AZ-204 Implement Azure security Practice Test 11 — 15 Questions

Question 1

A company uses Azure App Service to host a web application. They need to ensure that only authenticated users from their Microsoft Entra ID tenant can access the app. They also want to prevent unauthenticated requests from reaching the app code. Which configuration should they implement?

Accepted Answer

Enable App Service Authentication with Microsoft Entra ID as the identity provider and set 'Action to take when request is not authenticated' to 'Log in with Microsoft Entra ID'.. Option B is correct because the App Service Authentication feature, when configured to require authentication (e.g., 'Log in with Microsoft Entra ID'), blocks unauthenticated requests before they reach the app code. Option A is wrong because IP restrictions only block based on IP, not authentication. Option C is wrong because the built-in Microsoft Entra ID authentication module in App Service (EasyAuth) is specifically designed to offload authentication and reject unauthenticated requests. Option D is wrong because Microsoft Entra ID App Roles are for authorization, not authentication enforcement at the gateway.

Answer

Configure IP restrictions in the web.config to allow only the company's office IP range.

Answer

Implement a custom middleware in the app to validate tokens from Microsoft Entra ID.

Answer

Assign users to Microsoft Entra ID App Roles and check roles in the app.

Question 2

You are developing a serverless function app that processes credit card payments. The function app must securely store the payment gateway API key. Which Azure service should you use to store the key?

Accepted Answer

Store the key in Azure Key Vault and retrieve it using a managed identity.. Option C is correct because Azure Key Vault is designed to securely store secrets like API keys, certificates, and connection strings. Option A is wrong because App Service application settings are not encrypted at rest by default and are visible in the portal. Option B is wrong because Azure Cosmos DB is a database, not a secrets store. Option D is wrong because Azure Storage queues are for messaging, not secure storage.

Answer

Store the key in an Azure Storage queue and read it at runtime.

Answer

Store the key in Azure Cosmos DB with client-side encryption.

Answer

Store the key in the function app's application settings.

Question 3

A company has an Azure Kubernetes Service (AKS) cluster. They want to ensure that pods can securely access Azure SQL Database without using connection strings or secrets. The solution must use the principle of least privilege. What should they implement?

Accepted Answer

Enable Azure AD Workload Identity for AKS and assign a managed identity to the pod that has access to Azure SQL Database.. Option D is correct because AKS pod-managed identity (or Azure AD Workload Identity) allows pods to assume a managed identity, which can be granted access to Azure SQL Database via Microsoft Entra authentication. Option A is wrong because Kubernetes secrets are not encrypted at rest by default and require manual management. Option B is wrong because Azure Key Vault with CSI driver still requires a secret to access Key Vault unless combined with managed identity, but the question asks to avoid connection strings/secrets entirely. Option C is wrong because cluster IP addresses are not a secure method for database authentication.

Answer

Use the Azure Key Vault Provider for Secrets Store CSI Driver to mount secrets into the pod.

Answer

Store the SQL connection string in a Kubernetes secret and mount it as a volume in the pod.

Answer

Configure Azure SQL Database firewall to allow the AKS cluster's IP addresses.

Question 4

You are developing an ASP.NET Core web app that will be deployed to Azure App Service. The app needs to authenticate users from a Microsoft Entra ID tenant. You want to minimize development effort and rely on platform features. What should you do?

Accepted Answer

Enable App Service Authentication in the Azure portal and configure Microsoft Entra ID as the identity provider.. Option A is correct because App Service Authentication (EasyAuth) provides built-in authentication with Microsoft Entra ID without requiring code changes. Option B is wrong because it requires code changes. Option C is wrong because it's unnecessary if EasyAuth is used. Option D is wrong because it's for authorization, not authentication.

Answer

Implement custom OAuth 2.0 middleware in the app.

Answer

Add Microsoft.Identity.Web NuGet package and configure it in Startup.cs to use Microsoft Entra ID.

