AZ-204 Implement Azure security Practice Test 2 — 15 Questions

Question 1

Your company uses Azure Key Vault to manage encryption keys for data at rest in Azure Storage. You need to ensure that the storage account uses a customer-managed key (CMK) stored in Key Vault. Additionally, you need to periodically rotate the key automatically. Which configuration should you implement?

Accepted Answer

Create a key in Key Vault, assign the storage account's managed identity access to that key, and configure a Key Vault rotation policy to automatically rotate the key regularly. Option A is correct because it combines the three essential elements for using a customer-managed key (CMK) with automatic rotation in Azure Key Vault. First, you must create a key in Key Vault (not use the default system-managed key). Second, the storage account's managed identity must be granted 'Get', 'Unwrap Key', and 'Wrap Key' permissions on that key so it can encrypt/decrypt the storage account's root key. Third, you configure a Key Vault rotation policy (using the Azure Key Vault key rotation feature) to automatically create new key versions on a schedule (e.g., every 90 days), which the storage account automatically picks up without manual intervention.

Answer

Enable soft-delete and purge protection on the Key Vault to allow key recovery during rotation

Answer

Use Azure Key Vault's default key (system-managed) and rely on built-in rotation

Answer

Manually rotate the key every 90 days by generating a new version and updating the storage account

Question 2

Your company uses Azure App Service to host a web application. You need to allow only authenticated users from your Microsoft Entra ID tenant to access the app, without writing any authentication code. Which feature should you configure?

Accepted Answer

Azure App Service Authentication (EasyAuth) with Microsoft Entra ID as identity provider.. Azure App Service Authentication (EasyAuth) is the correct feature because it provides a built-in, code-free way to authenticate users by integrating with Microsoft Entra ID (formerly Azure AD). When configured, the App Service automatically validates tokens and redirects unauthenticated users to the identity provider, enforcing authentication at the platform level without requiring any changes to the application code.

Answer

IP restrictions in the app’s web.config.

Answer

Client certificate authentication.

Answer

Shared access signatures (SAS) for the app URL.

Question 3

Your company stores secrets in Azure Key Vault. You need to ensure that when a secret is disabled, it does not become accessible to applications that already have a cached copy. Which additional step must you take?

Accepted Answer

Rotate the secret immediately. When a secret is disabled in Azure Key Vault, the vault itself will reject new access requests, but applications that have already retrieved and cached the secret can continue using it until the cache expires or is refreshed. To immediately invalidate the cached copy, you must rotate the secret (change its value) so that any subsequent attempt to use the old cached value fails because it no longer matches the secret stored in Key Vault. Disabling alone does not force applications to re-authenticate or re-fetch; rotation ensures the cached value becomes obsolete.

Answer

Delete the secret

Answer

Enable soft-delete and purge protection

Answer

Use Key Vault access policies to deny access

Question 4

You are developing a web API that must authenticate requests using Microsoft Entra ID (Microsoft Entra ID) and OAuth 2.0 bearer tokens. You want to validate the token in your API code. Which library should you use?

Accepted Answer

Microsoft.Identity.Web. Microsoft.Identity.Web is the recommended library for integrating ASP.NET Core web APIs with Microsoft Entra ID. It provides built-in token validation, policy enforcement, and handles the OAuth 2.0 bearer token flow, including JWT validation, issuer signing keys, and audience checks, without requiring manual configuration of middleware.

Answer

Microsoft Authentication Library (MSAL)

Answer

ADAL.NET

Answer

Azure.Identity

Question 5

You are developing a web API hosted on Azure App Service. The API must authenticate requests using Microsoft Entra ID OAuth 2.0 bearer tokens. You want to validate the token in your ASP.NET Core API code with minimal custom validation logic. Which library should you use?

Accepted Answer

Microsoft.Identity.Web. Microsoft.Identity.Web is the correct choice because it provides a high-level, opinionated library that integrates directly with ASP.NET Core's authentication pipeline, handling token validation, scopes, and app roles with minimal custom code. It abstracts away the complexity of JWT bearer token validation against Microsoft Entra ID, including automatic OpenID Connect discovery and token signature verification.

