The correct answer is to store the key in an environment variable on the hosting machine. This approach keeps the subscription key out of source code and configuration files, which prevents accidental exposure through version control or logs and aligns with the security principle of separating secrets from application logic. On the Microsoft Azure Developer Associate AZ-204 exam, this scenario tests your understanding of secure configuration management for Azure Cognitive Services, often appearing as a trap where incorrect options suggest storing the key in a configuration file or hardcoding it. A common mistake is choosing Azure Key Vault for this specific case, but remember that while Key Vault is ideal for production secrets, the question explicitly asks for the simplest secure method for a Python app consuming the Text Analytics API—environment variables are the immediate best practice. Memory tip: "Env vars keep keys out of code, Key Vault is for when you need vault-level control."
AZ-204 Practice Question: Connect to and consume Azure services and third-party services
This AZ-204 practice question tests your understanding of connect to and consume azure services and third-party services. This is a configuration task: choose the command set that satisfies every stated requirement. Small differences — like 'secret' vs 'password' or 'transport input ssh' vs 'all' — change whether the answer is correct. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
You need to consume an Azure Cognitive Services Text Analytics API from a Python application. The API requires a subscription key. Where should you store the key to ensure security?
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Store the key in an environment variable on the hosting machine.
Option B is correct because storing the subscription key in an environment variable on the hosting machine keeps it out of source code and configuration files, reducing the risk of accidental exposure. Environment variables are a standard security best practice for secrets in cloud applications, and Azure Cognitive Services APIs require key-based authentication unless Azure AD is explicitly configured.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
Store the key in a text file in the application directory.
Why it's wrong here
Storing secrets in files is insecure if the file is accessible.
✓
Store the key in an environment variable on the hosting machine.
Why this is correct
Environment variables are secure and can be set in App Service or VM configuration.
Related concept
Read the scenario before looking for a memorised answer.
✗
Use Azure AD authentication instead of a key.
Why it's wrong here
Cognitive Services supports Azure AD, but the question specifies a subscription key.
✗
Hardcode the key in the Python source code.
Why it's wrong here
Hardcoding secrets is insecure and violates best practices.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates may choose Option C (Azure AD authentication) thinking it eliminates the need for a key entirely, but the Text Analytics API does not support Azure AD out-of-the-box without additional configuration, and the question explicitly states the API requires a subscription key.
Detailed technical explanation
How to think about this question
Environment variables are stored in the process's memory and can be set at the OS level (e.g., `export COGNITIVE_KEY=...` on Linux or `setx` on Windows) or via Azure App Service application settings, which are encrypted at rest. When using the Text Analytics SDK, you read the key via `os.environ['COGNITIVE_KEY']`, ensuring the secret never appears in logs or source files. In production, Azure Key Vault is a more robust solution, but environment variables are the simplest secure option for this scenario.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A company's IT admin needs to give a contractor read-only access to production logs without sharing account credentials. Using role-based access control (RBAC) and temporary scoped permissions — not a permanent shared password — is the correct pattern. Questions like this test whether you can apply least-privilege access across cloud identity services.
Related glossary terms
Concepts from this question explained
These glossary pages explain the core terms tested in this AZ-204 question in full detail.
Connect to and consume Azure services and third-party services — This question tests Connect to and consume Azure services and third-party services — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: Store the key in an environment variable on the hosting machine. — Option B is correct because storing the subscription key in an environment variable on the hosting machine keeps it out of source code and configuration files, reducing the risk of accidental exposure. Environment variables are a standard security best practice for secrets in cloud applications, and Azure Cognitive Services APIs require key-based authentication unless Azure AD is explicitly configured.
What should I do if I get this AZ-204 question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.