AZ-204 Implement Azure security — 40 Questions

Question 1

An API receives JWT access tokens from Microsoft Entra ID. Which two token properties should the API validate before accepting a request? The design must avoid adding custom operational scripts.

Accepted Answer

Issuer and signature are valid for the trusted tenant. The API must validate that the JWT's issuer (iss claim) matches the trusted tenant's issuer URL (e.g., https://login.microsoftonline.com/{tenant-id}/v2.0) and that the token's cryptographic signature is valid using the public keys from the OpenID Connect discovery endpoint. This ensures the token was genuinely issued by Microsoft Entra ID for the expected tenant and has not been tampered with. Additionally, the API must validate the token's audience (aud claim) to ensure it matches the API's own Application ID URI or client ID. This confirms the token was specifically intended for this API and not for another application.

Answer

The user's display name is present

Answer

The token was sent in a query string

Question 2

Match each Azure authentication mechanism to its description.

Accepted Answer

Azure Active Directory (Azure AD): Microsoft's cloud-based identity and access management service. These are key authentication mechanisms in Azure. Azure AD is the identity service; Managed Identities are automatic service principals; Service Principals are explicit identities for apps; SAS tokens grant limited access to storage.

Answer

Managed Identity: A secret key used to authenticate to Azure SQL Database

Answer

Service Principal: A user account in Azure AD for human users

Question 3

You are implementing a microservices solution on Azure Kubernetes Service (AKS). You need to securely store and retrieve connection strings to a database without hardcoding them in the application code. The solution should automatically rotate secrets every 90 days. What should you use?

Accepted Answer

Azure Key Vault with Key Vault Secrets Provider for AKS. Azure Key Vault with the Key Vault Secrets Provider for AKS allows mounting secrets as volumes, and Key Vault supports automatic rotation and versioning. Option A is correct because it integrates rotation. Option B lacks automatic rotation and is less secure than Key Vault for sensitive secrets. Option C (Azure Managed Identity) is an authentication mechanism for applications to access Azure resources, not a solution for storing and automatically rotating database connection strings. While it can be used by pods in AKS to access Key Vault, it doesn't fulfill the core requirement of secret storage and rotation. Option D (Azure App Configuration) is primarily for managing application settings and feature flags. While it can store key-value pairs, it is not designed as a secure secret store with built-in rotation capabilities for sensitive data like database connection strings, unlike Azure Key Vault.

Answer

Kubernetes Secrets with a CronJob to update them

Answer

Azure Managed Identity for the pod

Answer

Azure App Configuration with a managed identity

Question 4

Your company uses Azure DevOps for CI/CD. The security team requires that all pull request (PR) merges to the main branch be signed with a valid code signing certificate to ensure code integrity. Which Azure DevOps feature should you enforce?

Accepted Answer

Set up branch protection with 'Require a merge commit' and enable 'Require signed commits'. Branch policies in Azure DevOps allow you to enforce rules on branches. The 'Require signed commits' policy ensures that all commits pushed to the branch (including those introduced by a PR merge) have a valid GPG or S/MIME signature, which can be configured to require a valid signature from a trusted certificate. This directly addresses the requirement for signed PR merges. 'Require a merge commit' is a separate branch policy that enforces a specific merge strategy, but it does not directly enforce commit signing. Option C (Azure Policy) is for governing Azure resources, not Azure DevOps repository policies. Option D (build validation step) is for pipeline checks, not for enforcing commit signing at the Git level before a merge is allowed.

Answer

Configure a service hook to validate signatures using Azure Functions

Answer

Use Azure Policy to require code signing on the repository

Answer

Add a build validation step in the PR pipeline that checks signatures

Question 5

Your company is deploying a multi-tier application on Azure. The application consists of a web front end, an API layer, and a database. You need to ensure secure communication between tiers. Which TWO actions should you take? (Choose two.)

Accepted Answer

Use TLS for all internal service-to-service communication. TLS (Transport Layer Security) encrypts data in transit between application tiers, preventing eavesdropping and man-in-the-middle attacks. For internal service-to-service communication, using TLS ensures that sensitive data passed between the web front end, API layer, and database remains confidential and tamper-proof. Additionally, configuring Network Security Groups (NSGs) to enforce strict communication rules (e.g., web to API, API to database only) provides network-level segmentation, limiting the attack surface and ensuring that only authorized tiers can communicate with each other, which are fundamental security best practices for multi-tier applications.

