AZ-500 Secure compute, storage, and databases Practice Question
You need to securely store secrets, such as connection strings and API keys, for use by an Azure Functions app. The solution must automatically rotate the secrets and audit access. What should you use?
⚠ Common exam trap
Many exam-takers confuse Managed Identity with a secret storage solution, but Managed Identity is an authentication mechanism, not a store for secrets like connection strings or API keys.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure Key Vault
Azure Key Vault is the correct choice because it provides a centralized, secure store for secrets like connection strings and API keys, with built-in support for automatic rotation via integration with Azure Key Vault references in Azure Functions and access auditing through diagnostic logs and Azure Monitor. This meets the requirements of secure storage, automated secret rotation, and audit trail generation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Azure Key Vault
Why this is correct
Azure Key Vault is the correct choice because it is a purpose-built secret management service that stores connection strings and other secrets encrypted at rest, with granular access policies integrated with Microsoft Entra ID. It provides native secret versioning and rotation, full audit logging via diagnostics, and soft-delete/purge protection to prevent accidental or malicious loss. Applications can securely retrieve secrets at runtime using service principals or Managed Identity, eliminating the need to embed credentials in code or configuration.
- ✗
Azure Blob Storage with encryption
Why it's wrong here
Azure Blob Storage with encryption is incorrect because although server-side encryption (SSE) encrypts data at rest, Blob Storage is designed for unstructured data, not secret management. It lacks built-in rotation, versioning of individual secrets, secret-level access logging, and fine-grained access policies aligned to Microsoft Entra ID; you would have to implement all lifecycle management manually. Storing secrets as blobs also leaves their exposure and auditing far less controlled than a dedicated vault.
- ✗
Managed Identity
Why it's wrong here
Managed Identity is not a secret storage mechanism; it is an Microsoft Entra ID identity that allows an Azure resource (like a Function App) to authenticate to services such as Key Vault without any credentials in code. A Managed Identity cannot store or hold connection strings or passwords — it only represents the resource's identity and is used to obtain Microsoft Entra ID tokens. Therefore, it does not replace Key Vault for storing secrets; rather, it works alongside Key Vault to grant authenticated access to those secrets.
- ✗
Application settings in the function app configuration
Why it's wrong here
Application settings in the function app configuration are not encrypted at rest and are stored as plaintext within the App Service configuration, visible to anyone with read/write access to the resource. They offer no native secret rotation, versioning, or audit trail of changes, making them a poor choice for sensitive connection strings. Azure Function app settings do support Key Vault references as the secure alternative, meaning the secret itself should live in Key Vault, not in the app setting value.
Quick reference
Cloud Service Model Comparison
| Model | You Manage | Provider Manages | Examples |
|---|---|---|---|
| IaaS | OS, runtime, apps, data | Hardware, hypervisor, networking | EC2, Azure VMs, GCP Compute Engine |
| PaaS | Apps and data | OS, runtime, middleware, hardware | Elastic Beanstalk, Azure App Service |
| SaaS | Data and settings only | Everything else | Microsoft 365, Salesforce, Workday |
| FaaS / Serverless | Function code only | Infra, scaling, runtime | Lambda, Azure Functions, Cloud Run |
| CaaS | Containers and apps | Kubernetes, OS, hardware | EKS, AKS, GKE |
Go deeper
Related to this question
About these practice questions
Courseiva writes every AZ-500 question from scratch — 617 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-500 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-500 exam.