AZ-204 Implement Azure security Practice Question
Your company stores customer payment data in an Azure SQL Database. You need to ensure that only the application's managed identity can access the database, and no SQL logins or passwords are used. Which authentication method should you configure?
⚠ Common exam trap
Candidates often confuse network-level security (firewall rules) or data encryption (TDE) with authentication, failing to recognize that only Entra ID authentication with a managed identity eliminates the need for SQL logins and passwords entirely.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use Microsoft Entra ID authentication with the managed identity configured as a contained database user
Configuring the managed identity as a contained database user in Azure SQL Database using Microsoft Entra ID authentication allows the application to authenticate without any SQL logins or passwords. The managed identity provides an automatically managed service principal in Entra ID, which can be mapped to a contained database user (CREATE USER [<identity-name>] FROM EXTERNAL PROVIDER). This enables token-based authentication using OAuth 2.0, ensuring that only the application's identity can access the database.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
SQL Server authentication with a strong password stored in Key Vault
Why it's wrong here
While storing a strong password in Azure Key Vault is a security best practice for credential management, this approach still relies on traditional SQL Server authentication. This means the application must retrieve the password from Key Vault and present it to Azure SQL Database, creating a credential management burden and a potential secret exposure point. It does not leverage the credential-less authentication benefits of managed identities, which is a more secure and operationally simpler method for Azure services.
- ✓
Use Microsoft Entra ID authentication with the managed identity configured as a contained database user
Why this is correct
This is the correct approach because it leverages Microsoft Entra ID authentication, allowing an Azure service, like an application running on an App Service or VM, to authenticate to Azure SQL Database using its assigned managed identity. The managed identity is then configured as a contained database user within the Azure SQL database, granting it specific permissions without requiring any passwords or connection strings containing secrets. This eliminates credential management overhead and significantly enhances security by removing secret exposure risks.
- ✗
Enable Transparent Data Encryption (TDE) and use the database's certificate
Why it's wrong here
Transparent Data Encryption (TDE) is a feature designed to encrypt data at rest within the database files, backups, and transaction log files. While crucial for data protection and compliance, TDE operates at the storage layer and does not provide any mechanism for authenticating an application or user to the database. It secures the data itself, not the access pathway or the identity of the connecting principal, making it unrelated to the authentication problem.
- ✗
Configure the Azure SQL firewall to allow only the application's outbound IP
Why it's wrong here
Configuring the Azure SQL firewall to restrict access to specific outbound IP addresses is a fundamental network security measure that controls *who can connect* at a network level. However, firewall rules only permit or deny network traffic based on IP addresses; they do not authenticate the *identity* of the connecting application or user. An application with a permitted IP still needs a valid username and password or a managed identity to successfully log in to the database.
Go deeper
Related to this question
Learn chapter
Azure Functions Development
Key term
Key Vault Secrets
Key Vault Secrets are secure containers in Microsoft Azure that store sensitive information like passwords, connection strings, and API keys, keeping them encrypted and accessible only to authorized applications and users.
Key term
Managed identity
A managed identity is an automatically managed service principal in Azure that allows your code to authenticate to any service that supports Azure AD authentication without storing credentials.
About these practice questions
Courseiva writes every AZ-204 question from scratch — 881 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.