AZ-204 Practice Test 23 — 15 Questions

Question 1

You are designing a solution for a healthcare application that stores patient data in Azure Cosmos DB. The data must be encrypted at rest using a customer-managed key stored in Azure Key Vault. You need to ensure that the key can be rotated without downtime. Which approach should you recommend?

Accepted Answer

Enable automatic key rotation on the Key Vault key and use the key's versionless identifier in Cosmos DB.. Cosmos DB supports customer-managed keys with key auto-rotation when using a Key Vault key version. By enabling automatic rotation and using the key vault key's versionless identifier, Cosmos DB will automatically use the new version when the key is rotated. Option B is correct. Option A is wrong because regenerating the key in Cosmos DB would require re-encryption. Option C is wrong because manual update is not needed. Option D is wrong because Azure Security Center is not involved.

Answer

Configure Azure Security Center to automatically rotate the key.

Answer

After rotating the key in Key Vault, manually update the Cosmos DB account with the new key version.

Answer

Use the Cosmos DB account key rotation feature to regenerate the key.

Question 2

Which TWO of the following are benefits of using Azure Key Vault to store application secrets?

Accepted Answer

Centralized management of secrets with access policies.. Key Vault provides centralized secret management with access control and auditing. Option A and D are correct. Option B is wrong because Key Vault does not improve performance. Option C is wrong because secrets are encrypted at rest. Option E is wrong because Key Vault is not a CI/CD tool.

Answer

Improved application performance by caching secrets.

Answer

Integration with Azure DevOps for automatic secret rotation in pipelines.

Answer

Automatic encryption of secrets at rest and in transit.

Question 3

A company uses Azure API Management (APIM) to expose APIs to external partners. They want to validate JSON Web Tokens (JWTs) from partners' Microsoft Entra ID tenants before requests reach the backend. The solution must support multiple partner tenants and minimize latency. What should you implement?

Accepted Answer

Use APIM inbound policy with validate-jwt and specify openid-config URL for each partner tenant.. Option C is correct because APIM inbound policy with validate-jwt can use openid-config to dynamically fetch signing keys from multiple issuers. Option A is wrong because client certificates are for certificate-based auth, not JWT. Option B is wrong because OAuth2 in APIM is for authorization server integration but does not validate JWT for multiple tenants easily. Option D is wrong because Azure AD B2C is for customer identities, not partner tenants.

Answer

Use Azure AD B2C as a token broker between partners and the API.

Answer

Configure OAuth 2.0 authorization server in APIM for each partner tenant.

Answer

Use client certificate authentication in APIM to map certificates to partner tenants.

Question 4

You are developing a serverless application using Azure Functions that processes sensitive data. The function needs to access Azure Key Vault to retrieve a secret. You want to use managed identity for authentication. What should you do first?

Accepted Answer

Enable the system-assigned managed identity on the function app and grant it the Key Vault Secrets User role.. Option D is correct because the function app must have a managed identity enabled, and then the identity needs to be granted permissions in Key Vault. Option A is wrong because managed identity does not use client secrets. Option B is wrong because the identity is assigned to the function app, not Key Vault. Option C is wrong because enabling the identity in Key Vault is not possible.

Answer

Enable the system-assigned managed identity on the Key Vault.

Answer

Store the client ID and client secret of a service principal in the function app settings.

Answer

Create a user-assigned managed identity and assign it to the Key Vault.

Question 5

A company uses Azure SQL Database and needs to encrypt sensitive columns (e.g., credit card numbers) at rest and in transit, with the ability to allow specific applications to decrypt. They want to manage encryption keys centrally in Azure Key Vault and avoid managing certificates. Which technology should they use?

Accepted Answer

Always Encrypted with column master key in Azure Key Vault.. Option B is correct because Always Encrypted with Azure Key Vault allows client-side encryption and decryption, with keys stored in Key Vault. Option A is wrong because TDE encrypts the entire database at rest but not in transit and not column-level. Option C is wrong because Row-Level Security is for access control, not encryption. Option D is wrong because Dynamic Data Masking obscures data from non-privileged users but does not encrypt.

Answer

Transparent Data Encryption (TDE) with Azure Key Vault.

Answer

Dynamic Data Masking (DDM) with Azure Key Vault.

Answer

Row-Level Security (RLS) with Azure Key Vault.

