AZ-204 Practice Test 19 — 15 Questions

Question 1

You are deploying an Azure Kubernetes Service (AKS) cluster. You need to ensure that pods can access Azure resources (e.g., Azure Storage) using a managed identity without storing credentials. What should you configure?

Accepted Answer

Use Azure AD Workload Identity for Kubernetes (or aad-pod-identity) to assign managed identities to pods.. Option C is correct because AKS can use pod-managed identities (via aad-pod-identity or Workload Identity) to assign managed identities to pods. Option A is wrong because AKS does not have a built-in managed identity for pods; it's for the cluster. Option B is wrong because service principals require secret management. Option D is wrong because Azure AD integration is for user authentication, not pod identity.

Answer

Configure Azure AD integration on the AKS cluster for user authentication.

Answer

Create a service principal and distribute its secret to pods as a Kubernetes secret.

Answer

Enable managed identity on the AKS cluster and use cluster-level identity.

Question 2

A company stores secrets in Azure Key Vault. Developers need to retrieve secrets from a web app without storing connection strings in code. Which authentication method should the web app use?

Accepted Answer

Enable a managed identity for the web app. Managed identities provide an automatically managed identity in Microsoft Entra ID for the app to authenticate to any service supporting Entra ID authentication, including Key Vault, without storing credentials. Option A is wrong because SAS tokens are for storage accounts, not Key Vault. Option B is wrong because service principals require managing secrets or certificates. Option D is wrong because certificate thumbprints are used with service principals, not directly.

Answer

Register a service principal and use a client secret

Answer

Use a shared access signature (SAS) token

Answer

Use a certificate thumbprint in the app settings

Question 3

Your application uses Azure App Service and needs to authenticate users via Microsoft Entra ID. Which THREE components must be configured in the App Service authentication settings?

Accepted Answer

Client ID. Option A is correct because the client ID identifies the application to Entra ID. Option B is correct because the issuer URL tells App Service where to validate tokens. Option D is correct because allowed token audiences ensure the token is intended for this app. Option C is wrong because client secret is optional for some flows. Option E is wrong because tenant ID is part of the issuer URL.

Answer

Client secret

Answer

Tenant ID

Question 4

You need to ensure that an Azure Functions app can access a blob in Azure Storage using its system-assigned managed identity. What should you do first?

Accepted Answer

Assign the Storage Blob Data Reader role to the managed identity at the storage account scope. You must grant the managed identity the appropriate RBAC role on the storage account, such as Storage Blob Data Reader.

Answer

Configure CORS on the storage account

Answer

Enable the managed identity in the Function App

Answer

Generate a SAS token for the blob

Question 5

Refer to the exhibit. You are creating a custom Azure RBAC role. You assign this role to a user for the Production resource group. The user needs to read the contents of a blob in a container. Which permission is necessary for the user to list the container's blobs?

Accepted Answer

Microsoft.Storage/storageAccounts/blobServices/containers/blobs/list. The role includes 'Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read' data action for blob read, but does not include 'Microsoft.Storage/storageAccounts/blobServices/containers/read' action to list containers. However, the question asks to list blobs within a container, which requires 'Microsoft.Storage/storageAccounts/blobServices/containers/read' to list blobs? Actually, listing blobs is a data operation: 'Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read' allows reading blob content and properties but not listing? Wait, listing blobs requires the data action 'Microsoft.Storage/storageAccounts/blobServices/containers/blobs/list'? The exhibit shows only read, not list. But the options: Option A is the data action for reading blobs, but listing requires 'list' action. However, in Azure RBAC, 'list' is included in 'read' for blobs? Actually, the Microsoft documentation: 'Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read' allows reading blob content, but listing blobs requires 'Microsoft.Storage/storageAccounts/blobServices/containers/blobs/list'? No, listing is a separate operation. But the role only has read. The correct answer is Option D? Let's think: The user needs to read blob contents; the role already has 'blobs/read'. But the question says 'list the container's blobs' - that is a separate permission. The role does not include it. So the user cannot list blobs. But the options: Option A is 'Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read' - that is already present. Option B is 'Microsoft.Storage/storageAccounts/blobServices/containers/read' - that is for listing containers, not blobs. Option C is 'Microsoft.Storage/storageAccounts/blobServices/containers/blobs/list' - that is the correct permission for listing blobs. Option D is 'Microsoft.Storage/storageAccounts/read' - too broad. So Option C is needed to list blobs. But the question says 'Which permission is necessary' implying that the current role lacks it. So the user needs to add the list action. But the role already has the read action for blobs, but listing is not included. So the correct answer is Option C. However, the stem says 'The user needs to read the contents of a blob' and 'list the container's blobs' - but the role already has read, so to list they need list. The exhibit shows the role has 'blobs/read' data action. So the missing permission is 'list'. So Option C. But wait, the role also has 'actions' for 'containers/read' which is an ARM action, not data. That allows listing containers but not blobs. So indeed, to list blobs, you need the data action 'list'. So Option C is correct.

