AZ-204 Practice Question: Connect to and consume Azure services and third-party services
Your Azure Function app needs to call a third-party REST API that requires OAuth 2.0 client credentials flow. The API expects a JWT token signed with a client certificate. You want to store the certificate securely and rotate it automatically. Which Azure service and feature should you use?
⚠ Common exam trap
Candidates often confuse inbound TLS/SSL certificate binding (Option C) with outbound client certificate usage, mistakenly thinking the WEBSITE_LOAD_CERTIFICATES setting provides programmatic access to certificates for signing outbound requests.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Store the certificate in Azure Key Vault with automatic rotation enabled, and use Managed Identity to access it from the Function app.
Azure Key Vault provides secure storage for client certificates with built-in automatic rotation capabilities, and using Managed Identity allows the Azure Function app to authenticate to Key Vault without storing any secrets in code or configuration. This combination satisfies the OAuth 2.0 client credentials flow requirement by enabling the Function app to retrieve the certificate dynamically and sign the JWT token.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Store the certificate in Azure Cosmos DB as a document, and retrieve it using the Cosmos DB SDK.
Why it's wrong here
Azure Cosmos DB is a NoSQL database service designed for storing structured and semi-structured data, not for secure credential management or cryptographic key storage. Storing certificates as documents within Cosmos DB lacks the inherent security controls, robust access policies, and comprehensive auditing capabilities required for sensitive assets like certificates. Furthermore, Cosmos DB does not offer any built-in features for automatic certificate rotation or lifecycle management, which is crucial for maintaining security posture and preventing expiration-related outages in production environments.
- ✓
Store the certificate in Azure Key Vault with automatic rotation enabled, and use Managed Identity to access it from the Function app.
Why this is correct
Azure Key Vault is specifically designed as a secure, centralized store for cryptographic keys, secrets, and certificates, offering robust access control, versioning, and auditing. Enabling automatic rotation within Key Vault ensures certificates are refreshed before expiration, minimizing operational overhead and security risks associated with manual management. Using Managed Identity allows the Azure Function App to authenticate directly with Key Vault without needing to manage any connection strings or secrets, adhering to the principle of least privilege and significantly enhancing overall security. This combination represents the recommended best practice for secure certificate handling and access in Azure.
- ✗
Store the certificate in Azure App Service as a TLS/SSL binding, and use the WEBSITE_LOAD_CERTIFICATES app setting.
Why it's wrong here
While Azure App Service can host certificates for inbound TLS/SSL bindings to secure web traffic to the app, this mechanism is primarily for server-side certificates used for domain validation. The `WEBSITE_LOAD_CERTIFICATES` setting allows loading certificates into the app's personal store, but the App Service platform itself does not provide automatic rotation capabilities for *client* certificates used for outbound API authentication. Managing the lifecycle and rotation of client certificates for third-party API calls would still be a manual process, making this option inefficient, prone to expiration issues, and not suitable for a robust, automated solution.
- ✗
Store the certificate in Azure Storage as a blob, and reference it from the Function app using a SAS token.
Why it's wrong here
Azure Storage is a general-purpose object storage service, not engineered for secure certificate management or cryptographic operations. Storing sensitive certificates as blobs, even with a Shared Access Signature (SAS) token, introduces security risks as SAS tokens have expiration and can be misused if compromised, lacking the granular access control of a dedicated secret store. Critically, Azure Storage offers no native features for automatic certificate rotation, versioning, or lifecycle management, which are essential for maintaining the security and operational integrity of certificates used for API authentication in a production environment.
Go deeper
Related to this question
Learn chapter
Azure Functions Development
Key term
Key Vault Secrets
Key Vault Secrets are secure containers in Microsoft Azure that store sensitive information like passwords, connection strings, and API keys, keeping them encrypted and accessible only to authorized applications and users.
Key term
Managed identity
A managed identity is an automatically managed service principal in Azure that allows your code to authenticate to any service that supports Azure AD authentication without storing credentials.
About these practice questions
Courseiva writes every AZ-204 question from scratch — 881 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.