AZ-204 Practice Test 22 — 15 Questions

Question 1

You are deploying a sensitive application on Azure Kubernetes Service (AKS). You need to ensure that secrets, such as database connection strings, are encrypted at rest and in transit, and that the cluster has no static credentials. Which feature should you enable?

Accepted Answer

Use Azure Key Vault Provider for Secrets Store CSI Driver. Option B is correct because Azure Key Vault Provider for Secrets Store CSI Driver integrates with AKS to mount secrets as volumes without storing them in the cluster. Option A is wrong because etcd encryption is internal to Kubernetes and does not integrate with Key Vault. Option C is wrong because AKS does not offer disk encryption by default. Option D is wrong because managed identity alone does not store secrets.

Answer

Enable etcd encryption at rest

Answer

Enable Azure Disk Encryption on the node pools

Answer

Assign a managed identity to the AKS cluster

Question 2

Refer to the exhibit. An administrator runs this Azure CLI command. What is the result?

Accepted Answer

Assigns the Reader role to a service principal at the resource group scope. Option C is correct. The command assigns the Reader role to the specified service principal (by object ID) at the resource group scope 'ProdRG'. Option A is wrong because the scope is the resource group, not the subscription. Option B is wrong because the role is Reader, not Contributor. Option D is wrong because it does not assign a managed identity.

Answer

Assigns the Contributor role to a service principal at the resource group scope

Answer

Assigns a managed identity to the resource group

Answer

Assigns the Reader role to a user at the subscription scope

Question 3

Your application uses Azure App Service and needs to authenticate users via Microsoft Entra ID. You want to minimize code changes. Which feature should you use?

Accepted Answer

App Service Authentication (Easy Auth). App Service Authentication (Easy Auth) provides built-in authentication with Microsoft Entra ID without requiring code changes. Option A is correct. Option B is wrong because Microsoft.Identity.Web requires code changes. Option C is wrong because MSAL requires code. Option D is wrong because Azure AD B2C is for external identities.

Answer

Azure AD B2C

Answer

Microsoft.Identity.Web library

Answer

MSAL.js

Question 4

Which TWO methods can you use to authenticate an Azure App Service web app to Azure SQL Database without storing credentials in code? (Choose two.)

Accepted Answer

Store the SQL connection string in Azure Key Vault and use a Key Vault reference in the app settings.. Options B and D are correct. Managed identity allows the app to authenticate without credentials. Azure Key Vault can store credentials and the app retrieves them at runtime. Option A is wrong because connection strings with passwords expose credentials. Option C is wrong because service principal with client secret requires storing the secret. Option E is wrong because certificate authentication requires certificate management.

Answer

Use a connection string with a SQL username and password.

Answer

Use a service principal with a client secret stored in app settings.

Answer

Use a client certificate installed on the App Service.

Question 5

You need to secure a web API that is called from a single-page application (SPA). The API uses Microsoft Entra ID for authentication. Which OAuth 2.0 flow should the SPA use?

Accepted Answer

Authorization code flow with PKCE. The authorization code flow with PKCE is recommended for SPAs because it provides better security than implicit flow. Option A is wrong because client credentials flow is for server-to-server communication. Option B is wrong because implicit flow is deprecated. Option D is wrong because resource owner password credentials flow is not recommended for SPAs.

Answer

Resource owner password credentials flow

Answer

Client credentials flow

Answer

Implicit flow

Question 6

You are configuring a managed identity for an Azure App Service to access Azure Key Vault. The identity has been assigned, but the app receives a 403 Forbidden when trying to retrieve a secret. What is the most likely cause?

Accepted Answer

The managed identity lacks an access policy or RBAC role in Key Vault. The managed identity must be granted explicit access via an access policy or RBAC role in Key Vault. Simply assigning the identity does not grant access.

Answer

The app is using the wrong endpoint

Answer

The managed identity is not enabled in the App Service

Answer

The Key Vault firewall is blocking the request

Question 7

A company has an Azure Kubernetes Service (AKS) cluster. They want to ensure that pods can securely access Azure SQL Database without using connection strings or secrets. The solution must use the principle of least privilege. What should they implement?

Accepted Answer

Enable Azure AD Workload Identity for AKS and assign a managed identity to the pod that has access to Azure SQL Database.. Option D is correct because AKS pod-managed identity (or Azure AD Workload Identity) allows pods to assume a managed identity, which can be granted access to Azure SQL Database via Microsoft Entra authentication. Option A is wrong because Kubernetes secrets are not encrypted at rest by default and require manual management. Option B is wrong because Azure Key Vault with CSI driver still requires a secret to access Key Vault unless combined with managed identity, but the question asks to avoid connection strings/secrets entirely. Option C is wrong because cluster IP addresses are not a secure method for database authentication.

Answer

Use the Azure Key Vault Provider for Secrets Store CSI Driver to mount secrets into the pod.

Answer

Store the SQL connection string in a Kubernetes secret and mount it as a volume in the pod.

Answer

Configure Azure SQL Database firewall to allow the AKS cluster's IP addresses.

Question 8

Your company uses Azure API Management to expose APIs to external partners. You need to validate that each incoming request includes a valid JSON Web Token (JWT) issued by your Microsoft Entra ID tenant, and reject requests without valid tokens. What should you configure?

