AZ-204 Implement Azure security Practice Test 11 — 15 Questions

Question 1

You are configuring a managed identity for an Azure App Service to access Azure Key Vault. The identity has been assigned, but the app receives a 403 Forbidden when trying to retrieve a secret. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The managed identity lacks an access policy or RBAC role in Key Vault. Azure Key Vault uses either access policies or Azure RBAC to authorize requests. When a managed identity is assigned to an App Service but no corresponding access policy or RBAC role (e.g., 'Key Vault Secrets User') is granted in Key Vault, the identity has no permissions to read secrets, resulting in a 403 Forbidden response. The 403 indicates the request reached Key Vault but was denied due to missing authorization.

Answer

The app is using the wrong endpoint

Answer

The managed identity is not enabled in the App Service

Answer

The Key Vault firewall is blocking the request

Question 2

You need to secure access to an Azure Storage account that hosts sensitive data. The requirement is to restrict access to only requests originating from a specific virtual network. Which feature should you configure?

Accepted Answer

Storage firewall and virtual network rules. D is correct because Azure Storage firewall and virtual network rules allow you to restrict access to your storage account to only requests originating from a specific virtual network. This is achieved by configuring a service endpoint or a private endpoint for the storage account, which ensures that traffic from the designated VNet is permitted while all other public internet traffic is blocked. This directly meets the requirement of restricting access to a specific virtual network.

Answer

Customer-managed keys (CMK)

Answer

Azure AD authentication

Answer

Shared access signatures (SAS)

Question 3

Your application uses Azure App Configuration with Microsoft Entra ID authentication. You want to ensure that only authorized services can read configuration values. What is the recommended approach?

Accepted Answer

Assign the App Configuration Data Reader role to the managed identity of the consuming service. The recommended approach for authorizing access to Azure App Configuration with Microsoft Entra ID is to use role-based access control (RBAC). By assigning the 'App Configuration Data Reader' role to a managed identity, you grant that specific service identity read-only access to configuration values without exposing keys or connection strings. This aligns with the principle of least privilege and eliminates the security risks associated with shared access keys.

Answer

Enable public network access only from trusted IPs

Answer

Use access keys and rotate them frequently

Answer

Store connection strings in Azure Key Vault and retrieve them at runtime

Question 4

You are deploying a containerized application to Azure Kubernetes Service (AKS). The application needs to access Azure SQL Database securely. Which approach should you use to avoid storing credentials in the container image?

Accepted Answer

Use Azure AD Pod Identity (Workload Identity) to assign a managed identity to the pod and authenticate to SQL. Azure AD Pod Identity (now evolved into Workload Identity) allows you to assign a managed identity to a pod, which can then authenticate to Azure SQL Database without any credentials stored in the image or environment variables. This approach uses Azure AD tokens obtained via the pod's identity, eliminating the need for connection strings or secrets in the container.

Answer

Store the connection string in a Kubernetes Secret and mount it as an environment variable

Answer

Use a service principal and store its credentials in Azure Key Vault, then use the Key Vault Secrets Store CSI driver

Answer

Hardcode the credentials in the Dockerfile

Question 5

You are designing a solution where an Azure Logic App needs to send emails via Microsoft Graph. The Logic App should authenticate without user interaction. What authentication method should you use?

Accepted Answer

Use a user-assigned managed identity and grant it the Mail.Send application permission. A user-assigned managed identity provides a secure, passwordless authentication method for Azure resources. By granting it the Mail.Send application permission (not delegated), the Logic App can authenticate to Microsoft Graph without any user interaction, as managed identities are automatically managed by Azure and do not require credential rotation or storage.

Answer

Use OAuth 2.0 authorization code grant with a user account

Answer

Use a service principal and store its client secret in the Logic App configuration

Answer

Use basic authentication with an email account password

Question 6

You need to ensure that secrets stored in Azure Key Vault are automatically rotated every 90 days. Which feature should you configure?

