AZ-204 Develop Azure compute solutions Practice Question
You develop a containerized application that runs on Azure Container Instances (ACI). The application needs to securely access Azure SQL Database using a connection string. You want to minimize administrative effort and avoid storing secrets in the container image. What should you do?
⚠ Common exam trap
It's easy for candidates to confuse environment variables (Option B) as a secure alternative to embedding secrets, but environment variables are still plaintext and visible in the container's process list, whereas managed identity provides true secretless authentication.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable managed identity for the container group and use Microsoft Entra authentication to Azure SQL.
Enabling a managed identity for the container group allows the application to authenticate to Azure SQL Database using Microsoft Entra ID (formerly Azure Active Directory) without storing any secrets. The application requests an access token from the Azure Instance Metadata Service (IMDS) endpoint at 169.254.169.254, then uses that token to connect to Azure SQL. This eliminates the need to manage connection strings or secrets, minimizing administrative effort and keeping secrets out of the container image.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Embed the connection string in the container image as a configuration file.
Why it's wrong here
Embedding the connection string directly into the container image as a configuration file is highly insecure because secrets become an immutable part of the image layer. This practice makes secret rotation extremely difficult, requiring a full rebuild and redeployment of the container image every time the connection string changes, which is operationally burdensome and increases the risk of exposure.
- ✗
Store the connection string in an environment variable in the container group.
Why it's wrong here
Storing the connection string in an environment variable within the container group is not a secure practice for sensitive data. Environment variables are often visible through the Azure portal, CLI, and API calls, making them susceptible to unauthorized access by anyone with sufficient permissions to view the container group's configuration. This method lacks the robust security controls and encryption mechanisms required for production-grade secret management.
- ✓
Enable managed identity for the container group and use Microsoft Entra authentication to Azure SQL.
Why this is correct
Enabling managed identity for the container group and using Microsoft Entra authentication to Azure SQL is the most secure and recommended approach. A managed identity provides an automatic, Azure AD-managed identity for the container group, allowing it to authenticate to Azure SQL Database without any credentials needing to be stored in code or configuration. This eliminates the risk of secret leakage and simplifies credential rotation, as Azure handles the identity lifecycle.
- ✗
Mount a volume from Azure Key Vault using a secret volume.
Why it's wrong here
Mounting a volume from Azure Key Vault using a secret volume, while better than embedding secrets directly, still involves exposing the secret as a file within the container's filesystem. This approach requires managing access policies for Key Vault and the application still interacts with a file-based secret, which is less secure than direct token-based authentication. It doesn't fully eliminate the need for the application to handle a secret, unlike managed identities for Azure-to-Azure communication.
Go deeper
Related to this question
Learn chapter
Azure Functions Development
Key term
Azure Container Instances
Azure Container Instances (ACI) is a PaaS service that lets you run a container directly in Azure without managing any underlying servers or orchestration.
Key term
Managed identity
A managed identity is an automatically managed service principal in Azure that allows your code to authenticate to any service that supports Azure AD authentication without storing credentials.
About these practice questions
One of 881 original AZ-204 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.