AZ-204 Practice Exam 53 — 20 Questions

Question 1

The team is writing an Azure Function that needs to retrieve secrets from Azure Key Vault at runtime. The security policy prohibits storing client secrets, connection strings, or certificates in application settings or source code. What is the recommended approach?

Accepted Answer

Enable a system-assigned managed identity on the Function App and grant it Key Vault Secrets User (or Get/List access policy) permission on the vault. Option A is correct because a system-assigned managed identity provides a secure, credential-free way for an Azure Function to authenticate to Key Vault. Azure automatically manages the identity's lifecycle and tokens, eliminating the need to store any secrets in application settings or code. The Function App uses the managed identity to obtain an Azure AD token, which it presents to Key Vault to retrieve secrets, fully complying with the security policy.

Answer

Create an App Registration, generate a client secret, store the secret in an Application Setting, and authenticate using ClientSecretCredential

Answer

Generate a Key Vault SAS token and embed it in the function's connection string setting

Answer

Use the Key Vault REST API with the vault's access key embedded in the code

Question 2

Multiple teams need different levels of access to the same Azure Key Vault: the DevOps team needs to create and rotate secrets, the application team needs read-only secret access, and the auditing team needs list-only access. The security team wants audit logs of all access decisions and the ability to manage permissions through a single system. What access model should the developer recommend?

Accepted Answer

Use Azure RBAC for Key Vault with role assignments scoped per team: Key Vault Secrets Officer for DevOps, Key Vault Secrets User for the app team, and Key Vault Reader for auditing. Option A is correct because Azure RBAC for Key Vault provides a unified, centralized access management system that meets all requirements. The Key Vault Secrets Officer role allows DevOps to create and rotate secrets, the Key Vault Secrets User role grants read-only access to the application team, and the Key Vault Reader role provides list-only access for auditing. Additionally, RBAC integrates with Azure Monitor to deliver audit logs of all access decisions, satisfying the security team's need for a single management plane.

Answer

Create separate access policies for each team with the minimum required permissions

Answer

Create a separate Key Vault per team to enforce isolation between access levels

Answer

Issue shared access signatures for each team scoped to the operations they need

Question 3

External partners are given Shared Access Signatures to upload product images to a specific Blob Storage container named 'images'. A partner reports accidentally uploading files to the 'contracts' container, which should not be accessible. What is the most likely configuration mistake?

Accepted Answer

The SAS was generated at the storage account level, granting write access that applies to multiple containers rather than being scoped to the 'images' container only. A SAS generated at the storage account level grants permissions across all containers within that account. When the SAS URI includes only the account endpoint (e.g., https://.blob.core.windows.net/) and a set of permissions (like write), the token can be used to access any container, including 'contracts'. To restrict access to a single container, the SAS must be scoped to the container resource URI (e.g., https://.blob.core.windows.net/images) and the signed resource type must be 'c' (container) or 'b' (blob), not 's' (service).

Answer

The SAS expiry time is too long, giving partners time to discover and access other containers

Answer

The partner used a storage account key instead of the provided SAS token

Answer

The SAS was signed with a stored access policy that did not name the correct container

Question 4

Twenty Azure Functions across different teams all need read access to the same Azure Cosmos DB account. The security team wants to revoke or modify this access for all twenty functions at once without visiting each Function App individually. What managed identity design satisfies this requirement?

Accepted Answer

Create one user-assigned managed identity, attach it to all twenty Function Apps, and grant it the Cosmos DB Built-in Data Reader role. Option A is correct because a single user-assigned managed identity can be created once and then attached to all twenty Function Apps. Granting that identity the Cosmos DB Built-in Data Reader role at the Cosmos DB account scope means that revoking or modifying the role assignment centrally affects all functions simultaneously, without needing to visit each app individually.

Answer

Enable a system-assigned managed identity on each Function App and grant each identity the Cosmos DB Built-in Data Reader role

Answer

Create a service principal, store its client secret in Key Vault, and reference the secret from all twenty Function Apps via Key Vault references

Answer

Store the Cosmos DB connection string in Azure App Configuration and reference it from all twenty Function Apps

Question 5

Match each Azure authentication mechanism to its description.

Question 6

A developer is implementing Key Vault certificate retrieval. The application runs on Azure App Service and must avoid stored credentials. Which design should be used? The design must avoid adding custom operational scripts.

Accepted Answer

Enable managed identity and grant least-privilege access to the target resource. Managed identity (system-assigned or user-assigned) allows the App Service to authenticate to Key Vault without any stored credentials, because Azure automatically rotates the identity's service principal and provides an access token via the Azure Instance Metadata Service (IMDS) endpoint. By granting least-privilege access (e.g., a Key Vault access policy with only 'Get' on secrets), the design meets the requirement to avoid stored credentials and custom operational scripts.

