AZ-204 Practice Question: Connect to and consume Azure services and third-party services
Your web app hosted on Azure App Service needs to consume an external SaaS API that requires an API key. The key must be stored securely and rotated without redeploying the app. What is the best approach?
⚠ Common exam trap
The trap is choosing App Service application settings (Option D) because they are simpler and can technically store secrets. However, Azure Key Vault with Managed Identity (Option B) is the recommended best practice for secure secret management in Azure, offering a dedicated, more robust, and auditable solution that aligns with enterprise security standards and the development principles tested in the AZ-204 exam. While App Service settings provide basic security, Key Vault is the superior choice for 'best approach' when dealing with sensitive API keys.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Store the API key in Azure Key Vault and use a managed identity to retrieve it.
Azure Key Vault is specifically designed for securely storing and managing secrets, keys, and certificates. Using a Managed Identity for the App Service allows it to authenticate to Key Vault without needing any secrets (like connection strings or client IDs/secrets) stored within the App Service itself, adhering to the principle of least privilege. Secrets in Key Vault can be rotated independently, and the application can be designed to retrieve the latest version without redeployment, satisfying all requirements. This approach provides the highest level of security, auditability, and adherence to Azure best practices for secret management.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Store the API key in Azure SQL Database and query it at startup.
Why it's wrong here
Storing an API key in Azure SQL Database is not a secure or recommended practice for application secrets. Databases are primarily designed for data storage, not credential management, and typically require their own connection strings and authentication, creating a circular dependency. This approach introduces unnecessary attack surfaces, increases operational overhead for key rotation, and adds latency during application startup as the database must be queried. It also complicates access control, as database permissions would need to be carefully managed for a secret that should ideally be accessed only by the application itself.
- ✓
Store the API key in Azure Key Vault and use a managed identity to retrieve it.
Why this is correct
While using Azure Key Vault for secure storage and managed identities for retrieval is an excellent security practise, this option fails because a managed identity authenticates the web app to *Azure resources*, such as Key Vault itself, using Microsoft Entra ID. It does not provide a mechanism to directly authenticate or pass an API key to an *external* SaaS API. This approach is tempting and would be correct if the external SaaS API supported Microsoft Entra ID authentication, allowing the managed identity to obtain a token for direct access, or if the requirement was solely for the app to securely *access* the key for its own internal use.
- ✗
Store the API key in a configuration file in the application code.
Why it's wrong here
Embedding an API key directly within a configuration file in the application code is a significant security vulnerability. Such files are often committed to source control, exposing the secret to anyone with repository access, including potential insider threats. Furthermore, this method tightly couples the secret to the application's deployment lifecycle, meaning any key rotation or update necessitates a full code change, build, and redeployment, which is inefficient and error-prone. It violates the principle of least privilege and separation of concerns, making secret management cumbersome and insecure.
- ✗
Store the API key in an App Service application setting.
Why it's wrong here
Storing the API key in an App Service application setting is the recommended and most secure approach for this scenario. These settings are encrypted at rest and are not stored in your source control, preventing accidental exposure. They are injected into the application as environment variables at runtime, making them easily accessible by the application code without hardcoding. Crucially, application settings can be updated directly through the Azure portal, Azure CLI, or PowerShell without requiring a redeployment of the application, enabling agile key rotation and configuration changes.
Go deeper
Related to this question
Learn chapter
Azure Functions Development
Key term
Key Vault Secrets
Key Vault Secrets are secure containers in Microsoft Azure that store sensitive information like passwords, connection strings, and API keys, keeping them encrypted and accessible only to authorized applications and users.
Key term
Managed identity
A managed identity is an automatically managed service principal in Azure that allows your code to authenticate to any service that supports Azure AD authentication without storing credentials.
About these practice questions
One of 881 original AZ-204 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.