AZ-204 Practice Question: Connect to and consume Azure services and third-party services
You need to consume an Azure Cognitive Services Text Analytics API from a Python application. The API requires a subscription key. Where should you store the key to ensure security?
⚠ Common exam trap
Test-takers frequently choose Option C (Azure AD authentication) thinking it eliminates the need for a key entirely, but the Text Analytics API does not support Azure AD out-of-the-box without additional configuration, and the question explicitly states the API requires a subscription key.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Store the key in an environment variable on the hosting machine.
Storing the subscription key in an environment variable on the hosting machine keeps it out of source code and configuration files, reducing the risk of accidental exposure. Environment variables are a standard security best practice for secrets in cloud applications, and Azure Cognitive Services APIs require key-based authentication unless Azure AD is explicitly configured.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Store the key in a text file in the application directory.
Why it's wrong here
Storing the key in a plain text file within the application directory is highly insecure. These files are often deployed alongside the application code, making them susceptible to accidental exposure through source control, misconfigured web servers, or unauthorized access by other processes or users on the hosting machine. This method provides no protection against disclosure if the application's deployment environment is compromised or improperly secured.
- ✓
Store the key in an environment variable on the hosting machine.
Why this is correct
Storing the key in an environment variable on the hosting machine is a robust and recommended practice for managing secrets. Environment variables are loaded into the application's process at runtime, keeping the secret out of the source code and deployed files. On Azure App Service or virtual machines, these variables can be securely configured and managed by the platform, often encrypted at rest, significantly reducing the risk of unauthorized access or accidental leakage.
- ✗
Use Azure AD authentication instead of a key.
Why it's wrong here
While Azure Cognitive Services fully supports Azure Active Directory (Azure AD) authentication, which is generally a more secure and modern approach leveraging identity-based access control and Managed Identities, this option directly contradicts the problem statement. The question specifically implies the use of a subscription key for consumption. Therefore, switching to Azure AD, while technically feasible and often preferable, does not address the requirement of securely handling the specified key.
- ✗
Hardcode the key in the Python source code.
Why it's wrong here
Hardcoding the key directly into the Python source code is a severe security vulnerability and a violation of fundamental best practices. This embeds the secret within the application's codebase, making it visible to anyone with access to the source repository, potentially leading to accidental commits to public repositories or exposure during code reviews. Such a practice dramatically increases the risk of the key being compromised, enabling unauthorized access to the Cognitive Services resource.
Go deeper
Related to this question
About these practice questions
Courseiva writes every AZ-204 question from scratch — 881 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.