AZ-204 Implement Azure security — 30 Questions

Question 1

Your company stores sensitive documents in an Azure Storage account. You need to ensure that only authorized Microsoft Entra ID users can read the documents, and that shared keys (account access keys) cannot be used. Which two steps must you take? (Choose the most appropriate single answer that describes the combined action.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Disable shared key access and configure RBAC roles for Microsoft Entra ID users. To ensure that only authorized Microsoft Entra ID users can read documents and that shared keys cannot be used, you must disable shared key access and configure RBAC roles to authorize specific users. Option A does exactly that. Option D disables shared key access but uses user-delegation SAS tokens, which can be used by anyone possessing the token, not only authorized Entra ID users. Therefore, only option A fully meets the requirement.

Answer

Enable Microsoft Entra ID authentication and use SAS tokens with a stored access policy

Answer

Enable firewall and virtual network service endpoints, then assign RBAC roles

Answer

Use user-delegation SAS tokens and disable shared key access

Question 2

You need to restrict access to an Azure Storage account so that only a specific subnet of a virtual network can access the data. Additionally, you need to allow management access from the Azure portal (e.g., to view containers). Which configuration should you apply?

Accepted Answer

Configure a service endpoint for Microsoft.Storage on the subnet and add a firewall rule to allow the subnet, then enable 'Allow trusted Microsoft services'.. Configuring a service endpoint for Microsoft.Storage on the subnet ensures traffic from that subnet to the storage account stays within the Azure backbone, and the firewall rule restricts access to that subnet. Enabling 'Allow trusted Microsoft services' permits Azure portal management operations (e.g., listing containers) because the portal is a trusted service that bypasses the network rules for control-plane actions.

Answer

Configure IP firewall rules to allow the subnet IP range and add the Azure portal's public IP addresses.

Answer

Configure a private endpoint for the storage account and disable public network access.

Answer

Configure IP ACLs to allow the subnet and also allow all Azure services.

Question 3

You deploy an Azure App Service web app that uses a system-assigned managed identity. The app needs to read a secret stored in Azure Key Vault to connect to a third-party service. You want to grant the minimum required permissions to the managed identity. Which Azure RBAC role should you assign to the managed identity at the Key Vault scope?

Accepted Answer

Key Vault Secrets User. The 'Key Vault Secrets User' role grants the minimum required permission—'Microsoft.KeyVault/vaults/secrets/getSecret/action'—for a managed identity to read a secret from Azure Key Vault. This role is specifically designed for read-only access to secrets, aligning with the principle of least privilege for the app's need to retrieve a secret for third-party service authentication.

Answer

Key Vault Reader

Answer

Key Vault Secrets Officer

Answer

Key Vault Contributor

Question 4

An API receives JWT access tokens from Microsoft Entra ID. Which two token properties should the API validate before accepting a request? The design must avoid adding custom operational scripts.

Accepted Answer

Issuer and signature are valid for the trusted tenant. The API must validate that the JWT's issuer (iss claim) matches the trusted tenant's issuer URL (e.g., https://login.microsoftonline.com/{tenant-id}/v2.0) and that the token's cryptographic signature is valid using the public keys from the OpenID Connect discovery endpoint. This ensures the token was genuinely issued by Microsoft Entra ID for the expected tenant and has not been tampered with. Additionally, the API must validate the token's audience (aud claim) to ensure it matches the API's own Application ID URI or client ID. This confirms the token was specifically intended for this API and not for another application.

Answer

The user's display name is present

Answer

The token was sent in a query string

Question 5

A background service must call Microsoft Graph without a signed-in user. Which Microsoft identity platform permission model is required?

Accepted Answer

Application permissions with client credentials flow. For a background service calling Microsoft Graph without a signed-in user, the application must authenticate as itself, not on behalf of a user. Application permissions, combined with the client credentials flow (OAuth 2.0), allow the service to obtain an access token using its own identity (client ID and client secret or certificate), without any user interaction. This is the only model that supports non-interactive, daemon-style access to Microsoft Graph.

Answer

Password hash synchronization

Answer

Delegated permissions only

Answer

Device code flow

Question 6

Match each Azure authentication mechanism to its description.

Accepted Answer

Azure Active Directory (Azure AD): Microsoft's cloud-based identity and access management service. These are key authentication mechanisms in Azure. Microsoft Entra ID is the identity service; Managed Identities are automatic service principals; Service Principals are explicit identities for apps; SAS tokens grant limited access to storage.

