AZ-204 Develop Azure compute solutions Practice Question
You need to deploy an Azure App Service web app that uses a custom domain (www.contoso.com) and SSL/TLS certificate. The certificate is stored in Azure Key Vault. What should you use to bind the certificate to the App Service?
⚠ Common exam trap
It's easy for candidates to confuse the manual PFX export and upload method (Option D) as the only way to use a Key Vault certificate, missing the native 'Key Vault Certificate' integration that is more secure and automated.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Import the certificate from Key Vault into App Service using the 'Key Vault Certificate' option.
Azure App Service supports direct integration with Azure Key Vault to import a certificate using the 'Key Vault Certificate' option. This allows you to bind an SSL/TLS certificate stored in Key Vault to your custom domain without manually exporting or managing the PFX file, ensuring secure and seamless certificate lifecycle management.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Configure Azure Front Door to terminate SSL and forward traffic to App Service.
Why it's wrong here
While Azure Front Door can terminate SSL at the edge and forward traffic to an App Service, it does not facilitate the direct binding of a certificate from Key Vault to the App Service instance itself. Front Door is primarily a global load balancer and WAF service; using it solely for SSL termination when the core requirement is to bind a Key Vault certificate directly to the App Service for its custom domain is an unnecessary and indirect solution.
- ✗
Use an App Service Managed Certificate for the custom domain.
Why it's wrong here
App Service Managed Certificates are free SSL certificates provided by Azure, automatically issued and renewed for custom domains. However, these certificates are entirely managed by Azure and do not allow for the use or integration of pre-existing certificates stored within Azure Key Vault, making them unsuitable when the explicit requirement is to leverage a certificate from Key Vault.
- ✓
Import the certificate from Key Vault into App Service using the 'Key Vault Certificate' option.
Why this is correct
Azure App Service offers a direct and secure integration feature to import certificates from Azure Key Vault. This 'Key Vault Certificate' option securely retrieves the certificate, including its private key, from Key Vault, allowing it to be bound to a custom domain within the App Service without manual export or upload. This method also supports automatic renewal if the certificate is renewed in Key Vault.
- ✗
Export the certificate from Key Vault as a PFX file and upload it to App Service.
Why it's wrong here
Exporting a certificate from Key Vault as a PFX file and then manually uploading it to App Service is technically possible but represents a less secure and inefficient practice. This process involves handling sensitive private key material outside of Key Vault's secure environment, requires manual intervention for renewals, and bypasses the direct, secure integration Azure provides for Key Vault certificates, which automates management and reduces security risks.
Go deeper
Related to this question
About these practice questions
One of 881 original AZ-204 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.