AZ-900 Describe Azure management and governance Practice Question
A company needs to store database connection strings and API keys securely, ensuring only authorized applications can access them. Which Azure service is designed for this?
⚠ Common exam trap
Candidates often confuse Azure Key Vault with Azure Storage encryption, assuming that encrypting a storage account is sufficient for managing secrets, but Key Vault is the only service that provides centralized secret management with access policies and audit logging.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure Key Vault
Azure Key Vault is the correct service because it is specifically designed to securely store and manage secrets such as database connection strings, API keys, and certificates. It provides fine-grained access control via Azure RBAC and access policies, ensuring only authorized applications and users can retrieve secrets. This aligns directly with the requirement for secure, authorized access to sensitive configuration data.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Azure Storage with encryption
Why it's wrong here
Azure Storage encrypts data at rest and in transit on generic blob, file, table, and queue containers, and it can be secured with shared access signatures or managed identities. However, it is not purpose-built for secrets management: it lacks per-secret access policies, expiration, versioning, and integrated auditing, so storing secrets there would require custom implementation and still be less secure and manageable than Key Vault.
- ✓
Azure Key Vault
Why this is correct
Azure Key Vault is a cloud service designed specifically to safeguard cryptographic keys, certificates, and application secrets such as connection strings and API keys. It enforces access control through Azure AD and RBAC/access policies, supports hardware security modules for key protection, and integrates with monitoring and rotation for audited, centralized secrets management.
- ✗
Azure Active Directory
Why it's wrong here
Azure AD is Microsoft's identity and access management directory service, handling user authentication, single sign-on, and authorization via tokens and conditional access. Although app registrations can use client secrets for service-principal authentication, Azure AD is not a vault for general application secrets like database passwords or storage keys, and it cannot provide Key Vault's centralized secret lifecycle and audit features.
- ✗
Azure Policy
Why it's wrong here
Azure Policy is a governance service that evaluates Azure resources for compliance by applying rules over resource properties, tags, or allowed configurations. It can, for instance, audit whether a Key Vault enables soft delete or restrict resources to certain regions, but it does not store, encrypt, or rotate application secrets, because it is purely a policy enforcement and compliance engine.
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
Azure Cost Management and Billing
Key term
RBAC
RBAC is a method of restricting network access based on the roles of individual users within an organization, where permissions are assigned to roles rather than to individuals directly.
Key term
Azure Key Vault
Azure Key Vault is a cloud service for securely storing and managing sensitive information like passwords, encryption keys, and certificates.
About these practice questions
This AZ-900 question is part of Courseiva's 981-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.