Answer

Managed Identity: A secret key used to authenticate to Azure SQL Database

Answer

Service Principal: A user account in Azure AD for human users

Question 7

You are implementing a microservices solution on Azure Kubernetes Service (AKS). You need to securely store and retrieve connection strings to a database without hardcoding them in the application code. The solution should automatically rotate secrets every 90 days. What should you use?

Accepted Answer

Azure Key Vault with Key Vault Secrets Provider for AKS. Azure Key Vault with the Key Vault Secrets Provider for AKS allows mounting secrets as volumes, and Key Vault supports automatic rotation and versioning. Option A is correct because it integrates rotation. Option B lacks automatic rotation and is less secure than Key Vault for sensitive secrets. Option C (Azure Managed Identity) is an authentication mechanism for applications to access Azure resources, not a solution for storing and automatically rotating database connection strings. While it can be used by pods in AKS to access Key Vault, it doesn't fulfill the core requirement of secret storage and rotation. Option D (Azure App Configuration) is primarily for managing application settings and feature flags. While it can store key-value pairs, it is not designed as a secure secret store with built-in rotation capabilities for sensitive data like database connection strings, unlike Azure Key Vault.

Answer

Kubernetes Secrets with a CronJob to update them

Answer

Azure Managed Identity for the pod

Answer

Azure App Configuration with a managed identity

Question 8

Your company uses Azure DevOps for CI/CD. The security team requires that all pull request (PR) merges to the main branch be signed with a valid code signing certificate to ensure code integrity. Which Azure DevOps feature should you enforce?

Accepted Answer

Set up branch protection with 'Require a merge commit' and enable 'Require signed commits'. Branch policies in Azure DevOps allow you to enforce rules on branches. The 'Require signed commits' policy ensures that all commits pushed to the branch (including those introduced by a PR merge) have a valid GPG or S/MIME signature, which can be configured to require a valid signature from a trusted certificate. This directly addresses the requirement for signed PR merges. 'Require a merge commit' is a separate branch policy that enforces a specific merge strategy, but it does not directly enforce commit signing. Option C (Azure Policy) is for governing Azure resources, not Azure DevOps repository policies. Option D (build validation step) is for pipeline checks, not for enforcing commit signing at the Git level before a merge is allowed.

Answer

Configure a service hook to validate signatures using Azure Functions

Answer

Use Azure Policy to require code signing on the repository

Answer

Add a build validation step in the PR pipeline that checks signatures

Question 9

Your organization uses Azure Policy to enforce compliance. You need to ensure that all Azure SQL databases have Advanced Data Security (ADS) enabled. What type of Azure Policy effect should you use to automatically enable ADS if it is not already enabled?

Accepted Answer

DeployIfNotExists. DeployIfNotExists is the correct Azure Policy effect because it evaluates whether a specific dependent resource (or property) exists and, if not, triggers a deployment to create or enable it. For Advanced Data Security (ADS) on Azure SQL databases, the policy checks if ADS is enabled; if not, it deploys the necessary configuration to turn it on. This effect is designed for automatic remediation of non-compliant resources, exactly matching the requirement to 'automatically enable ADS if it is not already enabled.'

Answer

Audit

Answer

Modify

Answer

Deny

Question 10

Refer to the exhibit. You are creating a custom Azure RBAC role. You assign this role to a user for the Production resource group. The user needs to read the contents of a blob in a container. Which permission is necessary for the user to list the container's blobs?

Accepted Answer

Microsoft.Storage/storageAccounts/blobServices/containers/blobs/list. Listing blobs within a container is a data operation that requires a specific permission. The 'Microsoft.Storage/storageAccounts/blobServices/containers/blobs/list' permission enables the user to enumerate blobs in a container. This is distinct from reading the content of a specific blob, which would require a 'read' permission. Therefore, Option A is the necessary permission for listing the container's blobs.

Answer

Microsoft.Storage/storageAccounts/read

Answer

Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read

Answer

Microsoft.Storage/storageAccounts/blobServices/containers/read

Question 11

You need to restrict access to an Azure Storage blob container so that only users from your Microsoft Entra tenant can read blobs, and deny all other access including anonymous traffic. What should you configure?

Accepted Answer

Set public access level to private and assign RBAC roles to users. Setting the container's public access level to Private removes anonymous read access, and then assigning RBAC roles (such as Storage Blob Data Reader) to users or groups scoped to your Microsoft Entra tenant grants authenticated, identity-based access. This satisfies both requirements: only tenant users can read blobs, and all anonymous/other access is denied. RBAC integrates with Entra ID for centralized identity and conditional access.

