AZ-204 Implement Azure security Practice Test 10 — 15 Questions

Question 1

Refer to the exhibit. You run the Azure CLI command to retrieve a secret from Azure Key Vault. The output shows the secret metadata but not the secret value. The command returns without error. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The command output only shows metadata by default; you must specify --query "value" to retrieve the secret value.. The Azure CLI `az keyvault secret show` command returns the secret metadata (including attributes like id, enabled, created, updated) by default, but does not include the secret value unless you explicitly request it using the `--query "value"` parameter. Since the command completed without error and only metadata was shown, the most likely cause is that the output was not filtered to retrieve the secret value.

Answer

The secret has expired.

Answer

The user does not have the Key Vault Secrets Officer role.

Answer

The secret is in a soft-deleted state.

Question 2

Refer to the exhibit. You deploy an Azure Storage account using the ARM template snippet. A developer reports that they cannot connect to the storage account from their machine with IP 10.0.0.5, even though they have the proper RBAC role. What is the most likely reason?

Accepted Answer

The storage account firewall is configured to deny all traffic except from the 192.168.1.0/24 IP range.. The ARM template snippet configures a network rule that only allows traffic from the 192.168.1.0/24 IP range. Since the developer's machine has IP 10.0.0.5, it falls outside this allowed range, causing the connection to be blocked by the storage account firewall, regardless of RBAC permissions. RBAC controls authorization (who can access), but network rules control access (who can reach the endpoint), and the firewall denies all traffic not explicitly permitted.

Answer

The storage account is configured to bypass Azure Services, which blocks non-Azure clients.

Answer

The developer does not have the Storage Blob Data Contributor role.

Answer

The minimum TLS version is set to TLS 1.2, but the developer's client uses TLS 1.0.

Question 3

A company stores secrets in Azure Key Vault. Developers need to retrieve secrets from a web app without storing connection strings in code. Which authentication method should the web app use?

Accepted Answer

Enable a managed identity for the web app. Managed identities for Azure resources provide an automatically managed identity in Azure AD, allowing the web app to authenticate to Key Vault without any credentials in code. The web app obtains an Azure AD access token directly from the Azure Instance Metadata Service (IMDS) endpoint, which Key Vault accepts. This eliminates the need to store connection strings, client secrets, or certificates in the application.

Answer

Register a service principal and use a client secret

Answer

Use a shared access signature (SAS) token

Answer

Use a certificate thumbprint in the app settings

Question 4

You are developing a microservices application. Each microservice must authenticate to Azure SQL Database using its own identity. You need to minimize credential management overhead. What should you use?

Accepted Answer

System-assigned managed identities. System-assigned managed identities enable each microservice to authenticate to Azure SQL Database without storing credentials in code or configuration. Azure automatically rotates the identity's service principal certificate and handles token acquisition via the Azure Instance Metadata Service (IMDS) endpoint, eliminating manual credential management. This is the simplest approach when each microservice has a one-to-one relationship with its Azure resource (e.g., App Service or Azure Function).

Answer

User-assigned managed identities

Answer

Certificate-based authentication

Answer

Service principals with client secrets

Question 5

Your application uses Azure Key Vault to store cryptographic keys. You need to ensure that keys are automatically rotated every 90 days without any manual intervention. Which Key Vault feature should you configure?

Accepted Answer

Set a key rotation policy. Azure Key Vault supports key rotation policies that allow you to define automatic rotation intervals (e.g., every 90 days) for cryptographic keys. When a rotation policy is set, Key Vault automatically creates a new key version and optionally expires the old one, eliminating the need for manual intervention.

Answer

Configure a Key Vault firewall

Answer

Enable soft-delete on the key vault

Answer

Use a managed HSM instead of a standard vault

Question 6

You are building an API that needs to validate JWT tokens issued by Microsoft Entra ID. The API is registered as an application in Entra ID. Which endpoint should the API use to obtain the signing keys?

Accepted Answer

https://login.microsoftonline.com/{tenant}/discovery/v2.0/keys. The endpoint `https://login.microsoftonline.com/{tenant}/discovery/v2.0/keys` is the Microsoft Entra ID (formerly Azure AD) v2.0 JWKS (JSON Web Key Set) URI, which returns the public signing keys used to validate the signature of JWT tokens. The API must fetch these keys to verify the token's integrity and authenticity, as the keys are rotated periodically.

Answer

https://login.microsoftonline.com/{tenant}/oauth2/v2.0/token

Answer

https://login.microsoftonline.com/{tenant}/oauth2/v2.0/authorize

Answer

https://login.microsoftonline.com/{tenant}/v2.0/.well-known/openid-configuration

Question 7

You have an Azure Storage account with a blob container. You need to grant a user read-only access to a specific blob for 24 hours without requiring them to authenticate with Microsoft Entra ID. What should you use?

Accepted Answer

Generate a user delegation SAS token. A user delegation SAS token is the correct choice because it provides time-limited, delegated access to a specific blob using Microsoft Entra ID credentials without requiring the user to authenticate directly. The token is signed with the user's delegated key, granting read-only access for exactly 24 hours as specified, and it does not expose the storage account access key.

