AZ-204 Implement Azure security Practice Question
Your company stores API keys and connection strings in Azure Key Vault. You need to grant an Azure Function read access to these secrets using the principle of least privilege. Which identity type should you assign to the Function App?
⚠ Common exam trap
Many candidates confuse 'access policy' (a permission assignment) with an 'identity type,' or they incorrectly assume a user-assigned managed identity is always more flexible and thus better, overlooking that a system-assigned identity is more restrictive and simpler for a single-resource scenario.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
System-assigned managed identity
A system-assigned managed identity is the correct choice because it is directly tied to the lifecycle of the Azure Function, automatically managed by Azure, and requires no manual credential rotation. It provides the most restrictive scope (only that specific Function App) and adheres to the principle of least privilege by granting access only to the identity that needs it, without the overhead of managing a separate identity or service principal.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
System-assigned managed identity
Why this is correct
A system-assigned managed identity is automatically created and managed by Azure, directly tied to the lifecycle of a single Azure resource, such as a Virtual Machine or App Service. This identity can be granted specific Azure Key Vault access policies, allowing the resource to securely retrieve secrets without any hardcoded credentials or manual secret rotation. It inherently adheres to the principle of least privilege and offers the simplest, most secure method for a single resource to access Key Vault.
- ✗
User-assigned managed identity
Why it's wrong here
A user-assigned managed identity is a standalone Azure resource that can be assigned to multiple Azure services. While technically functional for Key Vault access, using it for a single resource introduces unnecessary management overhead, as it requires creating and managing an additional resource separate from the primary service. For scenarios involving only one resource needing Key Vault access, it deviates from the simplest and most direct path to secure credential management.
- ✗
Service principal
Why it's wrong here
A service principal represents an application identity within Azure Active Directory and requires explicit credential management, typically involving client secrets or certificates. Using a service principal to access Azure Key Vault would necessitate storing and rotating these credentials, which directly contradicts the primary benefit of Key Vault: eliminating the need for applications to manage their own secrets. This approach reintroduces the very security and operational challenges that managed identities are designed to solve.
- ✗
Access policy on the Key Vault
Why it's wrong here
An access policy on the Key Vault is an authorization mechanism that defines what permissions an authenticated identity has (e.g., Get, List secrets). It is not an identity itself, nor does it provide a means for a resource to authenticate to Azure Key Vault. A resource still requires an underlying identity, such as a system-assigned or user-assigned managed identity, to which the access policy can then be applied, granting the necessary permissions.
Go deeper
Related to this question
Learn chapter
Azure Functions Development
Key term
Key Vault Secrets
Key Vault Secrets are secure containers in Microsoft Azure that store sensitive information like passwords, connection strings, and API keys, keeping them encrypted and accessible only to authorized applications and users.
Key term
Managed identity
A managed identity is an automatically managed service principal in Azure that allows your code to authenticate to any service that supports Azure AD authentication without storing credentials.
About these practice questions
This AZ-204 question is part of Courseiva's 881-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.