Question 6

Refer to the exhibit. You deploy an Azure Storage account using the ARM template snippet. A developer reports that they cannot connect to the storage account from their machine with IP 10.0.0.5, even though they have the proper RBAC role. What is the most likely reason?

Accepted Answer

The storage account firewall is configured to deny all traffic except from the 192.168.1.0/24 IP range.. Option A is correct because the network ACLs have a default deny and only allow traffic from 192.168.1.0/24. The IP 10.0.0.5 is not in that range. Option B is wrong because TLS 1.2 is a requirement, but the error is network access. Option C is wrong because RBAC is correctly configured. Option D is wrong because Azure Services bypass is for Azure services, not the developer's machine.

Answer

The storage account is configured to bypass Azure Services, which blocks non-Azure clients.

Answer

The developer does not have the Storage Blob Data Contributor role.

Answer

The minimum TLS version is set to TLS 1.2, but the developer's client uses TLS 1.0.

Question 7

You need to secure access to an Azure Storage account that contains sensitive data. Which TWO of the following are recommended best practices?

Accepted Answer

Use managed identities to access storage from Azure services. Option B is correct because limiting network access reduces attack surface. Option C is correct because using managed identities avoids storing credentials. Option A is wrong because SAS tokens with long expiry increase risk. Option D is wrong because public access should be disabled except for specific containers when needed. Option E is wrong because storage account keys should be rotated regularly, but not necessarily every 24 hours.

Answer

Rotate storage account keys every 24 hours

Answer

Use SAS tokens with long expiry dates

Answer

Enable anonymous public access for all containers

Question 8

You are developing an API that will be hosted on Azure API Management (APIM). The API must be accessible only to clients that present a valid JSON Web Token (JWT) issued by Microsoft Entra ID. Which APIM policy should you use to validate the JWT?

Accepted Answer

<validate-jwt header-name="Authorization" failed-validation-httpcode="401" />. Option B is correct because the validate-jwt policy is designed to check the validity of a JWT token. Option A is wrong because check-header only checks for the existence of a header, not validation. Option C is wrong because authenticate-basic is for basic authentication. Option D is wrong because cors is for cross-origin requests.

Answer

Answer

<authenticate-basic />

Answer

<check-header name="Authorization" failed-check-httpcode="401" />

Question 9

A company deploys an Azure App Service web app that stores sensitive data in Azure Blob Storage. The security team requires that all access to the blob storage must be authenticated and authorized via Microsoft Entra ID, and that no anonymous access is permitted. The web app must also be able to access the storage using its managed identity. Which configuration should the company implement?

Accepted Answer

Enable the web app's system-assigned managed identity, assign the Storage Blob Data Contributor role to the identity, and disable anonymous access on the storage account.. Option B is correct because enabling managed identity and assigning the Storage Blob Data Contributor role ensures the web app can access blobs via Entra ID authentication. Disabling anonymous access is a separate step. Option A is wrong because storage account keys bypass Entra ID. Option C is wrong because SAS tokens do not use managed identity. Option D is wrong because shared access policy is not used for managed identity access.

Answer

Create a custom RBAC role that allows full access to the storage account and assign it to the web app's service principal.

Answer

Use storage account access keys and store them in Key Vault, then configure the web app to retrieve them at runtime.

Answer

Generate a shared access signature (SAS) token with read permissions, store it in App Settings, and configure the web app to use it.

Question 10

A company is building a microservices application on Azure Container Instances. Each microservice needs to authenticate to Azure Key Vault to retrieve secrets. They want to avoid storing any credentials in the container images or environment variables. What should they do?

Accepted Answer

Enable managed identity for the container group and grant it access to Key Vault.. Option B is correct because managed identity for Azure Container Instances allows containers to authenticate to Azure services without credentials. Option A is wrong because passing connection strings as environment variables exposes secrets. Option C is wrong because Docker secrets are not natively supported in Azure Container Instances. Option D is wrong because SAS tokens are not suitable for container-to-Key Vault authentication.

Answer

Use Docker secrets mounted as volumes.

Answer

Use a shared access signature (SAS) token to access Key Vault.

Answer

Store the Key Vault URI and a client secret in environment variables.

Question 11

A healthcare organization uses Azure API Management (APIM) to expose FHIR APIs to external partners. The FHIR backend is an Azure API for FHIR that requires OAuth 2.0 tokens from Microsoft Entra ID. APIM must validate tokens before forwarding requests to the backend. The organization also needs to rate-limit requests per subscription key and log all requests to Azure Monitor for audit. Which combination of APIM policies should be implemented?

