue, when in reality the error message 'cannot access the secret' points directly to an authentication or authorization failure, not a syntax or naming problem.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The App Service does not have a managed identity enabled and the Key Vault access policy is missing.
An Azure App Service must have a managed identity enabled and the Key Vault must have an access policy granting that identity the 'Get' permission for secrets. Without these, the App Service cannot authenticate to Key Vault, causing the deployment to fail with an access error.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The Key Vault reference syntax '@Microsoft.KeyVault(SecretUri=...)' is incorrect.
Why it's wrong here
The syntax '@Microsoft.KeyVault(SecretUri=...)' is the standard and correct format for referencing Key Vault secrets within Azure App Service application settings. This specific syntax instructs the App Service platform to resolve the secret at runtime by querying the specified Key Vault URI. Therefore, stating that this widely adopted and documented syntax is incorrect is inaccurate, as it is the prescribed method for this integration.
- ✗
The ARM template cannot use Key Vault references in app settings.
Why it's wrong here
Azure Resource Manager (ARM) templates fully support the deployment of App Services configured with Key Vault references in their application settings. The ARM template simply defines the application setting value using the Key Vault reference syntax, and the Azure platform handles the provisioning during deployment. This capability allows for secure secret management directly within infrastructure-as-code deployments, making the assertion that ARM templates cannot use them incorrect.
- ✗
The secret name in the URI does not match the actual secret name.
Why it's wrong here
While an incorrect secret name in the URI would indeed prevent the App Service from resolving the secret, the error message typically associated with such a mismatch or a non-existent secret is distinct from an access denied or authentication failure. The provided URI structure itself is syntactically valid for a Key Vault secret, implying that the issue isn't with the URI's format or a simple naming error. Instead, the problem points to a lack of proper authorization for the App Service to retrieve the secret.
- ✓
The App Service does not have a managed identity enabled and the Key Vault access policy is missing.
Why this is correct
For an Azure App Service to successfully retrieve a secret using a Key Vault reference, it must first be configured with a system-assigned or user-assigned managed identity. Subsequently, this managed identity requires an explicit access policy within the target Azure Key Vault, granting it 'Get' permissions on secrets. Without both the enabled managed identity and the corresponding Key Vault access policy, the App Service lacks the necessary authentication and authorization to resolve the secret, leading to a runtime failure.
Go deeper
Related to this question
Learn chapter
Azure Functions Development
Key term
Managed identity
A managed identity is an automatically managed service principal in Azure that allows your code to authenticate to any service that supports Azure AD authentication without storing credentials.
Key term
Key Vault Secrets
Key Vault Secrets are secure containers in Microsoft Azure that store sensitive information like passwords, connection strings, and API keys, keeping them encrypted and accessible only to authorized applications and users.
About these practice questions
One of 881 original AZ-204 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.