AZ-900 Describe Azure architecture and services Practice Question
Which Azure service manages application secrets, API keys, and certificates in a centralized, secure vault?
⚠ Common exam trap
Test-takers frequently confuse Azure Key Vault with Azure Active Directory, assuming that identity management includes secret storage, but Azure AD handles authentication tokens and user identities, not the secure storage of application secrets, API keys, or certificates.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure Key Vault
Azure Key Vault is the correct service because it is specifically designed to centrally store and control access to application secrets, API keys, and certificates. It provides hardware security module (HSM)-backed encryption, granular access policies via Azure RBAC, and integrates seamlessly with Azure services like VMs and App Services to inject secrets at runtime without exposing them in code.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Azure Active Directory
Why it's wrong here
Azure Active Directory (Azure AD) is Microsoft's cloud-based identity and access management service, handling user authentication, single sign-on, and conditional access policies. It manages identities and permissions for users and applications, but it is not designed to store application secrets, encryption keys, or SSL/TLS certificates as a service. While Azure AD is used to authenticate access to Key Vault, it itself does not provide the secret storage capability required by the scenario.
- ✗
Azure Information Protection
Why it's wrong here
Azure Information Protection (AIP) is a data classification and labeling solution that helps protect sensitive documents and emails by applying labels, watermarks, and encryption for compliance and governance. It focuses on classifying and protecting data at the document and email level, not on centrally storing and managing application secrets or certificates. AIP lacks the key and certificate lifecycle management features of Key Vault, so it is unsuitable for this requirement of securely storing and controlling access to secrets.
- ✓
Azure Key Vault
Why this is correct
Azure Key Vault is the correct choice because it is a cloud service specifically designed to securely store and tightly control access to secrets such as API keys, passwords, and connection strings, as well as encryption keys and SSL/TLS certificates. It integrates with Azure services and applications, enabling centralized management, automatic certificate renewal, and fine-grained access policies via Azure Active Directory. By using Key Vault, you avoid storing sensitive material in code or configuration files, significantly reducing the risk of credential leakage.
- ✗
Azure Security Center
Why it's wrong here
Azure Security Center is a unified infrastructure security management system that provides security posture monitoring, threat detection, and recommendations across hybrid cloud workloads. While it can help identify misconfigurations and vulnerabilities, it does not offer a dedicated, hardened storage service for application secrets or certificates. Its purpose is to assess and improve security, not to act as a vault for sensitive data, so it would not meet the requirement to securely store and control access to secrets and certificates.
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
Azure Regions and Geographies
Key term
Azure Key Vault
Azure Key Vault is a cloud service for securely storing and managing sensitive information like passwords, encryption keys, and certificates.
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
About these practice questions
Courseiva writes every AZ-900 question from scratch — 981 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.