Accepted Answer

Use Key Vault secret rotation with Event Grid and Azure Functions. Azure Key Vault does not natively rotate secrets automatically. To achieve automatic rotation every 90 days, you must integrate Key Vault with Event Grid to detect secret expiration events and trigger an Azure Function that generates a new secret version and updates the expiration date. This pattern is the recommended solution for automated secret rotation.

Answer

Set an access policy for the secret

Answer

Enable soft delete and purge protection

Answer

Set a secret expiration date

Question 7

A company uses Azure App Service to host a web application. They need to ensure that only authenticated users from their Microsoft Entra ID tenant can access the app. They also want to prevent unauthenticated requests from reaching the app code. Which configuration should they implement?

Accepted Answer

Enable App Service Authentication with Microsoft Entra ID as the identity provider and set 'Action to take when request is not authenticated' to 'Log in with Microsoft Entra ID'.. Enabling App Service Authentication (EasyAuth) with Microsoft Entra ID as the identity provider and setting 'Action to take when request is not authenticated' to 'Log in with Microsoft Entra ID' ensures that all unauthenticated requests are redirected to Microsoft Entra ID for authentication before they reach the application code. This configuration blocks unauthenticated requests at the platform layer, preventing any unauthenticated traffic from hitting the app's runtime, which meets the requirement of keeping unauthenticated requests away from the app code.

Answer

Configure IP restrictions in the web.config to allow only the company's office IP range.

Answer

Implement a custom middleware in the app to validate tokens from Microsoft Entra ID.

Answer

Assign users to Microsoft Entra ID App Roles and check roles in the app.

Question 8

You are developing a serverless function app that processes credit card payments. The function app must securely store the payment gateway API key. Which Azure service should you use to store the key?

Accepted Answer

Store the key in Azure Key Vault and retrieve it using a managed identity.. Azure Key Vault is the designated service for securely storing and managing secrets, keys, and certificates. By using a managed identity, the function app can authenticate to Key Vault without embedding any credentials in code or configuration, ensuring the API key is never exposed in plaintext.

Answer

Store the key in an Azure Storage queue and read it at runtime.

Answer

Store the key in Azure Cosmos DB with client-side encryption.

Answer

Store the key in the function app's application settings.

Question 9

A company has an Azure Kubernetes Service (AKS) cluster. They want to ensure that pods can securely access Azure SQL Database without using connection strings or secrets. The solution must use the principle of least privilege. What should they implement?

Accepted Answer

Enable Azure AD Workload Identity for AKS and assign a managed identity to the pod that has access to Azure SQL Database.. Azure AD Workload Identity allows you to assign a user-assigned managed identity to a pod in AKS. This identity can be granted specific permissions (e.g., db_datareader) on Azure SQL Database using Azure AD authentication, eliminating the need for connection strings or secrets. The pod authenticates directly via the managed identity token, adhering to the principle of least privilege by scoping access to only the required database roles.

Answer

Use the Azure Key Vault Provider for Secrets Store CSI Driver to mount secrets into the pod.

Answer

Store the SQL connection string in a Kubernetes secret and mount it as a volume in the pod.

Answer

Configure Azure SQL Database firewall to allow the AKS cluster's IP addresses.

Question 10

You are developing an ASP.NET Core web app that will be deployed to Azure App Service. The app needs to authenticate users from a Microsoft Entra ID tenant. You want to minimize development effort and rely on platform features. What should you do?

Accepted Answer

Enable App Service Authentication in the Azure portal and configure Microsoft Entra ID as the identity provider.. Enabling App Service Authentication (also known as EasyAuth) in the Azure portal allows you to configure Microsoft Entra ID as the identity provider with minimal code changes. This approach leverages the platform's built-in authentication layer, which automatically handles token validation, session management, and redirects, thereby reducing development effort and relying on Azure's managed features.

Answer

Implement custom OAuth 2.0 middleware in the app.

Answer

Add Microsoft.Identity.Web NuGet package and configure it in Startup.cs to use Microsoft Entra ID.

Answer

Use Microsoft Entra ID App Roles and add role checks in the code.

