AZ-204 Practice Question: Connect to and consume Azure services and third-party services
Your company uses Azure API Management (APIM) to expose several APIs. One of the backend APIs requires an API key that is stored in Azure Key Vault. You need to configure APIM to retrieve the API key from Key Vault and pass it to the backend in a header without exposing the key in policy definitions. Which APIM feature should you use?
⚠ Common exam trap
Many exam-takers confuse the authentication-managed-identity policy (used for backend authentication) with the named value Key Vault integration (used for secret retrieval), leading them to select option D even though it does not directly retrieve secrets from Key Vault.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use a named value that references the Key Vault secret, and reference that named value in a set-header policy.
Named values in Azure API Management can be configured to reference secrets stored in Azure Key Vault. When a named value is linked to a Key Vault secret, APIM automatically retrieves the secret value at runtime and can inject it into policies (e.g., a set-header policy) without the secret ever appearing in plaintext in the policy definition. This approach ensures the API key is securely managed and not exposed in source control or policy code.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use a policy expression with the context.Variables to store the key.
Why it's wrong here
Using a policy expression with `context.Variables` allows for storing values temporarily during a policy execution, but it does not provide a mechanism to securely retrieve secrets directly from Azure Key Vault. The API key would still need to be fetched from a secure source and then assigned to a context variable, which this option fails to address. This approach merely facilitates in-policy data manipulation, not secure secret retrieval from an external vault.
- ✗
Store the API key directly in the backend settings of the API.
Why it's wrong here
Storing the API key directly in the backend settings of the API is a significant security vulnerability. This method embeds sensitive credentials in plaintext within the API Management configuration, making them easily discoverable by anyone with access to the APIM instance's configuration. It completely bypasses secure secret management practices and is not suitable for production environments or compliance requirements.
- ✓
Use a named value that references the Key Vault secret, and reference that named value in a set-header policy.
Why this is correct
This is the correct and recommended approach for securely managing secrets in Azure API Management. Named values can be configured to reference a secret stored in Azure Key Vault. APIM, using its managed identity, securely retrieves the secret at runtime and injects its value into the `set-header` policy without ever exposing the secret in the APIM configuration or policy definitions.
- ✗
Use the authentication-managed-identity policy to authenticate to Key Vault and retrieve the secret.
Why it's wrong here
While Azure API Management does leverage managed identities for secure integration with other Azure services, there isn't a direct, built-in policy named `authentication-managed-identity` specifically designed to retrieve secrets from Key Vault. The `authentication-managed-identity` policy is primarily used for APIM to authenticate to *backend services* using its managed identity. Key Vault secret retrieval is handled implicitly through named values, which internally use APIM's managed identity for authentication to Key Vault.
Go deeper
Related to this question
Learn chapter
Azure Functions Development
Key term
Key Vault Secrets
Key Vault Secrets are secure containers in Microsoft Azure that store sensitive information like passwords, connection strings, and API keys, keeping them encrypted and accessible only to authorized applications and users.
Key term
API Management
API Management is a service that acts as a front door for application programming interfaces, controlling access, monitoring usage, and enforcing security policies.
About these practice questions
This AZ-204 question is part of Courseiva's 881-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.