Answer

Use a shared administrator account

Answer

Store a client secret in source control

Answer

Disable authentication for the target resource

Question 7

A background service must call Microsoft Graph without a signed-in user. Which Microsoft identity platform permission model is required? The design must avoid adding custom operational scripts.

Accepted Answer

Application permissions with client credentials flow. Application permissions with the client credentials flow are required because the background service must call Microsoft Graph without a signed-in user. This flow uses OAuth 2.0 client credentials grant (RFC 6749) where the service authenticates as itself using a client secret or certificate, not on behalf of a user. Delegated permissions (Option B) always require a signed-in user context, making them unsuitable for unattended background services.

Answer

Password hash synchronization

Answer

Delegated permissions only

Answer

Device code flow

Question 8

A background service must call Microsoft Graph without a signed-in user. Which Microsoft identity platform permission model is required? The architecture review board prefers a managed AWS-native control.

Accepted Answer

Application permissions with client credentials flow. For a background service calling Microsoft Graph without a signed-in user, the application must authenticate as itself, not on behalf of a user. Application permissions, combined with the client credentials flow (OAuth 2.0), allow the service to obtain an access token using its own identity (client ID and client secret or certificate), without any user interaction. This is the only model that supports non-interactive, daemon-style access to Microsoft Graph.

Answer

Password hash synchronization

Answer

Delegated permissions only

Answer

Device code flow

Question 9

You are developing an Azure Function that reads secrets from Azure Key Vault. The function must not use any static credentials in configuration files. You need to authenticate to Key Vault using the function's own identity. Which Azure service feature should you enable?

Accepted Answer

Assign a managed identity to the function app and grant it access to the Key Vault. Option B is correct because Azure Functions can use a system-assigned or user-assigned managed identity to authenticate to Azure Key Vault without storing any static credentials. When enabled, the function app obtains an Azure AD token from the Managed Identity endpoint (169.254.169.254) and uses it to access Key Vault secrets, eliminating the need for connection strings, keys, or certificates in configuration files.

Answer

Use storage account access keys to authenticate to Key Vault

Answer

Generate a shared access signature (SAS) token for the Key Vault

Answer

Create a service principal and store its certificate in the function app's local storage

Question 10

You have an Azure App Service that uses a system-assigned managed identity. You need to grant it permission to read a secret from Azure Key Vault. Which RBAC role should you assign at the Key Vault scope?

Accepted Answer

Key Vault Secrets User. The system-assigned managed identity needs to read a secret from Azure Key Vault. The 'Key Vault Secrets User' RBAC role grants exactly that permission — the ability to read secret contents. This is the least-privilege role that allows the 'Microsoft.KeyVault/vaults/secrets/read' action, which is required for reading secret values.

Answer

Key Vault Reader

Answer

Key Vault Contributor

Answer

Key Vault Certificate User

Question 11

Your company stores sensitive documents in an Azure Storage account. You need to ensure that only authorized Microsoft Entra ID users can read the documents, and that shared keys (account access keys) cannot be used. Which two steps must you take? (Choose the most appropriate single answer that describes the combined action.)

Accepted Answer

Disable shared key access and configure RBAC roles for Microsoft Entra ID users. Option A is correct because disabling shared key access on the Azure Storage account prevents the use of account access keys, which are shared secrets. Configuring Azure RBAC roles (e.g., Storage Blob Data Reader) for Microsoft Entra ID users ensures that only authenticated and authorized users can read the documents, enforcing identity-based access control as required.

Answer

Enable Microsoft Entra ID authentication and use SAS tokens with a stored access policy

Answer

Enable firewall and virtual network service endpoints, then assign RBAC roles

Question 12

Your company uses Azure Key Vault to store secrets. You need to ensure that if a secret is deleted, it can be recovered within 30 days. Which Key Vault feature should you enable?

Accepted Answer

Soft-delete. Soft-delete is the correct feature because it allows you to recover a deleted secret within a configurable retention period (default 90 days, but can be set to as low as 1 day). When soft-delete is enabled, a deleted secret is marked as deleted but remains recoverable until the retention period expires. This directly meets the requirement to recover a secret within 30 days.

Answer

Purge protection

Answer

RBAC (Role-Based Access Control)

Answer

Access policies

Question 13

A single-page app signs in users with Microsoft Entra ID and calls a protected API. The app cannot safely keep a client secret. Which OAuth flow should be used? The team wants the control to be enforceable during normal operations.

Accepted Answer

Authorization code flow with PKCE. The authorization code flow with PKCE (Proof Key for Code Exchange) is the recommended OAuth flow for single-page apps because it prevents the client secret from being exposed by using a dynamically generated code verifier and challenge. This flow ensures that even if the authorization code is intercepted, it cannot be exchanged for tokens without the original code verifier, making it secure for public clients that cannot safely store secrets.

Answer

Implicit flow

Answer

Client credentials flow

Answer

Resource owner password credentials flow

Question 14

A background service must call Microsoft Graph without a signed-in user. Which Microsoft identity platform permission model is required? The team wants the control to be enforceable during normal operations.