Answer

Use Microsoft Entra ID App Roles and add role checks in the code.

Question 5

A company uses Azure Blob Storage to store sensitive documents. They want to ensure that data is encrypted at rest using customer-managed keys (CMK) stored in Azure Key Vault. They also need to be able to revoke access to the data immediately if a security breach is detected. Which feature should they enable?

Accepted Answer

Configure Azure Storage encryption with customer-managed keys in Azure Key Vault and enable soft delete and purge protection.. Option D is correct because enabling double encryption with CMK and then revoking the key in Key Vault renders the data inaccessible. Option A is wrong because infrastructure encryption uses platform-managed keys, not CMK. Option B is wrong because client-side encryption is performed by the client, not server-side. Option C is wrong because storage service encryption uses Microsoft-managed keys by default.

Answer

Enable infrastructure encryption for the storage account.

Answer

Use Azure Storage Service Encryption with Microsoft-managed keys.

Answer

Implement client-side encryption using Azure Key Vault.

Question 6

You are developing an API that will be hosted on Azure API Management (APIM). The API must be accessible only to clients that present a valid JSON Web Token (JWT) issued by Microsoft Entra ID. Which APIM policy should you use to validate the JWT?

Accepted Answer

<validate-jwt header-name="Authorization" failed-validation-httpcode="401" />. Option B is correct because the validate-jwt policy is designed to check the validity of a JWT token. Option A is wrong because check-header only checks for the existence of a header, not validation. Option C is wrong because authenticate-basic is for basic authentication. Option D is wrong because cors is for cross-origin requests.

Answer

Answer

<authenticate-basic />

Answer

<check-header name="Authorization" failed-check-httpcode="401" />

Question 7

A company is building a microservices application on Azure Container Instances. Each microservice needs to authenticate to Azure Key Vault to retrieve secrets. They want to avoid storing any credentials in the container images or environment variables. What should they do?

Accepted Answer

Enable managed identity for the container group and grant it access to Key Vault.. Option B is correct because managed identity for Azure Container Instances allows containers to authenticate to Azure services without credentials. Option A is wrong because passing connection strings as environment variables exposes secrets. Option C is wrong because Docker secrets are not natively supported in Azure Container Instances. Option D is wrong because SAS tokens are not suitable for container-to-Key Vault authentication.

Answer

Use Docker secrets mounted as volumes.

Answer

Use a shared access signature (SAS) token to access Key Vault.

Answer

Store the Key Vault URI and a client secret in environment variables.

Question 8

You are deploying a web app to Azure App Service that must use a custom domain with TLS/SSL. You have purchased an SSL certificate from a third-party CA. How should you upload and bind the certificate to the custom domain?

Accepted Answer

Upload the .pfx file to the App Service TLS/SSL settings and bind it to the custom domain.. Option A is correct because App Service requires the certificate to be uploaded as a .pfx file with the private key. Option B is wrong because .cer files do not contain the private key. Option C is wrong because you should not upload to the custom domain folder. Option D is wrong because Key Vault integration is optional but not required.

Answer

Place the certificate files in the wwwroot folder of the app and configure the web.config.

Answer

Import the certificate into Azure Key Vault and reference it from App Service.

Answer

Upload the .cer file to the App Service and let Azure generate the private key.

Question 9

Which TWO actions should you take to securely store and access secrets for a legacy application that cannot be modified? The application runs on an Azure Virtual Machine and needs to read a database connection string. The solution must use Azure Key Vault and adhere to the principle of least privilege.

Accepted Answer

Configure the application to read the connection string from a local file that is updated by the Key Vault extension.. Option A is correct because Key Vault VM extension automatically syncs certificates and secrets as files, but for connection strings, the application still needs to read the file. Option C is correct because the application can be configured to read the connection string from a local file that is synced by the extension. Option B is wrong because managed identity is assigned to the VM, not the app; the extension uses the VM's identity. Option D is wrong because enabling the extension with a system-assigned managed identity is sufficient; a user-assigned identity is not required. Option E is wrong because the extension can be enabled on existing VMs.

