A company has a strict security policy that requires all secrets to be stored in Azure Key Vault and all applications to use managed identities. They have a legacy application that runs on an on-premises server and cannot use managed identities. The application needs to access a secret in Key Vault. The company wants to minimize the risk of secret leakage. What should you recommend?

Move the application to an Azure VM and enable a managed identity.

Use a certificate-based service principal and install the certificate on the on-premises server.

Create a service principal, store its client secret in Key Vault, and have the on-premises app retrieve the secret using the service principal.

Use a shared access signature to access Key Vault.

How does an Azure App Service application with a managed identity authenticate to Azure Key Vault?

It sends the client secret directly to Key Vault

It uses a shared access signature (SAS) token

It obtains an Azure AD token using the managed identity and passes it to Key Vault

It uses the Key Vault access key stored in the application settings

A company has multiple Azure Functions that need to access the same Azure SQL database. They want to use Azure AD authentication for the database. The functions are deployed in the same region and share the same resource group. You need to configure the identities for the functions. What is the most efficient approach?

Create one user-assigned managed identity and assign it to all the functions, then grant that identity access to the database.

Assign a user-assigned managed identity to each function and grant it access to the database.

Use a service principal with a certificate and configure each function to use it.

Enable system-assigned managed identity on each function and grant each identity access to the database.

Azure Developer Associate

Domain 3Objective 2

Implement Secure Azure Solutions AZ-204 Practice Questions (Page 5)

Part of the Implement Azure security domain, which accounts for 15-20% of the AZ-204 exam. Microsoft does not publish an official question count, but from its 100-minute exam (~40–65 total, ~6–13 in this domain), expect 3–7 from this objective — we provide 35 practice questions to prepare you well beyond it. (estimate)

35questions here

7free pages

8concepts

15-20%of the exam

Questions 21–25

21expert · hard
A company has a strict security policy that requires all secrets to be stored in Azure Key Vault and all applications to use managed identities. They have a legacy application that runs on an on-premises server and cannot use managed identities. The application needs to access a secret in Key Vault. The company wants to minimize the risk of secret leakage. What should you recommend?
Select an answer first
22foundation · easy
How does an Azure App Service application with a managed identity authenticate to Azure Key Vault?
Select an answer first
23foundation · easy
Which feature of Azure App Configuration allows you to enable or disable application functionality without redeploying the application?
Select an answer first
24application · medium
A company has multiple Azure Functions that need to access the same Azure SQL database. They want to use Azure AD authentication for the database. The functions are deployed in the same region and share the same resource group. You need to configure the identities for the functions. What is the most efficient approach?
Select an answer first
25foundation · easy
What method does the SecretClient class provide to retrieve a secret from Azure Key Vault?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to AZ-204

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “AZ-204” is a trademark of its owner, used for identification only.

Implement Secure Azure Solutions AZ-204 Practice Questions (Page 5)

Questions 21–25

How does an Azure App Service application with a managed identity authenticate to Azure Key Vault?

Which feature of Azure App Configuration allows you to enable or disable application functionality without redeploying the application?

What method does the SecretClient class provide to retrieve a secret from Azure Key Vault?

Keep studying — Implement Azure security