A company is deploying an application to Azure Kubernetes Service (AKS). The application needs to access secrets in Key Vault. The team wants to avoid storing secrets in Kubernetes secrets and wants to use managed identities. What is the recommended approach?

Use Azure Key Vault FlexVolume with a service principal.

Store the secrets in Kubernetes secrets and use a managed identity to encrypt them.

Use the AKS cluster's system-assigned managed identity and access Key Vault directly from the application code.

Use the Secrets Store CSI driver with a user-assigned managed identity to mount secrets from Key Vault as volumes.

A company has a web app on Azure App Service that needs to access Azure Storage and Azure SQL Database. They want to use managed identities. The web app is deployed in a staging slot and a production slot. They want the staging slot to have different permissions than production. What should they do?

Enable a user-assigned managed identity and assign it to both slots, then grant different permissions to the identity.

Enable a system-assigned managed identity on the web app and use the same identity for both slots.

Use a service principal with different client secrets for each slot.

Enable separate user-assigned managed identities for each slot and assign them to the respective slots.

A developer is building a web app that runs on Azure App Service and needs to access Key Vault. The app uses a user-assigned managed identity. Which code should the developer use to authenticate to Key Vault?

new ClientSecretCredential(tenantId, clientId, clientSecret)

new DefaultAzureCredential(new DefaultAzureCredentialOptions { ManagedIdentityClientId = userAssignedClientId })

new InteractiveBrowserCredential()

new ManagedIdentityCredential()

A team deploys multiple Azure Functions that need to access the same Key Vault. They want to avoid managing individual identities for each function and want to simplify permission assignments. What should they use?

Assign a system-assigned managed identity to each function and grant each identity access to Key Vault.

Create a user-assigned managed identity, assign it to all functions, and grant that identity access to Key Vault.

Use the Key Vault access policy to allow all functions from the same resource group.

Use a service principal with a client secret and share the secret across all functions.

Azure Developer Associate

Domain 3Objective 2

Implement Secure Azure Solutions AZ-204 Practice Questions (Page 3)

Part of the Implement Azure security domain, which accounts for 15-20% of the AZ-204 exam. Microsoft does not publish an official question count, but from its 100-minute exam (~40–65 total, ~6–13 in this domain), expect 3–7 from this objective — we provide 35 practice questions to prepare you well beyond it. (estimate)

35questions here

7free pages

8concepts

15-20%of the exam

Questions 11–15

11expert · hard
A company is deploying an application to Azure Kubernetes Service (AKS). The application needs to access secrets in Key Vault. The team wants to avoid storing secrets in Kubernetes secrets and wants to use managed identities. What is the recommended approach?
Select an answer first
12expert · hard
A company has a web app on Azure App Service that needs to access Azure Storage and Azure SQL Database. They want to use managed identities. The web app is deployed in a staging slot and a production slot. They want the staging slot to have different permissions than production. What should they do?
Select an answer first
13application · medium
A developer is building a web app that runs on Azure App Service and needs to access Key Vault. The app uses a user-assigned managed identity. Which code should the developer use to authenticate to Key Vault?
Select an answer first
14application · medium
A team deploys multiple Azure Functions that need to access the same Key Vault. They want to avoid managing individual identities for each function and want to simplify permission assignments. What should they use?
Select an answer first
15foundation · easy
Which Azure SDK client class is used in .NET code to retrieve secrets from Azure Key Vault?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to AZ-204

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “AZ-204” is a trademark of its owner, used for identification only.

Implement Secure Azure Solutions AZ-204 Practice Questions (Page 3)

Questions 11–15

A company is deploying an application to Azure Kubernetes Service (AKS). The application needs to access secrets in Key Vault. The team wants to avoid storing secrets in Kubernetes secrets and wants to use managed identities. What is the recommended approach?

A developer is building a web app that runs on Azure App Service and needs to access Key Vault. The app uses a user-assigned managed identity. Which code should the developer use to authenticate to Key Vault?

A team deploys multiple Azure Functions that need to access the same Key Vault. They want to avoid managing individual identities for each function and want to simplify permission assignments. What should they use?

Which Azure SDK client class is used in .NET code to retrieve secrets from Azure Key Vault?

Keep studying — Implement Azure security