AZ-204 Practice Test 20 — 15 Questions

Question 1

Refer to the exhibit. You deploy this ARM template to an App Service named 'myapp'. After deployment, users report they are able to access the app without being prompted to log in. What is the most likely reason?

Accepted Answer

The Azure Active Directory registration is missing the client secret.. The authentication settings are correct, but the App Service might not have the 'authsettingsV2' resource deployed at the correct scope. The resource type should be 'Microsoft.Web/sites/config' with name 'authsettingsV2' but the exhibit shows it correctly. However, a common issue is that the authentication is not enabled at the site level because the resource might be missing a dependency or the site is not restarted. But the most likely reason is that the 'globalValidation' section requires the identity provider to be properly configured with a client secret. Without a client secret, the authentication might not work. In Easy Auth, if you don't specify a client secret, it uses secret-less auth which might not work for all scenarios. Option A is correct. Option B is wrong because the issuer is valid. Option C is wrong because the redirect URI is not needed in the template. Option D is wrong because the client ID is correct.

Answer

The redirect URI is not configured in the Azure AD app registration.

Answer

The issuer URL is incorrect; it should include the tenant ID.

Answer

The client ID is from a different tenant.

Question 2

You are designing a solution that uses Azure Event Hubs to ingest telemetry data. The data must be encrypted at rest and in transit. Additionally, you need to ensure that only authorized applications can publish messages to the event hub. Which combination of features should you use?

Accepted Answer

Use SAS tokens or managed identities for authentication, and rely on default encryption at rest and in transit.. Option D is correct because Event Hubs enables encryption at rest by default (Azure Storage Service Encryption) and in transit via TLS, and uses shared access signatures (SAS) or managed identities for authorization. Option A is wrong because firewall restricts network access, not authorization. Option B is wrong because private endpoints are for network isolation. Option C is wrong because managed identity provides authorization, but encryption at rest is default.

Answer

Use managed identities for applications and enable encryption at rest using customer-managed keys.

Answer

Use Azure Private Link to connect applications to Event Hubs.

Answer

Enable Azure Firewall on the Event Hubs namespace and use IP filtering.

Question 3

Your application uses Azure Key Vault to store cryptographic keys. You need to ensure that keys are automatically rotated every 90 days without any manual intervention. Which Key Vault feature should you configure?

Accepted Answer

Set a key rotation policy. Key Vault key rotation policy allows automatic rotation of keys based on a time interval or expiration. Option A is wrong because Key Vault firewall controls network access, not rotation. Option B is wrong because soft-delete is for recovery, not rotation. Option D is wrong because managed HSM supports rotation but requires more configuration and is not the standard feature for automatic rotation; the built-in rotation policy is the correct answer.

Answer

Configure a Key Vault firewall

Answer

Enable soft-delete on the key vault

Answer

Use a managed HSM instead of a standard vault

Question 4

Refer to the exhibit. You are configuring a Key Vault key using an ARM template. What does this configuration achieve?

Accepted Answer

The key will be rotated 90 days after creation. The rotation policy specifies that the key should be rotated 90 days after creation. Option A is wrong because the key has both encrypt and decrypt operations. Option B is wrong because the key size is 2048 bits, not 4096. Option C is wrong because the policy triggers rotation based on time after creation, not expiration. Option D is correct.

Answer

The key can only be used for encryption

Answer

The key size is 4096 bits

Answer

The key will be rotated 90 days before expiration

Question 5

You are developing a .NET Core API that uses Azure AD for authentication. You want to restrict access to specific claims. Which middleware component should you use to check claims?

Accepted Answer

Use the [Authorize] attribute with a policy that requires a specific claim. The [Authorize] attribute with policy-based authorization allows checking claims via policies configured in Startup.

Answer

Use the UseAuthorization middleware in the pipeline

Answer

Use the UseAuthentication middleware to validate tokens

Answer

Manually parse the JWT in a custom middleware

Question 6

You are developing a web app that authenticates users via Microsoft Entra ID. The app needs to call a downstream API on behalf of the signed-in user. Which OAuth 2.0 flow should you implement?

Accepted Answer

Authorization code flow with PKCE. Option C is correct because the authorization code flow with PKCE is the recommended flow for single-page apps and native apps that need to call APIs on behalf of the user. Option A is wrong because the implicit flow is deprecated and less secure. Option B is wrong because client credentials is for non-user scenarios. Option D is wrong because device code flow is for devices without browsers.

Answer

Client credentials flow

Answer

Implicit flow

Answer

Device code flow

Question 7

Which THREE components are required to implement Azure AD B2C custom policies for sign-up and sign-in? (Choose three.)

Accepted Answer

A user journey definition. Options A, B, and D are correct. A trust framework policy (the XML base), a user journey (steps), and a relying party application (the app) are required. Option C is wrong because Azure AD is the identity provider for employees, not customers. Option E is wrong because B2C uses a tenant, not a subscription.

Answer

An Azure AD (Microsoft Entra ID) tenant for employee identities

Answer

An Azure subscription

Question 8

Your application uses Azure Key Vault to store secrets. You need to ensure that the application can access secrets without storing any credentials in the application code or configuration files. What should you use?

Accepted Answer

Azure Managed Identity. Azure Managed Identity allows Azure resources (like App Service, Functions, VMs) to authenticate to Key Vault without storing credentials. Option B is correct. Option A is wrong because Key Vault access policies control permissions, not authentication. Option C is wrong because connection strings contain credentials. Option D is wrong because certificates are an authentication method but require certificate management.