Accepted Answer

Use validate-jwt to validate the token, rate-limit to throttle requests per subscription key, and log-to-event-hub to send logs.. Option D is correct because validate-jwt ensures token validation, rate-limit enforces throttling per subscription key, and log-to-event-hub sends logs to Azure Monitor via Event Hubs. Option A is wrong because check-header is not for JWT validation. Option B is wrong because quota limits total calls, not rate. Option C is wrong because set-header is not for validation.

Answer

Use validate-jwt, set-header to add the subscription key, and log-to-event-hub.

Answer

Use check-header to verify the token, rate-limit to throttle requests, and log-to-event-hub to send logs.

Answer

Use validate-jwt to validate the token, quota to limit total requests, and log-to-event-hub.

Question 12

You are deploying a web app to Azure App Service that must use a custom domain with TLS/SSL. You have purchased an SSL certificate from a third-party CA. How should you upload and bind the certificate to the custom domain?

Accepted Answer

Upload the .pfx file to the App Service TLS/SSL settings and bind it to the custom domain.. Option A is correct because App Service requires the certificate to be uploaded as a .pfx file with the private key. Option B is wrong because .cer files do not contain the private key. Option C is wrong because you should not upload to the custom domain folder. Option D is wrong because Key Vault integration is optional but not required.

Answer

Place the certificate files in the wwwroot folder of the app and configure the web.config.

Answer

Import the certificate into Azure Key Vault and reference it from App Service.

Answer

Upload the .cer file to the App Service and let Azure generate the private key.

Question 13

A company is designing a secure microservices architecture on Azure Kubernetes Service (AKS). The security requirements include: encrypting secrets at rest and in transit, rotating secrets automatically, and avoiding hard-coded credentials in application code. Which THREE solutions should the company use? (Choose three.)

Accepted Answer

Use the Azure Key Vault CSI Driver to mount secrets as volumes in pods.. Options A, B, and C are correct. Azure Key Vault stores secrets encrypted at rest and provides automatic rotation. CSI Driver enables pods to mount secrets without hard-coding. Managed identities for Pods allow Entra ID authentication to Key Vault. Option D is wrong because Kubernetes Secrets do not provide automatic rotation. Option E is wrong because environment variables expose secrets in plaintext.

Answer

Inject secrets as environment variables from ConfigMaps.

Answer

Use Kubernetes Secrets with a scheduled CronJob to rotate them.

Question 14

Which TWO actions should you take to securely store and access secrets for a legacy application that cannot be modified? The application runs on an Azure Virtual Machine and needs to read a database connection string. The solution must use Azure Key Vault and adhere to the principle of least privilege.

Accepted Answer

Configure the application to read the connection string from a local file that is updated by the Key Vault extension.. Option A is correct because Key Vault VM extension automatically syncs certificates and secrets as files, but for connection strings, the application still needs to read the file. Option C is correct because the application can be configured to read the connection string from a local file that is synced by the extension. Option B is wrong because managed identity is assigned to the VM, not the app; the extension uses the VM's identity. Option D is wrong because enabling the extension with a system-assigned managed identity is sufficient; a user-assigned identity is not required. Option E is wrong because the extension can be enabled on existing VMs.

Answer

Create a new VM and install the Key Vault extension during provisioning.

Answer

Assign a managed identity to the legacy application.

Answer

Use a user-assigned managed identity and assign it to the VM.

Question 15

A company uses Azure Functions to process sensitive customer data. The functions are triggered by Service Bus messages. The security requirements mandate that all function code must be encrypted in transit and at rest, and that access to the function must be authenticated using Microsoft Entra ID. Which TWO configurations should be implemented? (Choose two.)

Accepted Answer

Configure the function app's authentication to 'Microsoft Entra ID' with 'Require authentication' set to 'On'.. Options A and C are correct. Enforcing HTTPS ensures encryption in transit. Restricting function access to Entra ID meets authentication requirement. Option B is wrong because Service Bus access keys are not Entra ID. Option D is wrong because HTTP-only functions can still be called via HTTP. Option E is wrong because anonymous access allows unauthenticated requests.

Answer

Enable 'App Service Authentication' and set the action to 'Allow anonymous requests'.

Answer

Use Service Bus managed identity with access keys for authentication.

Answer

Set the function app's 'HTTP version' to 'HTTP/2' to improve encryption.