AZ-204 Implement Azure security Practice Question
You need to design a solution to securely store and access secrets (e.g., API keys, connection strings) for a set of Azure Functions. The solution must minimize administrative overhead and avoid storing secrets in code or configuration files. Which THREE should you include? (Choose three.)
⚠ Common exam trap
Test-takers frequently confuse Azure App Configuration with a secret store, but App Configuration is for feature flags and non-sensitive configuration, while Key Vault is the dedicated service for secrets, and managed identities are required to access it securely without storing credentials.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Store secrets in Azure Key Vault
Azure Key Vault is the correct service for securely storing secrets like API keys and connection strings because it provides centralized, hardware-backed secret management with access policies and auditing. By referencing Key Vault secrets from Azure Functions via a managed identity, you avoid storing secrets in code or configuration files, which aligns with the requirement to minimize administrative overhead and eliminate plaintext secrets. Enabling Key Vault soft-delete and purge protection is a critical security best practice to prevent accidental or malicious permanent deletion of secrets, ensuring data resilience and compliance, which is essential for a robust 'secure solution'.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Store secrets in Azure Key Vault
Why this is correct
Azure Key Vault is the industry-standard, highly secure solution for centrally storing and managing cryptographic keys, certificates, and sensitive application secrets like API keys and database connection strings. It provides robust protection through FIPS 140-2 Level 2 validated Hardware Security Modules (HSMs) for cryptographic operations, ensuring secrets are encrypted at rest and in transit. Access to these secrets is meticulously controlled via Azure Role-Based Access Control (RBAC) or Key Vault access policies, enabling fine-grained permissions and comprehensive auditing.
- ✗
Store secrets in application settings as plain text
Why it's wrong here
Storing secrets in application settings as plain text, whether in configuration files, environment variables, or deployment scripts, is a critical security anti-pattern. This method leaves sensitive information completely unencrypted and unprotected, making it highly vulnerable to exposure through source code repositories, compromised build pipelines, or unauthorized access to the application's host environment. It lacks any form of access control, auditing, or encryption, directly violating security best practices and compliance requirements.
- ✗
Use Azure App Configuration for feature flags
Why it's wrong here
Azure App Configuration is designed for managing application settings and feature flags in a centralized and dynamic manner, allowing for configuration changes without requiring application redeployments. While it can store configuration data, it is not engineered with the same level of security and specialized features as Azure Key Vault for high-value secrets. App Configuration lacks HSM-backed protection, advanced access policies tailored for secrets, and the comprehensive auditing capabilities necessary for truly sensitive data, making it unsuitable for storing critical credentials.
- ✓
Assign a managed identity to each function app
Why this is correct
Managed identities eliminate the need to store credentials in code or configuration by providing each function app with an automatically managed service principal in Microsoft Entra ID. This satisfies the constraint of minimising administrative overhead, as there are no secrets to rotate or manage, and the identity is used to authenticate directly to Key Vault or other Azure services.
- ✓
Enable Key Vault soft-delete and purge protection
Why this is correct
Enabling Key Vault's soft-delete feature ensures that when a secret, key, or vault is deleted, it is retained for a configurable period (defaulting to 90 days) in a soft-deleted state, allowing for recovery and preventing accidental data loss. Purge protection, when activated in conjunction with soft-delete, provides an additional layer of security by preventing the permanent deletion (purging) of the key vault or its objects by any user, including privileged administrators, until the soft-delete retention period has fully expired. These features are crucial for business continuity, compliance, and protection against both human error and malicious actions.
Quick reference
Cloud Service Model Comparison
| Model | You Manage | Provider Manages | Examples |
|---|---|---|---|
| IaaS | OS, runtime, apps, data | Hardware, hypervisor, networking | EC2, Azure VMs, GCP Compute Engine |
| PaaS | Apps and data | OS, runtime, middleware, hardware | Elastic Beanstalk, Azure App Service |
| SaaS | Data and settings only | Everything else | Microsoft 365, Salesforce, Workday |
| FaaS / Serverless | Function code only | Infra, scaling, runtime | Lambda, Azure Functions, Cloud Run |
| CaaS | Containers and apps | Kubernetes, OS, hardware | EKS, AKS, GKE |
Go deeper
Related to this question
Learn chapter
Azure Functions Development
Key term
Durable Functions
Durable Functions is an extension of Azure Functions that lets you write stateful workflows in code, managing complex sequences of tasks, retries, and delays automatically.
Key term
Managed identity
A managed identity is an automatically managed service principal in Azure that allows your code to authenticate to any service that supports Azure AD authentication without storing credentials.
About these practice questions
One of 881 original AZ-204 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.