Answer

Provide the storage account access key

Answer

Assign the Storage Blob Data Reader role

Answer

Configure a stored access policy

Question 8

Your application runs on Azure Kubernetes Service (AKS). It needs to access Azure Key Vault secrets. You want to avoid using a service principal. Which solution should you implement?

Accepted Answer

Deploy the Secrets Store CSI Driver with workload identity. The Secrets Store CSI Driver with workload identity allows your AKS pods to securely access Azure Key Vault secrets without managing a separate service principal. Workload identity uses Azure AD pod-managed identities or federated identity credentials to authenticate directly to Key Vault, eliminating the need for explicit service principal credentials.

Answer

Mount secrets as a ConfigMap from Key Vault

Answer

Create a service principal and assign it to the AKS cluster

Answer

Use a Helm chart to inject secrets

Question 9

You need to secure a web API that is called from a single-page application (SPA). The API uses Microsoft Entra ID for authentication. Which OAuth 2.0 flow should the SPA use?

Accepted Answer

Authorization code flow with PKCE. The authorization code flow with PKCE (Proof Key for Code Exchange) is the recommended OAuth 2.0 flow for single-page applications because it provides a secure way to obtain an access token without exposing the client secret, which cannot be stored confidentially in a browser. PKCE adds a cryptographic challenge to prevent authorization code interception attacks, making it the only flow that meets modern security standards for public clients like SPAs calling Microsoft Entra ID-protected APIs.

Answer

Resource owner password credentials flow

Answer

Client credentials flow

Answer

Implicit flow

Question 10

Your company uses Microsoft Defender for Cloud. You need to receive alerts when a user modifies a Key Vault access policy. What should you configure?

Accepted Answer

Set up an activity log alert on the Key Vault. Activity log alerts in Azure Monitor can be configured to trigger on specific administrative operations, such as 'Microsoft.KeyVault/vaults/accessPolicies/write'. This allows you to receive near real-time notifications when a Key Vault access policy is modified, directly addressing the requirement without additional services or complex setups.

Answer

Create an Azure Policy to audit access policy changes

Answer

Configure Microsoft Sentinel to monitor Key Vault

Answer

Enable Key Vault logging and query logs

Question 11

Your application uses Azure Functions and needs to authenticate to a downstream API using OAuth 2.0. The function app uses a system-assigned managed identity. Which token endpoint should the function app call to get a token for the downstream API?

Accepted Answer

http://169.254.169.254/metadata/identity/oauth2/token. The Azure Instance Metadata Service (IMDS) endpoint at http://169.254.169.254/metadata/identity/oauth2/token is the standard way for an Azure resource (like a Function App) with a system-assigned managed identity to obtain an OAuth 2.0 access token for a downstream API. This endpoint is used internally by the Azure SDK and is the only endpoint that directly leverages the managed identity without requiring any client secret or certificate.

Answer

https://{function-app}.azurewebsites.net/.auth/login

Answer

https://{downstream-api}.azurewebsites.net/.auth/me

Answer

https://login.microsoftonline.com/{tenant}/oauth2/v2.0/token

Question 12

Your application uses Azure App Service and needs to authenticate users via Microsoft Entra ID. Which THREE components must be configured in the App Service authentication settings?

Accepted Answer

Client ID. The Client ID uniquely identifies your application registration in Microsoft Entra ID. App Service uses this ID to initiate the OAuth 2.0 authorization code flow, ensuring that tokens are issued specifically to your app. Without it, the authentication middleware cannot associate incoming tokens with your registered application.

Answer

Client secret

Answer

Tenant ID

Question 13

You are designing a solution to store application secrets. You need to ensure that secrets are encrypted at rest and access is audited. Which TWO Azure services should you use?

Accepted Answer

Azure Monitor. Azure Monitor is correct because it provides the auditing and logging capabilities required to track access to secrets. By enabling diagnostic settings on Key Vault, you can send audit events (e.g., secret get, set, delete) to a Log Analytics workspace, storage account, or Event Hub, which are then queryable via Azure Monitor Logs. This satisfies the requirement for access auditing.

Answer

Azure SQL Database

Answer

Azure Storage Account with encryption

Answer

Azure App Configuration

Question 14

Refer to the exhibit. You run the Azure CLI command shown. What is the result?

Accepted Answer

Stores a secret named MySecret with the value in the vault. The Azure CLI command `az keyvault secret set --vault-name MyVault --name MySecret --value 'MySecretValue'` is used to create or update a secret in an Azure Key Vault. The `--name` parameter specifies the secret's name, and `--value` provides the secret's value. Since the secret does not exist, it creates a new secret named MySecret with the specified value, making option C correct.

Answer

Creates a key named MySecret in the vault

Answer

Deletes the secret named MySecret from the vault

Answer

Creates a certificate named MySecret in the vault

Question 15

You are developing a web app that authenticates users via Microsoft Entra ID. The app needs to access the Microsoft Graph API to read user profiles. Which type of permission should you request in the app registration to ensure the app can read profiles without user interaction?

Accepted Answer

Application permissions. Application permissions are required for daemon or service-type applications that need to access Microsoft Graph API without a signed-in user. Unlike delegated permissions, which operate on behalf of a user, application permissions allow the app to authenticate as itself using the client credentials OAuth 2.0 flow, enabling read of user profiles without any user interaction.

Answer

Delegated permissions

Answer

Resource-based permissions

Answer

Consent permissions