AZ-204 Implement Azure security Practice Question
Your application uses Azure Key Vault to store secrets. You need to ensure that the application can access secrets without storing any credentials in the application code or configuration files. What should you use?
⚠ Common exam trap
AZ-204 often tests credential-free authentication — candidates pick 'access policies' or 'client certificate' because they sound secure, missing that only managed identity removes credentials from code and configuration entirely.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure Managed Identity
Azure Managed Identity provides an automatically managed identity in Microsoft Entra ID for the application to authenticate to Azure Key Vault without any credentials in code or configuration. The application requests a token from the managed identity endpoint, and Key Vault validates that token against its access policy or RBAC role assignment. This eliminates secret storage entirely for the authentication step.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Azure Managed Identity
Why this is correct
Azure Managed Identity gives the application a Microsoft Entra ID service principal whose credentials Azure manages and rotates automatically, so no secret is stored in code or configuration. Assigning it Key Vault access via RBAC or access policy satisfies the credential-free requirement directly.
- ✗
Key Vault access policies
Why it's wrong here
Access policies grant permissions but still require the caller to authenticate first, so credentials remain in code or config. They are tempting because they are Key Vault's legacy authorisation mechanism, and would suit scenarios where a managed identity or service principal already authenticates and only permission scoping is needed.
- ✗
A connection string with the secret
Why it's wrong here
Embedding the secret in a connection string places the credential directly in application configuration, which the scenario explicitly forbids. Connection strings are tempting because they are the conventional way to supply database endpoints and keys, and would be correct where the secret is injected at runtime from a managed identity or environment variable.
- ✗
A client certificate stored in the application
Why it's wrong here
Storing a client certificate in the application still embeds credential material within the application package, violating the requirement to avoid storing any credentials in code or configuration files. This approach is tempting because client certificates are a valid authentication method for Key Vault when the certificate itself is securely held outside the application—for example, in a managed identity or a certificate store accessed at runtime—but placing it inside the application defeats the purpose of credentialless access.
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
Function App Settings and Configuration
Key term
Key Vault Secrets
Key Vault Secrets are secure containers in Microsoft Azure that store sensitive information like passwords, connection strings, and API keys, keeping them encrypted and accessible only to authorized applications and users.
Key term
Managed identity
A managed identity is an automatically managed service principal in Azure that allows your code to authenticate to any service that supports Microsoft Entra ID authentication without storing credentials.
About these practice questions
Courseiva writes every AZ-204 question from scratch — 883 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Microsoft exam blueprint
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.