AZ-900 Describe Azure management and governance Practice Question
A company uses Azure Resource Manager templates to deploy infrastructure. They need to manage secrets such as database connection strings and passwords securely. Which Azure service should they use to store and retrieve these secrets during deployment?
⚠ Common exam trap
Many candidates confuse Azure Key Vault with Azure Managed Identity or Service Principal, as candidates often think that Managed Identity or Service Principals are used to store secrets, when in fact they are identities that require secrets to be stored elsewhere, typically in Key Vault.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A) Azure Key Vault
Azure Key Vault is the correct service because it is designed specifically to securely store and manage secrets such as database connection strings, passwords, and certificates. During Azure Resource Manager (ARM) template deployments, you can reference Key Vault secrets directly in the template using a linked template or a parameter file, allowing the secrets to be retrieved at deployment time without exposing them in plaintext. This integration ensures that sensitive values are never hardcoded or stored in source control.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
A) Azure Key Vault
Why this is correct
Azure Key Vault is the correct choice because ARM templates can dynamically reference Key Vault secrets at deployment time using the `reference` function with the secret's resource identifier. This enables secure injection of passwords, connection strings, or other sensitive values without embedding them in the template or parameter file. The deploying identity must have appropriate access (via access policies or RBAC) to the Key Vault, ensuring secrets are never exposed in logs or source control.
- ✗
B) Azure Policy
Why it's wrong here
Azure Policy is a governance tool that enforces organizational standards and compliance rules across Azure resources, such as allowed locations or required tags. It evaluates resource properties and can deny or modify non-compliant resources, but it has no mechanism to store, retrieve, or inject secret values into ARM deployments. Attempting to use Policy for secret management would be outside its design, and it cannot serve as a data source for template parameters.
When this WOULD be correct
An exam question asking which service can enforce tagging rules or restrict resource types across subscriptions would have Azure Policy as the correct answer.
- ✗
C) Azure Managed Identity
Why it's wrong here
Azure Managed Identity provides an automatically managed identity in Azure AD for Azure resources, allowing them to authenticate to services like Key Vault without explicit credentials. However, it is still an authentication mechanism, not a storage location; Managed Identities do not hold or manage secrets themselves. For ARM templates, a User-Assigned Managed Identity can be used as the deployment identity to access Key Vault, but the secret must already be stored in Key Vault, making Managed Identity the wrong answer for the storage component.
When this WOULD be correct
A question asking how to securely authenticate an Azure resource (e.g., a virtual machine or app service) to Azure Key Vault or another Azure service without storing credentials in code or configuration files. Managed Identity would be the correct answer for that scenario.
- ✗
D) Azure Service Principal
Why it's wrong here
An Azure Service Principal is an identity created for applications or automation to authenticate to Azure and perform authorized actions, typically with a client secret or certificate. While it has its own credential for authentication, it is not a secret storage service and cannot be used by ARM templates to fetch arbitrary secrets during deployment. In fact, a service principal is often used to authorize access to Key Vault, but it is the identity, not the store.
When this WOULD be correct
A question asking which Azure identity should be used to grant an automated deployment script permissions to access Azure resources, without storing credentials in code, would have Service Principal as the correct answer.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓A) Azure Key VaultCorrect answer▾
Why this is correct
Azure Key Vault is the correct choice because ARM templates can dynamically reference Key Vault secrets at deployment time using the `reference` function with the secret's resource identifier. This enables secure injection of passwords, connection strings, or other sensitive values without embedding them in the template or parameter file. The deploying identity must have appropriate access (via access policies or RBAC) to the Key Vault, ensuring secrets are never exposed in logs or source control.
✗B) Azure PolicyWrong answer — click to see why▾
Why this is wrong here
Azure Policy is used to enforce organizational standards and assess compliance, not to securely store and retrieve secrets like database connection strings during deployment.
★ When this WOULD be the correct answer
An exam question asking which service can enforce tagging rules or restrict resource types across subscriptions would have Azure Policy as the correct answer.
Why candidates choose this
Candidates may confuse policy with security management, thinking policies can control access to secrets, but Azure Policy is for governance, not secret storage.
✗C) Azure Managed IdentityWrong answer — click to see why▾
Why this is wrong here
Azure Managed Identity provides an automatically managed identity in Azure AD for authenticating to services that support Azure AD authentication, but it does not store or retrieve secrets like database connection strings or passwords. It is not a secret storage service.
★ When this WOULD be the correct answer
A question asking how to securely authenticate an Azure resource (e.g., a virtual machine or app service) to Azure Key Vault or another Azure service without storing credentials in code or configuration files. Managed Identity would be the correct answer for that scenario.
Why candidates choose this
Candidates may confuse Managed Identity with a secure way to handle secrets because it eliminates the need for explicit credentials, but it is an identity mechanism, not a secret store.
✗D) Azure Service PrincipalWrong answer — click to see why▾
Why this is wrong here
Azure Service Principal is an identity used by applications to authenticate to Azure services, not a service for securely storing and retrieving secrets like database connection strings during deployment.
★ When this WOULD be the correct answer
A question asking which Azure identity should be used to grant an automated deployment script permissions to access Azure resources, without storing credentials in code, would have Service Principal as the correct answer.
Why candidates choose this
Candidates may confuse Service Principal with a secure credential store because it involves authentication and can be used to access secrets, but it does not store them itself.
Analysis generated from the official AZ-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Azure Cost Management and Billing
Key term
ARM
ARM stands for Azure Resource Manager, the management layer that enables you to create, update, and delete resources in your Azure account.
Key term
Azure Resource Manager
Azure Resource Manager (ARM) is the deployment and management service for Azure that provides a consistent management layer for creating, updating, and deleting resources in your Azure account.
About these practice questions
This AZ-900 question is part of Courseiva's 981-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.