AZ-204 Practice Question: Connect to and consume Azure services and third-party services
You need to deploy a web app that uses Azure SQL Database. The connection string must be securely stored and automatically rotated without application downtime. What should you use?
⚠ Common exam trap
Test-takers frequently confuse Azure App Configuration (which is for app settings, not secrets) with Azure Key Vault, or assume that encrypted configuration files or environment variables are sufficient for automatic rotation, overlooking the need for a dedicated secret store with rotation capabilities.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Store the connection string in Azure Key Vault and configure automatic rotation.
Azure Key Vault provides centralized, secure storage for secrets like connection strings, and its automatic rotation feature (via Key Vault rotation policies or integration with Azure SQL) allows secrets to be updated without requiring application restarts or downtime. The App Service can access the vault using a managed identity, ensuring the connection string is never exposed in code or configuration files.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Store the connection string as an environment variable in the App Service.
Why it's wrong here
Storing connection strings directly as environment variables within an App Service is a common practice but lacks robust secret management capabilities. While accessible to the application, this method necessitates manual intervention for any updates or rotations of the secret, such as changing the SQL database password. This manual process is prone to errors, increases operational overhead, and introduces a security risk by not supporting automated secret lifecycle management, which is crucial for maintaining a strong security posture.
- ✗
Store the connection string in a web.config file with encrypted configuration.
Why it's wrong here
Storing connection strings in a web.config file, even with encrypted configuration sections, is generally discouraged for cloud-native applications due to several limitations. The web.config file is part of the application deployment package, meaning any secret rotation or update requires a redeployment of the application. Furthermore, managing encryption keys for web.config across multiple instances or environments can be complex, and it fundamentally lacks any built-in mechanism for automatic secret rotation, making it unsuitable for modern security practices.
- ✗
Store the connection string in Azure App Configuration and use a managed identity.
Why it's wrong here
Azure App Configuration is designed for managing application settings and feature flags, providing a centralized store for configuration data. While it integrates well with managed identities for secure access, its primary purpose is not secret management. App Configuration does not offer native capabilities for storing sensitive secrets like connection strings securely with features such as automatic rotation or versioning of secrets, which are essential for robust security practices. It should be used for non-sensitive configuration values, not secrets.
- ✓
Store the connection string in Azure Key Vault and configure automatic rotation.
Why this is correct
Azure Key Vault is the recommended service for securely storing and managing sensitive information like connection strings, API keys, and certificates. It provides a centralized, highly secure repository with robust access control policies, auditing capabilities, and crucially, support for automatic secret rotation. By integrating Key Vault with an Azure App Service using a managed identity, the application can securely retrieve the connection string at runtime without ever exposing it in configuration files or environment variables, ensuring optimal security and compliance.
Go deeper
Related to this question
Learn chapter
Azure Functions Development
Key term
Managed identity
A managed identity is an automatically managed service principal in Azure that allows your code to authenticate to any service that supports Azure AD authentication without storing credentials.
Key term
Key Vault Secrets
Key Vault Secrets are secure containers in Microsoft Azure that store sensitive information like passwords, connection strings, and API keys, keeping them encrypted and accessible only to authorized applications and users.
About these practice questions
One of 881 original AZ-204 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.