Answer

Create a new VM and install the Key Vault extension during provisioning.

Answer

Assign a managed identity to the legacy application.

Answer

Use a user-assigned managed identity and assign it to the VM.

Question 10

Which THREE of the following are valid ways to authenticate an Azure Function to an Azure SQL Database using managed identities?

Accepted Answer

Enable system-assigned managed identity on the function app and grant it access to the SQL database.. Options A, B, and D are correct. Option A is correct because a system-assigned managed identity can be enabled for the function app and granted access to SQL DB. Option B is correct because a user-assigned managed identity can be assigned to the function app. Option D is correct because both system and user-assigned identities can be used; they are both managed identity types. Option C is wrong because service principal is not a managed identity. Option E is wrong because managed identity cannot be assigned directly to SQL DB; it's assigned to the function app.

Answer

Assign the managed identity directly to the Azure SQL Database logical server.

Answer

Create a service principal and assign it to the function app.

Question 11

Which THREE of the following are true regarding Microsoft Entra ID authentication for Azure Storage?

Accepted Answer

RBAC roles can be used to grant permissions to a user or service principal.. Options A, B, and D are correct. Option A is correct because RBAC roles like Storage Blob Data Contributor grant access to storage. Option B is correct because managed identities can be used for authentication. Option D is correct because OAuth 2.0 access tokens are used. Option C is wrong because Shared Key authorization is disabled when only Microsoft Entra ID is allowed. Option E is wrong because SAS tokens can still be used even if Microsoft Entra ID is enabled, unless explicitly forbidden.

Answer

SAS tokens are not supported when using Microsoft Entra ID authentication.

Answer

When Microsoft Entra ID authentication is enabled, Shared Key authorization is still allowed by default.

Question 12

Refer to the exhibit. You are deploying an Azure Key Vault using this ARM template. Your team plans to use RBAC to manage access. The vault must be accessible from Azure services (e.g., Azure VMs) without public IP addresses. After deployment, a developer reports that they cannot access secrets from a VM in the same region, even though the VM has a managed identity with the Key Vault Secrets User role. What is the most likely cause?

Accepted Answer

The vault's network ACLs block all traffic except from Azure services, but VMs are not considered Azure services.. Option B is correct because the network ACLs have defaultAction set to 'Deny' and only Azure services bypass (via 'AzureServices'), but VMs are not considered Azure services for bypass; they need a virtual network rule. Option A is wrong because RBAC is enabled and the role is assigned. Option C is wrong because soft delete is enabled and does not affect access. Option D is wrong because the vault name is irrelevant.

Answer

Soft delete is enabled, which prevents access to secrets until they are recovered.

Answer

The accessPolicies array is empty, so RBAC is not working.

Answer

The vault name is not unique and conflicts with another vault.

Question 13

You are a developer for a fintech company. Your application consists of multiple Azure Functions that process sensitive financial transactions. The functions need to access an Azure SQL Database and an Azure Storage account. Security requirements are: (1) No secrets or connection strings should be stored in application settings or code. (2) Access must be restricted to the specific resources each function needs. (3) All access must be audited. (4) The solution must support local development debugging. You have already enabled system-assigned managed identity for each function app. Which course of action should you take to meet the requirements?

Accepted Answer

Grant each function app's system-assigned managed identity access to Azure SQL Database using Microsoft Entra authentication (create contained user) and to Azure Storage using RBAC (Storage Blob Data Contributor role). Enable auditing on SQL and Storage. For local development, use Azure CLI to sign in with your developer account and assign it the same RBAC roles.. Option D is correct because it uses managed identity for Azure SQL (via Microsoft Entra authentication) and RBAC for Storage, satisfying no-secret requirement. It also enables auditing via Azure SQL Auditing and Storage analytics. For local development, you can use Azure CLI or Visual Studio with your developer account that has appropriate RBAC roles. Option A is wrong because it stores connection strings in Key Vault and uses Key Vault references, which still involves retrieving a secret (the connection string) even though it's not in code; the requirement says no secrets should be stored anywhere. Option B is wrong because it uses connection strings in Key Vault and then retrieves them. Option C is wrong because it uses a user-assigned identity but then stores connection strings in Key Vault.

