AZ-204 Implement Azure security Practice Question
You have an Azure Function app that needs to retrieve a secret from Azure Key Vault at runtime. You want to avoid storing any credentials in code or configuration. Which mechanism should you use?
⚠ Common exam trap
Many candidates confuse managed identity with a service principal, thinking a client secret is required, or incorrectly assume that an access key or SAS can be used for Key Vault authentication.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Managed identity
Managed identity (B) is the correct mechanism because it allows the Azure Function app to authenticate to Azure Key Vault without storing any credentials in code or configuration. Azure automatically manages the identity and provides a token from Azure AD that the function can use to access the vault, eliminating the need for secrets or keys in the application.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Service principal with client secret
Why it's wrong here
A service principal with a client secret represents an application identity in Azure Active Directory. While it can be used to authenticate to Azure Key Vault, it necessitates storing the client secret itself within the Function App's configuration (e.g., application settings or environment variables). This approach merely shifts the secret management problem, as the client secret becomes a new credential that must be securely protected and rotated, defeating the primary goal of retrieving secrets without embedding them directly in the application.
- ✓
Managed identity
Why this is correct
Managed identities provide an automatically managed identity in Azure Active Directory for Azure services, including Function Apps. When enabled, the Function App can obtain an Azure AD token from the Azure Instance Metadata Service (IMDS) endpoint, which it then uses to authenticate to other Azure services like Azure Key Vault. This eliminates the need for developers to manage any credentials, as Azure handles the lifecycle of the identity and its authentication to Azure AD, making it the most secure and recommended approach for service-to-service authentication.
- ✗
Access key
Why it's wrong here
Azure Storage accounts utilize access keys (primary and secondary) for full administrative access to the storage account itself. While these keys grant powerful access, they are specifically designed for authenticating to Azure Storage services (Blobs, Queues, Tables, Files) and are not a mechanism for authenticating an Azure Function App to Azure Key Vault. Attempting to use an access key for Key Vault would fail, and even if it were applicable, storing such a key in the Function App's configuration would introduce the same security vulnerability as storing any other secret.
- ✗
Shared access signature (SAS)
Why it's wrong here
A Shared Access Signature (SAS) provides delegated access to resources in an Azure Storage account with granular control over permissions, services, and time validity. SAS tokens are primarily used to grant limited, time-bound access to clients without sharing the storage account access keys. They are fundamentally a mechanism for authorizing access to *storage resources* (e.g., a specific blob or container) and are not designed or capable of authenticating an Azure Function App to Azure Key Vault to retrieve secrets. Their scope is entirely different from Key Vault authentication.
Go deeper
Related to this question
Learn chapter
Azure Functions Development
Key term
Key Vault Secrets
Key Vault Secrets are secure containers in Microsoft Azure that store sensitive information like passwords, connection strings, and API keys, keeping them encrypted and accessible only to authorized applications and users.
Key term
Managed identity
A managed identity is an automatically managed service principal in Azure that allows your code to authenticate to any service that supports Azure AD authentication without storing credentials.
About these practice questions
This AZ-204 question is part of Courseiva's 881-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.