Accepted Answer

Application permissions with client credentials flow. Option D is correct because the scenario requires an unattended background service to call Microsoft Graph without a signed-in user. Application permissions, combined with the client credentials flow (OAuth 2.0 grant type), allow the service to authenticate as itself using a client ID and client secret or certificate, obtaining an access token with pre-authorized application-level permissions. This model enforces control during normal operations because the permissions are granted directly to the application and cannot be delegated by a user, ensuring consistent access regardless of user presence.

Answer

Password hash synchronization

Answer

Delegated permissions only

Answer

Device code flow

Question 15

A background data pipeline runs on a schedule and must read user profile data from Microsoft Graph. No user is present during execution. The service authenticates to Microsoft Entra ID and calls the Graph API. Which permission type and OAuth 2.0 flow are correct for this scenario?

Accepted Answer

Application permissions with the client credentials flow, authenticating with the app's client ID and secret (or certificate). This scenario requires a background service to access Microsoft Graph without any user interaction. Application permissions are designed for such non-interactive, service-to-service calls, and the client credentials OAuth 2.0 flow (defined in RFC 6749 section 4.4) allows the app to authenticate using its own identity (client ID and secret or certificate) to obtain an access token. Delegated permissions would be incorrect because they require a signed-in user context, which is absent here.

Answer

Delegated permissions with the authorization code flow, initiating a browser redirect to collect user consent

Answer

Delegated permissions with the device code flow, prompting a user to authenticate on a separate device

Answer

Application permissions with the on-behalf-of flow, passing the calling user's token to the Graph API

Question 16

A company stores secrets (e.g., connection strings) in Azure Key Vault and needs them automatically rotated every 90 days. Which solution should they implement?

Accepted Answer

Use Event Grid to trigger an Azure Function or Automation runbook that rotates the secret. Option C is correct because Azure Key Vault does not natively support automatic secret rotation; you must implement a custom solution using Event Grid to detect expiration events and trigger an Azure Function or Automation runbook that generates a new secret and updates the vault. This pattern leverages Key Vault's eventing capabilities to automate the rotation workflow without manual intervention.

Answer

Configure Key Vault access policies to enforce rotation

Answer

Enable Key Vault firewall to limit access

Answer

Enable soft-delete on the vault

Question 17

A background service must call Microsoft Graph without a signed-in user. Which Microsoft identity platform permission model is required?

Accepted Answer

Application permissions with client credentials flow. Option D is correct because when a background service or daemon calls Microsoft Graph without a signed-in user, it must authenticate as itself using application permissions (app roles) rather than delegated permissions. The client credentials flow (OAuth 2.0 grant type) allows the service to obtain an access token using its own credentials (client ID and client secret or certificate), without any user interaction. This flow is designed for server-to-server scenarios where the application acts on its own behalf.

Answer

Password hash synchronization

Answer

Delegated permissions only

Answer

Device code flow

Question 18

A single-page app signs in users with Microsoft Entra ID and calls a protected API. The app cannot safely keep a client secret. Which OAuth flow should be used?

Accepted Answer

Authorization code flow with PKCE. The authorization code flow with PKCE (Proof Key for Code Exchange) is the recommended OAuth flow for single-page apps that cannot securely store a client secret. PKCE ensures that even if the authorization code is intercepted, it cannot be exchanged for tokens without the original code verifier, mitigating the risk of code injection attacks. This flow aligns with Microsoft's best practices for native and browser-based applications using Microsoft Entra ID.

Answer

Implicit flow

Answer

Client credentials flow

Answer

Resource owner password credentials flow

Question 19

A developer needs to grant an Azure Function read access to secrets in Azure Key Vault without storing any credentials in the function code or configuration. Which approach should they use?

Accepted Answer

Managed identity. Managed identity (B) is the correct approach because it allows the Azure Function to authenticate to Azure Key Vault without storing any credentials in code or configuration. Azure automatically manages the identity, and the function can obtain an access token from Azure AD to read secrets, eliminating the need for secrets, certificates, or keys in the application.

Answer

Service principal with a certificate

Answer

Access policy with a client secret

Answer

Shared access signature (SAS)

Question 20

A developer is implementing least-privilege storage access. The application runs on Azure App Service and must avoid stored credentials. Which design should be used? The design must avoid adding custom operational scripts.

Accepted Answer

Enable managed identity and grant least-privilege access to the target resource. Option D is correct because Azure Managed Identity provides an automatically managed identity in Azure AD that allows the App Service to authenticate to any service supporting Azure AD authentication without storing any credentials. By granting the managed identity only the specific permissions required (least-privilege) on the target storage resource (e.g., Storage Blob Data Reader), the application avoids stored credentials and eliminates the need for custom operational scripts. This aligns with the principle of zero standing credentials and is the recommended approach for Azure App Service.

Answer

Use a shared administrator account

Answer

Disable authentication for the target resource

Answer

Store a client secret in source control