AZ-204 Implement Azure security Practice Question
Your application uses Azure App Configuration with Microsoft Entra ID authentication. You want to ensure that only authorized services can read configuration values. What is the recommended approach?
⚠ Common exam trap
Many exam-takers confuse storing connection strings in Key Vault (Option C) as the most secure approach, but the question specifically asks for the recommended approach with Entra ID authentication, which is to use managed identities and RBAC instead of any form of shared access keys.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Assign the App Configuration Data Reader role to the managed identity of the consuming service
The recommended approach for authorizing access to Azure App Configuration with Microsoft Entra ID is to use role-based access control (RBAC). By assigning the 'App Configuration Data Reader' role to a managed identity, you grant that specific service identity read-only access to configuration values without exposing keys or connection strings. This aligns with the principle of least privilege and eliminates the security risks associated with shared access keys.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable public network access only from trusted IPs
Why it's wrong here
Enabling public network access only from trusted IPs configures a network firewall rule, restricting which IP addresses can reach the Azure App Configuration endpoint. While this enhances network perimeter security, it is a network control, not an identity-based authorization mechanism. It does not grant or deny specific permissions to read configuration data; it only determines if a connection attempt from a particular source IP is allowed to reach the service at all.
- ✗
Use access keys and rotate them frequently
Why it's wrong here
Using access keys and rotating them frequently involves managing shared secrets that provide administrative access to the App Configuration store. While rotation mitigates the risk of long-lived compromised keys, it still requires secure storage and distribution of these keys. This method is less secure than identity-based access, as a compromised key grants broad access, and it does not leverage Azure Active Directory for fine-grained, identity-driven authorization.
- ✗
Store connection strings in Azure Key Vault and retrieve them at runtime
Why it's wrong here
Storing connection strings in Azure Key Vault and retrieving them at runtime is a secure practice for managing secrets. However, this approach means the consuming service still authenticates to App Configuration using a connection string (which typically contains an access key or token) retrieved from Key Vault. This introduces an additional dependency on Key Vault and does not directly utilize the consuming service's managed identity for authentication and authorization to App Configuration itself, thus adding complexity without fully embracing identity-based access for this specific interaction.
- ✓
Assign the App Configuration Data Reader role to the managed identity of the consuming service
Why this is correct
Assigning the App Configuration Data Reader role to the managed identity of the consuming service is the most secure and recommended approach. A managed identity provides an automatically managed identity in Azure Active Directory for Azure services, eliminating the need for developers to manage credentials. By assigning this specific Azure built-in role, the service is granted least-privilege access to read configuration data directly from App Configuration using its own identity, without any shared secrets or connection strings.
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
Azure Functions Development
Key term
Key Vault Secrets
Key Vault Secrets are secure containers in Microsoft Azure that store sensitive information like passwords, connection strings, and API keys, keeping them encrypted and accessible only to authorized applications and users.
Key term
Azure App Configuration
Azure App Configuration is a managed Azure service that stores and manages application settings and feature flags separately from your code, allowing you to update them without redeploying or restarting your application.
About these practice questions
This AZ-204 question is part of Courseiva's 881-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.