Answer

Microsoft.Storage/storageAccounts/read

Answer

Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read

Answer

Microsoft.Storage/storageAccounts/blobServices/containers/read

Question 6

Your Azure Logic App needs to send emails using Microsoft Graph API on behalf of the signed-in user. The user is authenticated with Microsoft Entra ID. Which authentication method should you use in the Logic App?

Accepted Answer

Use OAuth 2.0 authorization code flow with delegated permissions. Option D is correct because the Logic App connector for Microsoft Graph supports OAuth 2.0 with user delegation. Option A is wrong because managed identity cannot act on behalf of a signed-in user. Option B is wrong because Basic Auth is not supported. Option C is wrong because client credentials flow is for app-only access.

Answer

Use a system-assigned managed identity

Answer

Use client credentials flow with an app registration

Answer

Use Basic authentication with user credentials

Question 7

Your API is secured using Azure AD (now Microsoft Entra ID) tokens. You need to validate the token in your custom code. Which library should you use to validate the token's signature, issuer, and audience?

Accepted Answer

Microsoft.IdentityModel.Tokens and System.IdentityModel.Tokens.Jwt. Microsoft.IdentityModel.Tokens and System.IdentityModel.Tokens.Jwt are the standard .NET libraries for JWT token validation. Option A is correct. Option B is wrong because MSAL is for acquiring tokens, not validation. Option C is wrong because Graph API is for accessing Microsoft Graph. Option D is wrong because ASP.NET Core Identity is for user management.

Answer

ASP.NET Core Identity

Answer

Microsoft Graph SDK

Answer

Microsoft Authentication Library (MSAL)

Question 8

Refer to the exhibit. You run the Azure CLI command to store a secret in Key Vault. Later, you run 'az keyvault secret show --vault-name myvault --name MySecret'. What will be displayed?

Accepted Answer

The secret's metadata and the value 'P@ssw0rd123'.. The 'az keyvault secret show' command displays the secret metadata and the value (if the user has permission). The value will be displayed as the original plaintext. Option A is correct. Option B is wrong because the value is not masked by default. Option C is wrong because the command shows the value. Option D is wrong because the command shows the secret value.

Answer

The secret's metadata only, without the value.

Answer

The secret's metadata with the value masked as '*****'.

Answer

An error because you cannot retrieve a secret after it is set.

Question 9

Your organization uses Azure Key Vault to store secrets. Developers need to retrieve secrets during application runtime. You want to minimize latency and avoid network overhead. Which approach should you recommend?

Accepted Answer

Implement caching of secrets in the application with a short time-to-live (TTL) and use Key Vault as the source of truth.. Option B is correct because Key Vault secret caching in the application (e.g., using IMemoryCache with expiration) reduces calls to Key Vault. Option A is wrong because storing secrets in app settings is insecure. Option C is wrong because Key Vault firewall does not reduce latency. Option D is wrong because soft-delete is for recovery, not performance.

Answer

Enable the Key Vault firewall and allow only trusted Azure services.

Answer

Store the secrets directly in application configuration files.

Answer

Enable Key Vault soft-delete to ensure secrets are recoverable.

Question 10

You are developing a microservices application. Each microservice must authenticate to Azure SQL Database using its own identity. You need to minimize credential management overhead. What should you use?