Answer

Enable HTTPS on the web front end

Answer

Enable Azure Storage encryption at rest

Answer

Use managed identities to authenticate between tiers

Question 6

Refer to the exhibit. You are creating a custom Azure RBAC role. You assign this role to a user for the Production resource group. The user needs to read the contents of a blob in a container. Which permission is necessary for the user to list the container's blobs?

Accepted Answer

Microsoft.Storage/storageAccounts/blobServices/containers/blobs/list. Listing blobs within a container is a data operation that requires a specific permission. The 'Microsoft.Storage/storageAccounts/blobServices/containers/blobs/list' permission enables the user to enumerate blobs in a container. This is distinct from reading the content of a specific blob, which would require a 'read' permission. Therefore, Option A is the necessary permission for listing the container's blobs.

Answer

Microsoft.Storage/storageAccounts/read

Answer

Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read

Answer

Microsoft.Storage/storageAccounts/blobServices/containers/read

Question 7

Which TWO services can be used to manage secrets and certificates for applications running on Azure? (Choose two.)

Accepted Answer

Azure Key Vault. Azure Key Vault is a cloud service for securely storing and accessing secrets, keys, and certificates. It provides centralized management, access control via Azure RBAC and policies, and integration with Azure services like VMs and App Services for certificate deployment and secret injection at runtime. Azure Automation can also store secrets as encrypted variables and certificates as assets, which can then be used by automation runbooks and other integrated services.

Answer

Azure App Configuration

Answer

Azure Active Directory Certificate Services

Answer

Azure Policy

Question 8

Which TWO of the following are benefits of using Azure Key Vault to store application secrets?

Accepted Answer

Centralized management of secrets with access policies.. Azure Key Vault provides a centralized store for application secrets, such as connection strings and API keys, with fine-grained access control through access policies. These policies allow you to grant specific permissions (e.g., GET, LIST, SET) to individual security principals (users, groups, or service principals), ensuring only authorized entities can access secrets. This centralization simplifies secret management across multiple applications and environments. Additionally, Key Vault integrates with Azure Monitor and Log Analytics, enabling comprehensive auditing and logging of all secret access and management operations, which is crucial for security and compliance.

Answer

Improved application performance by caching secrets.

Answer

Integration with Azure DevOps for automatic secret rotation in pipelines.

Answer

Automatic encryption of secrets at rest and in transit.

Question 9

A company uses Azure Logic Apps to orchestrate workflows that process sensitive data. They need to ensure that workflow runs are logged and auditable, and that the logs are tamper-proof. Which Azure service should they use?

Accepted Answer

Azure Blob Storage with immutable storage policy.. Azure Logic Apps can be configured to send their diagnostic logs to an Azure Storage Account. By applying an immutable storage policy (Write Once, Read Many - WORM) to the container or blobs in that Storage Account, the logs become tamper-proof for the specified retention period, directly meeting the requirement for tamper-proof auditing. This is a standard and direct method for achieving WORM compliance for Azure service diagnostic logs.

Answer

Azure Monitor Log Analytics workspaces.

Answer

Microsoft Sentinel.

Answer

Microsoft Purview Audit (Premium).

Question 10

Which THREE measures can you use to protect data at rest in Azure Cosmos DB? (Choose three.)

Accepted Answer

Enable encryption at rest using Microsoft-managed keys.. Azure Cosmos DB automatically encrypts all data at rest using AES-256 encryption. By default, this is done with Microsoft-managed keys (Option A), ensuring data stored on disk is protected. For enhanced control, customers can configure customer-managed keys (CMK) in Azure Key Vault (Option C), allowing them to manage their own encryption keys. Additionally, using Azure Role-Based Access Control (RBAC) (Option B) is crucial to restrict who can access the Cosmos DB account and its data, thereby protecting data at rest from unauthorized users.

Answer

Enforce TLS 1.2 for all client connections.

Answer

Deploy Azure Firewall in front of the Cosmos DB account.

Question 11

You need to secure access to an Azure Storage account that contains sensitive data. Which TWO of the following are recommended best practices?