Accepted Answer

Add a validate-jwt policy in the inbound processing policy. Option D is correct because a validate-jwt policy in the inbound processing pipeline checks the token before the request reaches the backend. Option A is wrong because OAuth 2.0 authorization server doesn't validate tokens per request. Option B is wrong because subscription keys are not tokens. Option C is wrong because IP filtering does not validate tokens.

Answer

Configure an OAuth 2.0 authorization server in API Management

Answer

Require a subscription key for each API

Answer

Use an IP access restriction policy

Question 9

Refer to the exhibit. You created a custom RBAC role definition. A user assigned this role at the subscription scope. What can the user do?

Accepted Answer

Read Azure SQL Database configurations and data. Option A is correct. The role includes the 'read' action for Azure SQL Databases, allowing read-only access to databases. Option B is wrong because the role does not include write actions. Option C is wrong because the role does not include server-level actions. Option D is wrong because the role only applies to SQL Database, not all resources.

Answer

Read any resource in the subscription

Answer

Write to Azure SQL Databases

Answer

Create new Azure SQL Databases

Question 10

Which TWO of the following are valid ways to authenticate an Azure function to an Azure SQL database using managed identity?

Accepted Answer

Create a user-assigned managed identity, assign it to the function app, and use its client ID in the connection string.. System-assigned managed identity and user-assigned managed identity are both supported. Option A and D are correct. Option B is wrong because service principal is not managed identity. Option C is wrong because connection string with username/password is not managed identity. Option E is wrong because certificate authentication is not managed identity.

Answer

Create a service principal and assign it to the function app.

Answer

Use the function app's default connection string with a username and password.

Answer

Upload a client certificate to the function app and use it to authenticate.

Question 11

Refer to the exhibit. You have a custom RBAC role definition. A user assigned this role reports they can read, write, and delete blobs, but cannot list the containers in the storage account. What is the most likely reason?

Accepted Answer

The user does not have the Reader role on the storage account to navigate in the Azure portal.. Option C is correct because the role includes container read permission (Microsoft.Storage/storageAccounts/blobServices/containers/read) which allows listing containers. However, the user may not have the Reader role at the storage account level to see the storage account in the portal. Option A is wrong because dataActions for blobs are included. Option B is wrong because the role includes delete for containers and blobs. Option D is wrong because the actions include container read.

Answer

The role does not grant delete permissions on containers.

Answer

The role lacks dataActions for reading blobs.

Answer

The role does not include the action to list containers.

Question 12

Your company uses Microsoft Defender for Cloud. You need to receive alerts when a user modifies a Key Vault access policy. What should you configure?

Accepted Answer

Set up an activity log alert on the Key Vault. Azure Policy can audit or enforce specific configurations, but for real-time alerts, you should use Azure Monitor alerts on activity log events. Option A is wrong because Azure Policy can be used to audit but not to alert in real-time. Option B is wrong because Key Vault logging is for audit, not real-time alerts. Option C is wrong because Microsoft Sentinel is a SIEM that can ingest logs but is not the simplest solution for alerting on activity log events.

Answer

Create an Azure Policy to audit access policy changes

Answer

Configure Microsoft Sentinel to monitor Key Vault

Answer

Enable Key Vault logging and query logs

Question 13

You need to secure access to an Azure Storage account that hosts sensitive data. The requirement is to restrict access to only requests originating from a specific virtual network. Which feature should you configure?

Accepted Answer

Storage firewall and virtual network rules. Storage firewalls and virtual networks allow you to restrict access to specific VNets and IPs.

Answer

Customer-managed keys (CMK)

Answer

Azure AD authentication

Answer

Shared access signatures (SAS)

Question 14

You are developing an ASP.NET Core web app that will be deployed to Azure App Service. The app needs to authenticate users from a Microsoft Entra ID tenant. You want to minimize development effort and rely on platform features. What should you do?

Accepted Answer

Enable App Service Authentication in the Azure portal and configure Microsoft Entra ID as the identity provider.. Option A is correct because App Service Authentication (EasyAuth) provides built-in authentication with Microsoft Entra ID without requiring code changes. Option B is wrong because it requires code changes. Option C is wrong because it's unnecessary if EasyAuth is used. Option D is wrong because it's for authorization, not authentication.

Answer

Implement custom OAuth 2.0 middleware in the app.

Answer

Add Microsoft.Identity.Web NuGet package and configure it in Startup.cs to use Microsoft Entra ID.

Answer

Use Microsoft Entra ID App Roles and add role checks in the code.

Question 15

Your organization has a custom application that stores customer data in Azure Cosmos DB. You need to encrypt the data at rest using a customer-managed key stored in Azure Key Vault. Which type of Cosmos DB encryption should you configure?

Accepted Answer

Use customer-managed keys (CMK) with Azure Key Vault. Option A is correct because Cosmos DB supports encryption at rest with customer-managed keys (CMK) via Azure Key Vault. Option B is wrong because TDE is for SQL Server, not Cosmos DB. Option C is wrong because client-side encryption is separate. Option D is wrong because Azure Disk Encryption is for VMs.

Answer

Enable Azure Disk Encryption on the Cosmos DB instance

Answer

Enable Transparent Data Encryption (TDE)

Answer

Implement client-side encryption using the SDK