AZ-204 Practice Question: Connect to and consume Azure services and third-party services
You need to call a third-party REST API from your Azure Function app. The API requires an API key in the header. Where should you store the API key to keep it secure?
⚠ Common exam trap
Many candidates confuse 'app settings' or 'environment variables' as secure storage, but Azure explicitly recommends Key Vault for secrets, and the exam tests this distinction by making the other options appear convenient but insecure.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure Key Vault
Azure Key Vault is the correct choice because it provides a centralized, secure store for secrets like API keys, with access control via Azure AD and automatic rotation capabilities. The Function app can securely retrieve the key at runtime using a managed identity, avoiding hardcoding or exposing the secret in configuration files or environment variables.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Environment variable in the hosting plan
Why it's wrong here
While environment variables can be used to pass configuration, storing sensitive API keys directly as unencrypted environment variables within the hosting plan (e.g., App Service Plan) is a significant security risk. They are not designed for secure secret management and could be accessed by anyone with sufficient access to the underlying host or diagnostic tools, making them unsuitable for production secrets.
- ✓
Azure Key Vault
Why this is correct
Azure Key Vault is the recommended and most secure solution for storing secrets like API keys, connection strings, and certificates. It provides hardware security module (HSM)-backed protection, fine-grained access control through Azure RBAC or Key Vault access policies, and comprehensive audit logging, ensuring secrets are encrypted at rest and in transit, and only authorized identities can retrieve them. Azure Functions can integrate with Key Vault using managed identities, eliminating the need to store any secrets directly in the function app configuration.
- ✗
Connection string in the Function app
Why it's wrong here
While Function App configuration allows defining "Connection strings," this section is primarily intended for database or storage account connection details, often with specific parsing expectations by SDKs. Although technically a string, using this section for a generic third-party API key is a misuse of its intended purpose and doesn't offer any additional security benefits over regular application settings for non-database secrets, nor does it provide the robust secret management features of Key Vault.
- ✗
App settings in the Function app configuration
Why it's wrong here
App settings in the Function app configuration are suitable for non-sensitive configuration values, but not for storing highly sensitive secrets like third-party API keys. While they can be marked as "slot sticky," they are stored unencrypted within the Function App's configuration and are easily viewable by anyone with contributor access to the Azure portal or via Azure CLI/PowerShell, posing a significant security vulnerability for production secrets.
Go deeper
Related to this question
Learn chapter
Azure Functions Development
Key term
Managed identity
A managed identity is an automatically managed service principal in Azure that allows your code to authenticate to any service that supports Azure AD authentication without storing credentials.
Key term
Key Vault Secrets
Key Vault Secrets are secure containers in Microsoft Azure that store sensitive information like passwords, connection strings, and API keys, keeping them encrypted and accessible only to authorized applications and users.
About these practice questions
Courseiva writes every AZ-204 question from scratch — 881 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.