Question 11

A company uses Azure Blob Storage to store sensitive documents. They want to ensure that data is encrypted at rest using customer-managed keys (CMK) stored in Azure Key Vault. They also need to be able to revoke access to the data immediately if a security breach is detected. Which feature should they enable?

Accepted Answer

Configure Azure Storage encryption with customer-managed keys in Azure Key Vault and enable soft delete and purge protection.. It combines customer-managed keys (CMK) in Azure Key Vault for encryption at rest with soft delete and purge protection, which allows immediate revocation of access by deleting or disabling the key in Key Vault. This ensures that the data becomes permanently inaccessible as Azure Storage relies on the CMK to encrypt/decrypt the data, and without the key, the data cannot be decrypted.

Answer

Enable infrastructure encryption for the storage account.

Answer

Use Azure Storage Service Encryption with Microsoft-managed keys.

Answer

Implement client-side encryption using Azure Key Vault.

Question 12

You are developing an API that will be hosted on Azure API Management (APIM). The API must be accessible only to clients that present a valid JSON Web Token (JWT) issued by Microsoft Entra ID. Which APIM policy should you use to validate the JWT?

Accepted Answer

. The policy in Azure API Management is specifically designed to enforce the presence and validity of a JSON Web Token (JWT) in incoming requests. By setting the header-name attribute to 'Authorization' and failed-validation-httpcode to '401', the policy checks that the JWT in the Authorization header is cryptographically signed by Microsoft Entra ID and has not expired, rejecting invalid or missing tokens with a 401 Unauthorized response.

Answer

Answer

<authenticate-basic />

Answer

<check-header name="Authorization" failed-check-httpcode="401" />

Question 13

A company is building a microservices application on Azure Container Instances. Each microservice needs to authenticate to Azure Key Vault to retrieve secrets. They want to avoid storing any credentials in the container images or environment variables. What should they do?

Accepted Answer

Enable managed identity for the container group and grant it access to Key Vault.. Azure Container Instances supports managed identities, allowing the container group to authenticate to Azure Key Vault without any credentials stored in the image or environment variables. By enabling a system-assigned or user-assigned managed identity on the container group and granting that identity the appropriate Key Vault access policy (e.g., 'Get' secret permission), the application can acquire an Azure AD token from the Instance Metadata Service (IMDS) endpoint and use it to retrieve secrets securely.

Answer

Use Docker secrets mounted as volumes.

Answer

Use a shared access signature (SAS) token to access Key Vault.

Answer

Store the Key Vault URI and a client secret in environment variables.

Question 14

You are deploying a web app to Azure App Service that must use a custom domain with TLS/SSL. You have purchased an SSL certificate from a third-party CA. How should you upload and bind the certificate to the custom domain?

Accepted Answer

Upload the .pfx file to the App Service TLS/SSL settings and bind it to the custom domain.. Azure App Service requires a .pfx file containing both the public certificate and the private key to bind a custom domain with TLS/SSL. The .pfx file is uploaded directly in the App Service's TLS/SSL settings, and then the certificate is bound to the custom domain, enabling HTTPS traffic.

Answer

Place the certificate files in the wwwroot folder of the app and configure the web.config.

Answer

Import the certificate into Azure Key Vault and reference it from App Service.

Answer

Upload the .cer file to the App Service and let Azure generate the private key.

Question 15

Which TWO actions should you take to securely store and access secrets for a legacy application that cannot be modified? The application runs on an Azure Virtual Machine and needs to read a database connection string. The solution must use Azure Key Vault and adhere to the principle of least privilege.

Accepted Answer

Configure the application to read the connection string from a local file that is updated by the Key Vault extension.. The legacy application cannot be modified, so it cannot directly call the Key Vault REST API or SDK. The Azure Key Vault VM extension (also known as the Key Vault Sync extension) runs as a daemon on the VM, retrieves secrets from Key Vault using a managed identity, and writes them to a local file. The application reads the connection string from that local file, achieving secure secret access without code changes.

Answer

Create a new VM and install the Key Vault extension during provisioning.

Answer

Assign a managed identity to the legacy application.

Answer

Use a user-assigned managed identity and assign it to the VM.