Accepted Answer

Use managed identities to access storage from Azure services. Managed identities provide an automatically managed identity in Azure AD, allowing Azure services (e.g., Azure Functions, App Services) to authenticate to Azure Storage without storing any credentials in code or configuration. This eliminates the risk of key leakage and simplifies access management, making it a security best practice. Additionally, configuring firewall rules for Azure Storage allows you to restrict access to specific IP addresses or virtual networks (VNets), ensuring that only authorized clients from trusted network locations can connect to your storage account. This is a fundamental security layer and a critical best practice for protecting sensitive data.

Answer

Rotate storage account keys every 24 hours

Answer

Use SAS tokens with long expiry dates

Answer

Enable anonymous public access for all containers

Question 12

Refer to the exhibit. You are configuring a Key Vault key using an ARM template. What does this configuration achieve?

Accepted Answer

The key will be rotated 90 days after creation. The ARM template configuration sets the rotation policy with an expiry time and a 'timeAfterCreate' property relative to creation. The 'timeAfterCreate' value of 'P90D' means the key will be rotated 90 days after creation, not before expiration. This is achieved by specifying a rotation policy that triggers a new key version at a fixed interval from the key's creation date.

Answer

The key can only be used for encryption

Answer

The key size is 4096 bits

Answer

The key will be rotated 90 days before expiration

Question 13

Refer to the exhibit. You create a custom RBAC role with the shown permissions. You assign this role to a user at the resource group scope. What can the user do?

Accepted Answer

Read secrets from Key Vaults in the resource group. The role includes read access to Key Vaults and secrets within those vaults, allowing the user to read secrets from Key Vaults in the resource group. Option A is correct. Option B is incorrect because assigning the same role to other users requires Microsoft.Authorization/roleAssignments/write permission, which is not included. Option C is incorrect because deleting secrets requires Microsoft.KeyVault/vaults/secrets/delete permission, which is not included. Option D is incorrect because creating new Key Vaults requires Microsoft.KeyVault/vaults/write permission, which is not included in the read-only role.

Answer

Assign the same role to other users

Answer

Delete secrets from Key Vaults in the resource group

Answer

Create new Key Vaults in the resource group

Question 14

You need to ensure that an Azure Functions app can access a blob in Azure Storage using its system-assigned managed identity. What should you do first?

Accepted Answer

Enable the managed identity in the Function App. To use a system-assigned managed identity, it must first be enabled on the Azure Functions app. This action creates the identity in Azure Active Directory. Once the identity is enabled, you can then assign the necessary Azure RBAC role, such as 'Storage Blob Data Reader', to this identity at the storage account scope to grant it permissions to access the blob storage. Therefore, enabling the managed identity is the foundational first step.

Answer

Configure CORS on the storage account

Answer

Assign the Storage Blob Data Reader role to the managed identity at the storage account scope

Answer

Generate a SAS token for the blob

Question 15

You are developing a .NET Core API that uses Azure AD for authentication. You want to restrict access to specific claims. Which middleware component should you use to check claims?

Accepted Answer

Use the UseAuthorization middleware in the pipeline. The UseAuthorization middleware is the component in the ASP.NET Core pipeline responsible for performing authorization checks, including evaluating policies that require specific claims. While the [Authorize] attribute and policies define the authorization requirements, it is the UseAuthorization middleware that executes these checks.

Answer

Use the UseAuthentication middleware to validate tokens

Answer

Use the [Authorize] attribute with a policy that requires a specific claim

Answer

Manually parse the JWT in a custom middleware

Question 16

Which THREE of the following are valid ways to authenticate an Azure Function to an Azure SQL Database using managed identities?

Accepted Answer

Enable system-assigned managed identity on the function app and grant it access to the SQL database.. Enabling a system-assigned managed identity on the function app (Option A) creates an Azure AD identity tied to the function app. Alternatively, you can create a user-assigned managed identity and assign it to the function app (Option D). In both scenarios, once the function app has a managed identity, you grant that identity access to the SQL database by using the managed identity's principal ID to create a contained database user mapped to the managed identity (Option C). This allows the function to authenticate via Azure AD token-based authentication without storing credentials.

Answer

Assign the managed identity directly to the Azure SQL Database logical server.

Answer

Create a service principal and assign it to the function app.

Question 17

A company is designing a secure microservices architecture on Azure Kubernetes Service (AKS). The security requirements include: encrypting secrets at rest and in transit, rotating secrets automatically, and avoiding hard-coded credentials in application code. Which THREE solutions should the company use? (Choose three.)

