The correct answer is Azure Key Vault.

Azure Key Vault is designed to securely store and manage secrets such as database connection strings and it provides encryption at rest, integration with Azure Active Directory for access control, and support for managed identities so the application can retrieve secrets without embedding credentials.

Using Azure Key Vault also enables secret versioning and rotation and it provides logging and auditing so you can track secret access. These capabilities reduce the risk of accidental exposure and make operational security simpler than storing secrets in code or files.

Embed the connection string directly in application code is insecure because code repositories can be leaked and it makes rotation difficult. This practice exposes credentials to developers and to any system with access to the source code.

Use Google Secret Manager is a legitimate secrets service but it is not the recommended choice for protecting an Azure SQL connection string in an Azure environment. Using the cloud provider native secret store such as Azure Key Vault simplifies authentication and access control and avoids cross cloud complexity.

Keep the connection string in a local configuration file is risky because files can be copied or accidentally committed and they are hard to secure at scale. Configuration files do not provide the centralized access controls and auditing that a secrets manager provides.

Full AWS Practitioner Certification Question