AZ-204 Develop Azure compute solutions Practice Question
You have an Azure Function app that uses .NET 8 isolated process. The function must connect to an Azure SQL database using a managed identity. The function app has a system-assigned managed identity enabled. Which code snippet correctly retrieves the access token?
⚠ Common exam trap
The trap here is that candidates often forget that `GetTokenAsync` requires a `TokenRequestContext` object with an array of scopes, not a plain string URL, and they may also omit the `/.default` suffix required for Azure SQL Database token requests.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
var credential = new DefaultAzureCredential(); var token = await credential.GetTokenAsync(new TokenRequestContext(new[] {"https://database.windows.net/.default"}));
It uses `DefaultAzureCredential` to obtain an access token for Azure SQL Database by specifying the resource URI `https://database.windows.net/.default` in a `TokenRequestContext`. In a .NET 8 isolated process function app with a system-assigned managed identity, `DefaultAzureCredential` automatically attempts managed identity authentication as one of its credential sources, making it the recommended approach. The `GetTokenAsync` method requires a `TokenRequestContext` object, not a plain string, to correctly request the token for the Azure SQL resource.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
new SqlConnection(connectionString) using Integrated Security=true;
Why it's wrong here
This option is incorrect because `Integrated Security=true` is a connection string property used for Windows Authentication, which is not applicable for authenticating to Azure SQL Database from an Azure Function using a Managed Identity. Managed Identities leverage Azure Active Directory (AAD) authentication, requiring an OAuth 2.0 access token to be acquired and then supplied to the SQL connection.
- ✗
var token = await new Azure.Identity.DefaultAzureCredential().GetTokenAsync("https://database.windows.net");
Why it's wrong here
This option is incorrect due to an invalid method signature for `GetTokenAsync` in the `Azure.Identity` library. The `GetTokenAsync` method expects a `TokenRequestContext` object, not a simple string, to specify the required scopes. Furthermore, the scope for Azure SQL Database typically requires the `.default` suffix to request the default permissions.
- ✓
var credential = new DefaultAzureCredential(); var token = await credential.GetTokenAsync(new TokenRequestContext(new[] {"https://database.windows.net/.default"}));
Why this is correct
This option is correct as it properly utilizes the `Azure.Identity` library to obtain an access token for a Managed Identity. `DefaultAzureCredential` intelligently determines the appropriate credential type in an Azure environment, and `GetTokenAsync` is correctly invoked with a `TokenRequestContext` specifying the `https://database.windows.net/.default` scope, which is the standard for Azure SQL Database.
- ✗
var credential = new ManagedIdentityCredential(); var token = await credential.GetTokenAsync("https://database.windows.net");
Why it's wrong here
This option is incorrect because, similar to `DefaultAzureCredential`, the `ManagedIdentityCredential`'s `GetTokenAsync` method also requires a `TokenRequestContext` object to define the desired scopes. Providing a raw string for the scope is an incorrect usage of the method signature within the `Azure.Identity` library, leading to a compilation error or runtime failure.
Go deeper
Related to this question
Learn chapter
Azure Functions Development
Key term
Managed identity
A managed identity is an automatically managed service principal in Azure that allows your code to authenticate to any service that supports Azure AD authentication without storing credentials.
Key term
Key Vault Secrets
Key Vault Secrets are secure containers in Microsoft Azure that store sensitive information like passwords, connection strings, and API keys, keeping them encrypted and accessible only to authorized applications and users.
About these practice questions
Courseiva writes every AZ-204 question from scratch — 881 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.