AZ-900 Describe Azure architecture and services Practice Question
Which Azure service provides a secure way for applications running in Azure to access secrets and keys without storing credentials in code?
⚠ Common exam trap
Candidates often confuse Azure Key Vault (a storage service) with the authentication mechanism itself, mistakenly thinking Key Vault eliminates the need for credentials in code, when in fact it still requires an identity to access it.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure Managed Identities
Azure Managed Identities (Option C) provide an automatically managed identity in Azure AD that applications can use to authenticate to any service supporting Azure AD authentication, including Key Vault, without storing any credentials in code. This eliminates the need for developers to manage secrets or keys, as the Azure infrastructure automatically rotates the identity's credentials.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Azure Key Vault
Why it's wrong here
Azure Key Vault is a centralized vault for storing secrets, keys, and certificates, but it is a storage service rather than an authentication identity. To access Key Vault itself, your application must authenticate using something—such as a managed identity or a service principal—so Key Vault alone does not eliminate credentials. Using Key Vault may hide secrets, but it does not remove the underlying identity requirement, making it incorrect here.
- ✗
Azure AD Service Principals with client secrets
Why it's wrong here
Azure AD Service Principals with client secrets represent an application identity, but they force you to generate, store, and periodically rotate a secret in code, configuration, or Key Vault. That secret can leak, and its lifecycle adds operational overhead. Managed Identities are the Azure-native alternative because Azure automatically rotates and protects the credential, so this approach is incorrect for a credential-free design.
- ✓
Azure Managed Identities
Why this is correct
Azure Managed Identities provide an Azure resource with an automatically managed Azure AD identity, allowing it to authenticate to services like Key Vault or Storage without any credentials embedded in source code. The identity is tied to the Azure resource itself, and Azure handles secret rotation and binding on the resource's behalf. This exactly satisfies the requirement, making it the correct answer for eliminating credential management.
- ✗
Azure Certificate Manager
Why it's wrong here
Azure Certificate Manager is not a real Azure service; certificate lifecycle is handled through App Service managed certificates or secrets stored in Key Vault. Even if certificates were used for service-to-service authentication, they would still require secure storage, renewal, and explicit configuration, which does not remove credential handling. The goal is identity without credentials, so this option does not apply and is incorrect.
Go deeper
Related to this question
About these practice questions
This AZ-900 question is part of Courseiva's 981-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.