Answer

Assign a user-assigned managed identity to each function app. Grant the identity access to Azure SQL via Microsoft Entra authentication and to Storage via RBAC. Use service principal for local development.

Answer

Use the system-assigned managed identity to access Key Vault, where you store the SQL connection string and storage account key. Use the Key Vault SDK in the function code to retrieve them. Enable Key Vault audit logging.

Answer

Store the SQL connection string and storage account key in Azure Key Vault. Use Key Vault references in function app settings to retrieve them at runtime. Enable Key Vault audit logging.

Question 14

You are developing a web application that will be deployed to Azure App Service. The application allows users to upload files, which are stored in Azure Blob Storage. You need to ensure that only authenticated users can upload files and that each user can only see their own files. You plan to use shared access signatures (SAS) for secure access. The application uses Microsoft Entra ID for authentication. You want to generate SAS tokens on the server after the user authenticates. Which approach should you use?

Accepted Answer

After user authentication, use the server-side code to generate a user delegation SAS for a specific blob container path that includes the user's identifier. Store the SAS in the user's session and return it to the client. The client then uses the SAS to upload the file directly to Blob Storage.. Option A is correct because generating a user delegation SAS with the user's identity ensures that the SAS token is scoped to that user. Storing the SAS in the user's session and returning it to the client for direct upload is secure and efficient. Option B is wrong because a service SAS is not tied to the user's identity and would allow cross-user access. Option C is wrong because using the storage account key directly from the server is a security risk and does not tie the SAS to the user. Option D is wrong because client-side generation of SAS tokens requires the storage account key to be exposed to the client.

Answer

After user authentication, have the client generate a SAS token using the storage account key retrieved from a secure endpoint.

Answer

After user authentication, use the server-side code to generate a service SAS for the entire blob container. Return the SAS to the client. The client uploads the file, and the server later moves the file to a user-specific folder.

Answer

After user authentication, use the server to upload the file to Blob Storage using the storage account key. Then return the URL of the uploaded blob to the client.

Question 15

You are deploying a multi-tier application: a frontend web app (Azure App Service) that calls a backend API (another Azure App Service). Both apps use Microsoft Entra ID for authentication. The frontend needs to authenticate to the backend on behalf of the signed-in user. You need to configure the OAuth 2.0 flow correctly. You have already registered both applications in Microsoft Entra ID. Which configuration should you apply?

Accepted Answer

In the frontend app registration, grant API permissions for the backend using the 'Delegated permissions' type. In the backend app registration, expose an API scope. The frontend uses the on-behalf-of flow (OBO) to exchange the user's token for a token to call the backend.. Option B is correct because the on-behalf-of flow (OBO) is designed for this scenario: the frontend receives a token for the user, then exchanges it for a token to call the backend. This requires exposing an API in the backend app registration and granting API permissions from the frontend. Option A is wrong because the client credentials flow is for non-interactive scenarios, not on behalf of a user. Option C is wrong because the authorization code flow alone does not allow the frontend to pass the user's identity to the backend. Option D is wrong because the implicit grant flow is deprecated.

Answer

In the frontend app registration, enable the implicit grant flow for access tokens. The frontend gets a token for the backend directly from the authorization endpoint.

Answer

In the frontend app registration, set the redirect URI to the backend URL. The frontend uses the authorization code flow to get a token for the backend directly.

Answer

In the frontend app registration, grant API permissions for the backend using the 'Application permissions' type. In the backend app registration, expose an API scope. The frontend uses the client credentials flow to get a token for the backend.