Accepted Answer

System-assigned managed identities. System-assigned managed identities are tied to the lifecycle of the Azure resource and are automatically created and deleted. They are ideal for each microservice to have its own identity without managing credentials. Option A is wrong because user-assigned managed identities are shared across resources, not per-service. Option C is wrong because service principals require managing secrets. Option D is wrong because certificate-based authentication still requires certificate management.

Answer

User-assigned managed identities

Answer

Certificate-based authentication

Answer

Service principals with client secrets

Question 11

You are designing a solution to store application secrets. You need to ensure that secrets are encrypted at rest and access is audited. Which TWO Azure services should you use?

Accepted Answer

Azure Monitor. Option B is correct because Azure Key Vault provides encryption and access control. Option D is correct because Azure Monitor provides auditing via diagnostics logs. Option A is wrong because App Configuration does not provide encryption by default. Option C is wrong because Azure SQL Database is not designed for secret storage. Option E is wrong because Storage Accounts can store secrets but lack native auditing and access control.

Answer

Azure SQL Database

Answer

Azure Storage Account with encryption

Answer

Azure App Configuration

Question 12

You are designing a solution where an Azure Logic App needs to send emails via Microsoft Graph. The Logic App should authenticate without user interaction. What authentication method should you use?

Accepted Answer

Use a user-assigned managed identity and grant it the Mail.Send application permission. Managed identity allows the Logic App to authenticate to Microsoft Graph without credentials, using the system-assigned identity.

Answer

Use OAuth 2.0 authorization code grant with a user account

Answer

Use a service principal and store its client secret in the Logic App configuration

Answer

Use basic authentication with an email account password

Question 13

Refer to the exhibit. You are using Azure CLI to list blobs in a container. The command fails with an authorization error. The storage account has firewall rules enabled, and you are running the CLI from a machine that is not on the allowed network list. What is the most likely cause of the failure?

Accepted Answer

The storage account firewall is blocking the request because your IP is not in the allow list. Firewall rules deny access from non-allowed IPs. Option A is correct. Option B is for data plane operations that require RBAC? However, the CLI can use storage account key or SAS; the error is likely due to firewall. Option C is about TLS, which would give a different error. Option D is about container level, but the command syntax is correct.

Answer

You do not have the 'Storage Blob Data Reader' role assigned

Answer

The container name is misspelled

Answer

The storage account requires TLS 1.2 and your CLI uses an older version

Question 14

Which TWO actions should you take to secure an Azure Kubernetes Service (AKS) cluster that runs a critical workload? (Choose two.)

Accepted Answer

Enable Azure AD integration with Kubernetes RBAC. Options A and D are correct. Enabling Azure AD integration and using RBAC for Kubernetes resources provide authentication and authorization. Option B is wrong because SSH access should be disabled or limited. Option C is wrong because Kubernetes secrets are base64 encoded and not encrypted by default; use Azure Key Vault Provider. Option E is wrong because Azure Firewall is not required for AKS internal traffic.

Answer

Store secrets as Kubernetes secrets without encryption

Answer

Enable SSH access to all nodes for troubleshooting

Answer

Deploy Azure Firewall in the cluster VNet

Question 15

You have a multi-tenant application that uses Azure AD (Microsoft Entra ID) for authentication. You want to allow only specific tenants to access your app. What is the recommended approach?

Accepted Answer

In the application code, validate the 'tid' claim against a list of allowed tenant IDs.. The recommended approach is to validate the 'tid' (tenant ID) claim in the token after validation, and compare it against a list of allowed tenants. Option B is correct. Option A is wrong because user assignment requires each tenant to assign users, which is not flexible. Option C is wrong because tenant restrictions are set at the tenant level, not the app. Option D is wrong because the 'iss' claim includes the tenant ID, but it's better to use 'tid' as it's explicit.

Answer

Configure the app manifest to require user assignment and assign users from allowed tenants.

Answer

Validate the 'iss' claim to ensure it matches one of your allowed tenant issuer URLs.

Answer

Use Azure AD tenant restrictions to block all tenants except the allowed ones.