Answer

Key Vault access policies

Answer

A connection string with the secret

Answer

A client certificate stored in the application

Question 9

A company stores sensitive data in Azure Blob Storage. They require that all access to the storage account be authenticated via Microsoft Entra ID and that users must have the 'Storage Blob Data Reader' role assigned. A developer reports being unable to read blobs using the Azure portal despite having the role assigned. What is the most likely cause?

Accepted Answer

The user does not have the Azure RBAC Reader role on the storage account's resource group to view the storage account in the portal.. Option D is correct because the Azure portal uses both the control plane (RBAC) and data plane permissions; even with Storage Blob Data Reader, if the user lacks a Reader role at the subscription or resource group level, they cannot navigate to the storage account. Option A is wrong because managed identity is not involved. Option B is wrong because firewall settings would affect all users. Option C is wrong because the role assignment is correct.

Answer

The storage account firewall is blocking the user's IP address.

Answer

The storage account is using a system-assigned managed identity for authentication.

Answer

The role is assigned at the storage account scope but the user is trying to access a different storage account.

Question 10

A company uses Azure Logic Apps to orchestrate workflows that process sensitive data. They need to ensure that workflow runs are logged and auditable, and that the logs are tamper-proof. Which Azure service should they use?

Accepted Answer

Microsoft Purview Audit (Premium).. Option D is correct because Microsoft Purview provides audit logging and data governance, including tamper-proof capabilities. Option A is wrong because Azure Monitor collects logs but does not guarantee tamper-proof. Option B is wrong because Microsoft Sentinel is for SIEM, not tamper-proof logging. Option C is wrong because Azure Storage with immutable blobs can provide tamper-proof storage, but the question asks for a service that combines logging and tamper-proof.

Answer

Azure Monitor Log Analytics workspaces.

Answer

Microsoft Sentinel.

Answer

Azure Blob Storage with immutable storage policy.

Question 11

You are building an API that needs to validate JWT tokens issued by Microsoft Entra ID. The API is registered as an application in Entra ID. Which endpoint should the API use to obtain the signing keys?

Accepted Answer

https://login.microsoftonline.com/{tenant}/discovery/v2.0/keys. The OpenID Connect discovery endpoint (well-known/openid-configuration) provides metadata, including the jwks_uri, which points to the keys endpoint. Option A is wrong because the authorize endpoint is for user authentication. Option B is wrong because the token endpoint issues tokens. Option D is wrong because the metadata endpoint for Microsoft Entra ID is correct but the question asks for the endpoint to get signing keys; the jwks_uri is obtained from the discovery endpoint.

Answer

https://login.microsoftonline.com/{tenant}/oauth2/v2.0/token

Answer

https://login.microsoftonline.com/{tenant}/oauth2/v2.0/authorize

Answer

https://login.microsoftonline.com/{tenant}/v2.0/.well-known/openid-configuration

Question 12

Refer to the exhibit. You create a custom RBAC role with the shown permissions. You assign this role to a user at the resource group scope. What can the user do?

Accepted Answer

Read secrets from Key Vaults in the resource group. The role includes read access to Key Vaults and secrets in the vaults. Option A is wrong because the role does not include write permissions. Option B is wrong because the role does not include delete permissions. Option D is wrong because the role is limited to the resource group scope.

Answer

Assign the same role to other users

Answer

Delete secrets from Key Vaults in the resource group

Answer

Create new Key Vaults in the resource group

Question 13

You need to ensure that secrets stored in Azure Key Vault are automatically rotated every 90 days. Which feature should you configure?

Accepted Answer

Use Key Vault secret rotation with Event Grid and Azure Functions. Key Vault does not support automatic rotation natively; you need to use a manual or custom solution. However, the question asks for 'automatically', and the closest built-in feature is the 'Create a key rotation policy' for keys, but for secrets, there is no automatic rotation. The answer is that there is no built-in automatic rotation for secrets; you must use a custom solution or Azure Event Grid with a function. But since the options must be plausible, the correct answer here is that you need to implement a custom solution using Azure Functions and Event Grid.

Answer

Set an access policy for the secret

Answer

Enable soft delete and purge protection

Answer

Set a secret expiration date

Question 14

Your Azure App Service app must access Azure Key Vault secrets without storing credentials in code. Which service should you use to manage identities?

Accepted Answer

Managed identity. Option B is correct because managed identities provide an automatically managed identity for Azure resources to access Key Vault securely. Option A is wrong because service principals require manual credential management. Option C is wrong because certificates still require storage. Option D is wrong because shared access keys are for storage, not Key Vault.

Answer

Service principal with client secret

Answer

Storage account access key

Answer

Client certificate

Question 15

Which TWO services can be used to manage secrets and certificates for applications running on Azure? (Choose two.)

Accepted Answer

Azure Key Vault. Options A and D are correct. Azure Key Vault is the primary service for secrets and certificates. Azure App Configuration can also store secrets as Key Vault references or encrypted values. Option B is wrong because Certificate Services is for issuing certificates, not management. Option C is wrong because Azure Automation stores credentials in runbooks, not a general-purpose secret store. Option E is wrong because Azure Policy is for compliance.

Answer

Azure Automation

Answer

Azure Active Directory Certificate Services

Answer

Azure Policy

AZ-204 Practice Test 20 — 15 Questions

Exhibit

AZ-204 Practice Test 20 — 15 Questions

Exhibit