Answer

Generate a shared access signature (SAS) for the container

Answer

Configure a network firewall to allow only your tenant's IP range

Answer

Use storage account access keys and distribute them to users

Question 12

Which TWO services can be used to manage secrets and certificates for applications running on Azure? (Choose two.)

Accepted Answer

Azure Key Vault. Azure Key Vault (A) is correct because it is Azure's dedicated service for securely storing and managing secrets, keys, and certificates, with features like HSM-backed keys, access policies, and RBAC for application access. Azure Automation (C) is also correct because its credential and certificate assets (stored encrypted and retrievable at runtime in runbooks/DSC) allow it to manage secrets and certificates used by automation workloads. Azure App Configuration (B) is for centralized configuration settings and feature flags, not secret/certificate storage. Microsoft Entra ID Certificate Services (D) is not a standalone Azure service for application secret management, and Azure Policy (E) is a governance/compliance tool that enforces rules rather than storing or managing secrets.

Answer

Azure App Configuration

Answer

Azure Active Directory Certificate Services

Answer

Azure Policy

Question 13

Which TWO permissions should be granted to an application's managed identity to allow it to read secrets from Azure Key Vault and use them to access Azure Storage?

Accepted Answer

Key Vault Secrets User role (includes get and list). To read secrets from Azure Key Vault, the Key Vault Secrets User role provides the necessary 'get' and 'list' permissions using the principle of least privilege. To access Azure Storage after retrieving a secret (e.g., a connection string), the Storage Blob Data Contributor role is required. Therefore, two distinct roles (D and E) satisfy the requirements. The Key Vault Secrets Officer role (B) would also allow reading secrets but grants excessive permissions beyond what is required for just reading, so it is not a least-privilege choice.

Answer

Key Vault Crypto User role

Answer

Key Vault Secrets Officer role (includes all operations)

Answer

Key Vault Reader role

Question 14

Which TWO of the following are benefits of using Azure Key Vault to store application secrets?

Accepted Answer

Centralized management of secrets with access policies.. Option A is correct because Azure Key Vault provides a single, centralized store for secrets, keys, and certificates, and access is governed through Key Vault access policies (or Azure RBAC), so applications and administrators no longer scatter credentials across config files. Option E is correct because Key Vault emits diagnostic logs and metrics for secret operations (for example, SecretGet) that can be routed to Azure Monitor and Log Analytics for auditing and alerting on who accessed which secret and when. Option B is not a Key Vault benefit: Key Vault is not a caching layer, and applications typically use the Key Vault SDK or a client-side cache to reduce calls, but that is not a built-in performance feature of the service. Option C is not correct as stated: Azure DevOps can integrate with Key Vault via variable groups and pipeline tasks, but Key Vault does not automatically rotate secrets in pipelines; rotation requires Azure Functions, Event Grid, or custom automation. Option D is not the best answer because while Key Vault does protect secrets with encryption at rest (HSM-backed) and TLS in transit, that is a baseline security property rather than the distinguishing benefit being tested here, and the question asks for benefits of using Key Vault to store application secrets.

Answer

Improved application performance by caching secrets.

Answer

Integration with Azure DevOps for automatic secret rotation in pipelines.

Answer

Automatic encryption of secrets at rest and in transit.

Question 15

A company uses Azure Logic Apps to orchestrate workflows that process sensitive data. They need to ensure that workflow runs are logged and auditable, and that the logs are tamper-proof. Which Azure service should they use?

Accepted Answer

Azure Blob Storage with immutable storage policy.. Azure Logic Apps can be configured to send their diagnostic logs to an Azure Storage Account. By applying an immutable storage policy (Write Once, Read Many - WORM) to the container or blobs in that Storage Account, the logs become tamper-proof for the specified retention period, directly meeting the requirement for tamper-proof auditing. This is a standard and direct method for achieving WORM compliance for Azure service diagnostic logs.

Answer

Azure Monitor Log Analytics workspaces.

Answer

Microsoft Sentinel.

Answer

Microsoft Purview Audit (Premium).

Question 16

Which THREE measures can you use to protect data at rest in Azure Cosmos DB? (Choose three.)

Accepted Answer

Enable encryption at rest using Microsoft-managed keys.. Option A is correct because Azure Cosmos DB automatically encrypts all data at rest using Microsoft-managed keys by default, which protects stored data on the underlying storage media without additional configuration. Option B is correct because Azure RBAC controls who can access the Cosmos DB account and its data plane, ensuring that only authorized identities can read or modify stored data, which is a core data-at-rest protection measure. Option C is correct because configuring customer-managed keys (CMK) in Azure Key Vault lets you control the encryption keys used for data-at-rest encryption, satisfying compliance and key-ownership requirements. Option D is not correct because TLS 1.2 protects data in transit between clients and the service, not data at rest. Option E is not correct because Azure Firewall is a network security service for filtering traffic and does not encrypt or protect stored data at rest.

