AZ-204 Develop Azure compute solutions Practice Question
You need to deploy an Azure Functions app that runs on a dedicated App Service plan. The function must be triggered by an HTTP request and call a downstream API that requires OAuth 2.0 authentication. Which approach should you use to store the API credentials securely?
⚠ Common exam trap
It's easy for candidates to confuse Azure App Configuration (a configuration store) with Azure Key Vault (a secrets store), assuming both are equally secure for credentials, but App Configuration does not natively encrypt values or support managed identity-based access for secrets without Key Vault integration.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use Key Vault references in the function app settings
Azure Key Vault references in function app settings allow you to securely store and retrieve sensitive information like OAuth 2.0 credentials (client ID, client secret) without exposing them in code or configuration files. The function app resolves these references at runtime using a managed identity, ensuring credentials are never stored in plaintext or accessible via source control.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use Azure App Configuration with plain text
Why it's wrong here
Storing credentials in plain text within Azure App Configuration is a significant security vulnerability. While App Configuration is excellent for managing application settings and feature flags, it is not designed as a secure vault for sensitive secrets like connection strings or API keys. Exposing these values unencrypted makes them easily accessible to anyone with access to the configuration store, violating the principle of least privilege and increasing the risk of data breaches.
- ✗
Store credentials in a configuration file in the deployment package
Why it's wrong here
Embedding credentials directly within a configuration file (e.g., appsettings.json, .env) that is part of the deployment package for an Azure Function app is highly insecure. These files are often bundled with the application code, making them susceptible to accidental exposure through source control, build artifacts, or during deployment troubleshooting. This practice creates a static, unmanaged secret that is difficult to rotate and poses a significant risk if the deployment package is ever compromised or accessed by unauthorized individuals.
- ✓
Use Key Vault references in the function app settings
Why this is correct
Using Key Vault references in Azure Function app settings is the recommended and most secure method for managing sensitive credentials. This approach allows the function app to retrieve secrets dynamically from Azure Key Vault at runtime, without ever storing the secret value directly in the app's configuration or code. The function app uses its managed identity to authenticate with Key Vault, ensuring that secrets are accessed securely, rotated easily, and never exposed in plain text within the application environment.
- ✗
Store credentials in the function code as constants
Why it's wrong here
Hardcoding credentials directly into the function code as constants is a severe security anti-pattern and should be strictly avoided. This practice embeds sensitive information directly into the compiled application, making it discoverable through decompilation or source code review. Furthermore, it tightly couples the application logic to specific secret values, making credential rotation difficult, requiring code changes and redeployments for every update, and violating the principle of separation of concerns.
Visual reference
Quick reference
Cloud Service Model Comparison
| Model | You Manage | Provider Manages | Examples |
|---|---|---|---|
| IaaS | OS, runtime, apps, data | Hardware, hypervisor, networking | EC2, Azure VMs, GCP Compute Engine |
| PaaS | Apps and data | OS, runtime, middleware, hardware | Elastic Beanstalk, Azure App Service |
| SaaS | Data and settings only | Everything else | Microsoft 365, Salesforce, Workday |
| FaaS / Serverless | Function code only | Infra, scaling, runtime | Lambda, Azure Functions, Cloud Run |
| CaaS | Containers and apps | Kubernetes, OS, hardware | EKS, AKS, GKE |
Go deeper
Related to this question
Learn chapter
Azure Functions Development
Key term
Key Vault Secrets
Key Vault Secrets are secure containers in Microsoft Azure that store sensitive information like passwords, connection strings, and API keys, keeping them encrypted and accessible only to authorized applications and users.
Key term
Managed identity
A managed identity is an automatically managed service principal in Azure that allows your code to authenticate to any service that supports Azure AD authentication without storing credentials.
About these practice questions
This AZ-204 question is part of Courseiva's 881-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.