AZ-204 Implement Azure security Practice Question
Your application uses Azure Key Vault to store secrets. You need to ensure that the application can access secrets without storing any credentials in the application code or configuration files. What should you use?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure Managed Identity
Azure Managed Identity enables Azure resources (such as App Service, Functions, or VMs) to authenticate to Azure Key Vault without storing any credentials in code or configuration files. This is the recommended approach for secure access. Option A is correct. Option B is incorrect because Key Vault access policies control permissions but do not eliminate the need for authentication credentials. Option C is incorrect because a connection string inherently includes credentials, violating the requirement. Option D is incorrect because a client certificate still requires storing and managing the certificate, which introduces credential management overhead.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Azure Managed Identity
Why this is correct
Managed Identity provides an automatically managed identity for authentication.
- ✗
Key Vault access policies
Why it's wrong here
Access policies control permissions, not authentication.
- ✗
A connection string with the secret
Why it's wrong here
This would expose credentials in code or config.
- ✗
A client certificate stored in the application
Why it's wrong here
Storing a client certificate in the application still embeds credential material within the application package, violating the requirement to avoid storing any credentials in code or configuration files. This approach is tempting because client certificates are a valid authentication method for Key Vault when the certificate itself is securely held outside the application—for example, in a managed identity or a certificate store accessed at runtime—but placing it inside the application defeats the purpose of credentialless access.
Go deeper
Related to this question
Learn chapter
Azure Functions Development
Key term
Key Vault Secrets
Key Vault Secrets are secure containers in Microsoft Azure that store sensitive information like passwords, connection strings, and API keys, keeping them encrypted and accessible only to authorized applications and users.
Key term
Managed identity
A managed identity is an automatically managed service principal in Azure that allows your code to authenticate to any service that supports Azure AD authentication without storing credentials.
About these practice questions
Courseiva writes every AZ-204 question from scratch — 881 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.