Answer

Enforce TLS 1.2 for all client connections.

Answer

Deploy Azure Firewall in front of the Cosmos DB account.

Question 17

Your application uses Azure App Service and needs to authenticate users via Microsoft Entra ID. Which THREE components must be configured in the App Service authentication settings?

Accepted Answer

Client ID. In App Service Authentication (Easy Auth) with Microsoft Entra ID as the identity provider, you must supply the Client ID (A), which is the application (client) ID of the Entra ID app registration used to identify your app during the OAuth/OpenID Connect flow. You must also configure Allowed token audiences (B), which specifies the acceptable 'aud' claim values in the incoming token so App Service can validate that the token was issued for your application. The Issuer URL (C) is required so App Service can validate the token's 'iss' claim against the Entra ID authority (e.g., https://login.microsoftonline.com/{tenant}/v2.0), ensuring the token came from the expected tenant. The Client secret (D) is not a required field in the authentication settings for validating incoming user tokens — it is only needed for confidential client flows such as token exchange or when the app calls downstream APIs, and it is optional in the Easy Auth configuration. The Tenant ID (E) is not a separate required setting because the tenant is already embedded in the Issuer URL, so it does not need to be configured independently.

Answer

Client secret

Answer

Tenant ID

Question 18

Refer to the exhibit. You create a custom RBAC role with the shown permissions. You assign this role to a user at the resource group scope. What can the user do?

Accepted Answer

Read secrets from Key Vaults in the resource group. The role includes read access to Key Vaults and secrets within those vaults, allowing the user to read secrets from Key Vaults in the resource group. Option A is correct. Option B is incorrect because assigning the same role to other users requires Microsoft.Authorization/roleAssignments/write permission, which is not included. Option C is incorrect because deleting secrets requires Microsoft.KeyVault/vaults/secrets/delete permission, which is not included. Option D is incorrect because creating new Key Vaults requires Microsoft.KeyVault/vaults/write permission, which is not included in the read-only role.

Answer

Assign the same role to other users

Answer

Delete secrets from Key Vaults in the resource group

Answer

Create new Key Vaults in the resource group

Question 19

You are developing a .NET Core API that uses Azure AD for authentication. You want to restrict access to specific claims. Which middleware component should you use to check claims?

Accepted Answer

Use the UseAuthorization middleware in the pipeline. The UseAuthorization middleware is the component in the ASP.NET Core pipeline responsible for performing authorization checks, including evaluating policies that require specific claims. While the [Authorize] attribute and policies define the authorization requirements, it is the UseAuthorization middleware that executes these checks.

Answer

Use the UseAuthentication middleware to validate tokens

Answer

Use the [Authorize] attribute with a policy that requires a specific claim

Answer

Manually parse the JWT in a custom middleware

Question 20

A company is designing a secure microservices architecture on Azure Kubernetes Service (AKS). The security requirements include: encrypting secrets at rest and in transit, rotating secrets automatically, and avoiding hard-coded credentials in application code. Which THREE solutions should the company use? (Choose three.)

Accepted Answer

Use the Azure Key Vault CSI Driver to mount secrets as volumes in pods.. Option C is correct because the Azure Key Vault CSI Driver for AKS mounts Key Vault secrets, keys, and certificates directly into pods as volume files, so secrets are delivered over TLS from Key Vault and never baked into images or environment variables, satisfying in-transit encryption and avoiding hard-coded credentials. Option D is correct because Azure Key Vault encrypts secrets at rest (FIPS 140-2 validated HSMs/software protection) and supports automatic rotation via Key Vault rotation policies, while soft-delete and purge protection guard against accidental or malicious deletion of the vault objects. Option E is correct because AKS-managed Microsoft Entra ID integration with pod-managed identities (workload identity) lets pods obtain Microsoft Entra tokens to authenticate to Key Vault without storing credentials in code, eliminating hard-coded secrets. Option A is not appropriate because ConfigMaps are not encrypted at rest by default and are meant for non-sensitive configuration, not secrets. Option B is not appropriate because Kubernetes Secrets are only base64-encoded, not encrypted at rest by default, and a CronJob-based rotation is manual, error-prone, and does not provide the managed rotation or centralized protection that Key Vault offers.

Answer

Inject secrets as environment variables from ConfigMaps.

Answer

Use Kubernetes Secrets with a scheduled CronJob to rotate them.