AZ-204 — Data and application security
Route position
After selecting a runtime, the learner needs to decide where application state lives and how code reaches it without embedding durable credentials. This path precedes event integration and observability.
Ordered modules
- Cosmos DB and Blob Storage through SDKs
- Application configuration, Key Vault, SAS, and managed identities
Core relationships
The application authenticates as a principal, receives authorization at the data service, uses an SDK to make a data-plane request, and emits telemetry about the outcome. A storage lifecycle policy changes stored data over time; it is not a backup. A managed identity removes application-managed credentials, but it still needs an explicit role or data permission.
Checkpoint
Explain the complete path for an API request that reads a Blob and writes Cosmos DB: identity, authorization, SDK call, partition/key or object boundary, lifecycle consequence, and telemetry. Then diagnose a 403 as either missing permission, an expired delegation, or a wrong endpoint.
Sources and re-audit
- AZ-204 study guide, storage and security objectives, skills measured 2026-01-14; checked 2026-08-31.
- Azure storage security, checked 2026-08-31.
Re-audit when SDK, authorization, data-protection, or lifecycle behavior changes.