AZ-204 Implement Azure security Practice Question
Your organization uses Azure Key Vault to store secrets. Developers need to retrieve secrets during application runtime. You want to minimize latency and avoid network overhead. Which approach should you recommend?
⚠ Common exam trap
Watch out — candidates often confuse security features (like firewalls or soft-delete) with performance optimizations, or mistakenly think that storing secrets in config files is acceptable for minimizing latency, ignoring the critical security implications.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Implement caching of secrets in the application with a short time-to-live (TTL) and use Key Vault as the source of truth.
It directly addresses the need to minimize latency and network overhead by caching secrets locally with a short TTL, while still using Azure Key Vault as the authoritative source. This pattern reduces the frequency of network calls to Key Vault, which is critical for high-throughput applications where every millisecond matters. The short TTL ensures that secret updates are eventually reflected without stale data persisting indefinitely.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable the Key Vault firewall and allow only trusted Azure services.
Why it's wrong here
Enabling the Key Vault firewall restricts network access to the vault, enhancing security by only allowing connections from specified IP ranges or trusted Azure services. While crucial for data protection, this feature operates at the network perimeter and does not inherently reduce the latency of secret retrieval operations for applications. It is a security measure designed to control who can connect to the vault, not a performance optimization technique for secret access.
- ✗
Store the secrets directly in application configuration files.
Why it's wrong here
Storing secrets directly in application configuration files, such as `appsettings.json` or environment variables within the application package, is a significant security vulnerability. These files are often deployed with the application, making secrets susceptible to unauthorized access if the application or deployment package is compromised. This practice bypasses secure secret management principles and is strongly discouraged in production environments due to the high risk of exposure.
- ✓
Implement caching of secrets in the application with a short time-to-live (TTL) and use Key Vault as the source of truth.
Why this is correct
Implementing application-level caching for secrets, coupled with a short time-to-live (TTL), significantly reduces the frequency of direct calls to Azure Key Vault. This approach minimizes network latency associated with repeated Key Vault requests and decreases the operational load on the Key Vault service itself. Key Vault remains the authoritative source, ensuring secrets are eventually refreshed and updated, balancing performance with security and freshness.
- ✗
Enable Key Vault soft-delete to ensure secrets are recoverable.
Why it's wrong here
Enabling Key Vault soft-delete provides a crucial data protection mechanism, allowing for the recovery of accidentally deleted secrets, keys, or certificates within a configurable retention period. This feature safeguards against data loss and ensures business continuity by preventing permanent deletion for a set duration. However, soft-delete does not impact the performance or latency of secret retrieval operations for an active application; its purpose is solely for disaster recovery and operational resilience, not runtime optimization.
Go deeper
Related to this question
About these practice questions
Courseiva writes every AZ-204 question from scratch — 881 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.