Develop Azure compute solutions →mediumMultiple ChoiceObjective-mapped

AZ-204 Develop Azure compute solutions Practice Question

Exhibit

Refer to the exhibit.

```json
{
  "type": "Microsoft.Web/sites/config",
  "apiVersion": "2022-03-01",
  "name": "[concat(parameters('siteName'), '/config')]",
  "properties": {
    "connectionStrings": [
      {
        "name": "DefaultConnection",
        "connectionString": "[concat('Server=tcp:', parameters('sqlServerName'), '.database.windows.net,1433;Initial Catalog=', parameters('sqlDatabaseName'), ';Persist Security Info=False;User ID=', parameters('sqlLogin'), ';Password=', parameters('sqlPassword'), ';MultipleActiveResultSets=False;Encrypt=True;TrustServerCertificate=False;Connection Timeout=30;')]",
        "type": "SQLAzure"
      }
    ]
  }
}
```

You find the above ARM template for an App Service. What is a security concern with this configuration?

⚠ Common exam trap

The trap here is that candidates focus on the connection string being in the template (Option A) or its type (Option C), but the real security issue is the plaintext parameter exposure in deployment logs, which is a common oversight in ARM template security.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The password is passed as a parameter and may be exposed in deployment logs.

When a password is passed as an ARM template parameter, its value can be captured in deployment logs (e.g., Azure Activity Logs or PowerShell verbose output) if the parameter is not marked as 'secureString'. This exposes sensitive credentials to anyone with log access, violating security best practices. In contrast, using a secureString parameter encrypts the value and masks it in logs.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The connection string is stored in the source code.
Why it's wrong here
This statement is incorrect because connection strings defined within an ARM template for an Azure App Service are stored as application settings or connection strings directly within the App Service's configuration, not embedded in the application's source code. ARM templates are used to provision and configure Azure resources, separating infrastructure configuration from application logic. Storing sensitive data like connection strings directly in source code is a significant security vulnerability and an anti-pattern.
✓
The password is passed as a parameter and may be exposed in deployment logs.
Why this is correct
This statement is correct because while ARM templates support `securestring` parameters to prevent values from being displayed in the Azure portal after deployment, the actual parameter value can still be captured and exposed in deployment logs during the execution phase. This risk is particularly relevant in CI/CD pipelines or if the parameter is used in a way that triggers logging of its content. For true secret management, integrating with Azure Key Vault is the recommended secure approach.
✗
The connection string type should be 'Custom' instead of 'SQLAzure'.
Why it's wrong here
This statement is incorrect because 'SQLAzure' is the appropriate and recognized connection string type for connecting an Azure App Service to an Azure SQL Database. Azure App Services are designed to understand specific database types, including 'SQLAzure', 'SQLServer', 'MySQL', and 'PostgreSQL', which can enable specific platform optimizations or portal integrations. The 'Custom' type is reserved for other database systems or non-standard connection string formats not explicitly recognized by the platform.
✗
The connection string is not encrypted at rest.
Why it's wrong here
This statement is incorrect because Azure App Service automatically encrypts all sensitive configuration data, including connection strings and application settings, when it is stored at rest within the platform. This encryption is a fundamental security feature provided by Azure, utilizing platform-managed keys to protect data from unauthorized access even if the underlying storage infrastructure were to be compromised. Users do not need to configure this encryption explicitly for connection strings.

Go deeper

AZ-204 Develop Azure compute solutions Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question