Accepted Answer

Use the Azure Key Vault CSI Driver to mount secrets as volumes in pods.. The Azure Key Vault CSI Driver enables pods to mount secrets from Azure Key Vault as volumes, ensuring secrets are never hard-coded in application code. Storing secrets in Azure Key Vault (D) provides encryption at rest and critical features like soft-delete and purge protection. AKS-managed Microsoft Entra ID integration with pod managed identities (E) allows pods to securely authenticate to Key Vault without hard-coded credentials. This combined approach encrypts secrets at rest (in Key Vault) and in transit (via HTTPS), and supports automatic rotation by syncing with Key Vault's versioned secrets without requiring application restarts.

Answer

Inject secrets as environment variables from ConfigMaps.

Answer

Use Kubernetes Secrets with a scheduled CronJob to rotate them.

Question 18

A company uses Azure Functions to process sensitive customer data. The functions are triggered by Service Bus messages. The security requirements mandate that all function code must be encrypted in transit and at rest, and that access to the function must be authenticated using Microsoft Entra ID. Which TWO configurations should be implemented? (Choose two.)

Accepted Answer

Configure the function app's authentication to 'Microsoft Entra ID' with 'Require authentication' set to 'On'.. Enabling Microsoft Entra ID authentication with 'Require authentication' set to 'On' ensures that only authenticated identities can invoke the function, meeting the access control requirement. This integrates directly with the function app's built-in authentication/authorization layer, which validates tokens from Microsoft Entra ID before the function code runs. Setting the function app's 'HTTPS Only' to 'On' enforces that all communication with the function app occurs over HTTPS, thereby ensuring encryption of data in transit.

Answer

Enable 'App Service Authentication' and set the action to 'Allow anonymous requests'.

Answer

Use Service Bus managed identity with access keys for authentication.

Answer

Set the function app's 'HTTP version' to 'HTTP/2' to improve encryption.

Question 19

You are developing a serverless application using Azure Functions that processes sensitive data. The function is triggered by an Azure Storage queue. You need to ensure that data in transit between the function and the storage account is encrypted using a customer-managed key (CMK) and that the storage account's firewall only allows access from the function's virtual network. Which two actions should you take? (Choose two.)

Accepted Answer

Configure the storage account firewall to allow access only from the function's virtual network.. The stem incorrectly states that data in transit between the function and storage account can be encrypted using a customer-managed key (CMK). CMK is for encryption at rest. Data in transit is secured via TLS/HTTPS using platform-managed keys. Option C, 'Enable 'Secure transfer required' on the storage account,' enforces HTTPS, ensuring in-transit encryption. Option B, 'Configure the storage account firewall to allow access only from the function's virtual network,' directly addresses the network access restriction. While enabling VNet integration on the function app (Option D) is a necessary prerequisite action for the function to utilize the virtual network, Option B is the specific action on the storage account to enforce the firewall rule. Given the ambiguity, if the question intends to focus on direct actions on the storage account for both requirements, B and C would be chosen.

Answer

Configure a customer-managed key in Azure Key Vault and associate it with the storage account.

Answer

Enable VNet integration on the function app to route traffic through a virtual network.

Question 20

You are designing a solution to store secrets for a microservices application running on Azure Kubernetes Service (AKS). The secrets must be automatically rotated and remain available if the Key Vault is temporarily unavailable. Which TWO options meet the requirements?

Accepted Answer

Use the AKS add-on for Azure Key Vault (Secrets Store CSI driver) with a sync to Kubernetes secrets.. The AKS add-on for Azure Key Vault (Secrets Store CSI driver) can sync secrets to Kubernetes secrets, ensuring they remain available as cached copies even if Key Vault is temporarily unreachable. The driver polls Key Vault for changes, meeting the automatic rotation requirement. Similarly, deploying a sidecar container that periodically retrieves secrets from Key Vault and stores them in a shared volume also meets both requirements: the sidecar handles automatic rotation by polling, and the shared volume ensures availability even if Key Vault is temporarily down.

Answer

Have each microservice read secrets directly from Key Vault using the SDK.

Answer

Assign a managed identity to each pod and use it to authenticate to Key Vault.

Answer

Store secrets as plain text in Kubernetes secrets.