Answer

Microsoft Authentication Library (MSAL)

Answer

Azure Identity client library

Answer

Azure Management Libraries for .NET

Question 6

Your company uses Azure Key Vault to store secrets. You need to ensure that only a specific Microsoft Entra ID application can read a particular secret, while other applications are denied access. You want to apply the principle of least privilege. Which access control method should you configure?

Accepted Answer

Assign the application to the Key Vault Secrets User RBAC role at the secret scope. Option B is correct because Azure RBAC allows you to assign the Key Vault Secrets User role at the secret scope, which grants read access exclusively to the specified Microsoft Entra ID application for that particular secret. This aligns with the principle of least privilege by restricting access to only the necessary secret, without granting broader permissions at the vault level.

Answer

Assign the application to the Key Vault Contributor RBAC role

Answer

Use Key Vault access policies

Answer

Use managed identity and assign the Key Vault Secrets User role at the vault scope

Question 7

You need to restrict access to an Azure Storage account so that only a specific subnet of a virtual network can access the data. Additionally, you need to allow management access from the Azure portal (e.g., to view containers). Which configuration should you apply?

Accepted Answer

Configure a service endpoint for Microsoft.Storage on the subnet and add a firewall rule to allow the subnet, then enable 'Allow trusted Microsoft services'.. Option B is correct because configuring a service endpoint for Microsoft.Storage on the subnet ensures traffic from that subnet to the storage account stays within the Azure backbone, and the firewall rule restricts access to that subnet. Enabling 'Allow trusted Microsoft services' permits Azure portal management operations (e.g., listing containers) because the portal is a trusted service that bypasses the network rules for control-plane actions.

Answer

Configure IP firewall rules to allow the subnet IP range and add the Azure portal's public IP addresses.

Answer

Configure a private endpoint for the storage account and disable public network access.

Answer

Configure IP ACLs to allow the subnet and also allow all Azure services.

Question 8

You are developing an ASP.NET Core web API that authenticates users via Microsoft Entra ID. The application needs to authorize access to resources based on custom roles (e.g., 'Admin', 'Editor') that are not present in Microsoft Entra ID. The role mappings are dynamic and stored in an application database. How should you implement authorization?

Accepted Answer

Store the role mappings in an Azure SQL Database and use a custom authorization policy that queries the database after authentication.. Option B is correct because the custom roles are dynamic and stored in an application database, not in Microsoft Entra ID. After authentication, a custom authorization policy can query the database to retrieve the role mappings for the authenticated user and enforce access control. This approach decouples role management from the identity provider and supports dynamic role assignments.

Answer

Define the roles as Microsoft Entra ID app roles and include them in the token claims.

Answer

Include the roles as claims in the Microsoft Entra ID token by using a custom claim mapping policy.

Answer

Store the role mappings in the web.config file and read them at runtime.

Question 9

You are developing an ASP.NET Core web API that authenticates users via Microsoft Entra ID. The API needs to call a downstream API (also secured by Microsoft Entra ID) on behalf of the signed-in user (On-Behalf-Of flow). You have already configured the web API to authenticate users with Microsoft.Identity.Web. How should you implement the token acquisition for the downstream API?

Accepted Answer

Inject `ITokenAcquisition` and call `GetAccessTokenForUserAsync` with the scopes for the downstream API. Option B is correct because Microsoft.Identity.Web provides the `ITokenAcquisition` service specifically for ASP.NET Core applications to acquire tokens for downstream APIs using the OAuth 2.0 On-Behalf-Of flow. Calling `GetAccessTokenForUserAsync` with the required scopes handles the token exchange automatically, leveraging the incoming user token and client credentials configured in the app. This is the recommended approach when using Microsoft.Identity.Web, as it abstracts the complexity of the OBO flow and integrates seamlessly with the ASP.NET Core authentication pipeline.

Answer

Use ADAL.NET's `AcquireTokenOnBehalfOf` method

Answer

Use the `Azure.Identity` library with `DefaultAzureCredential` to acquire a token

Answer

Manually construct an HTTP POST to the Microsoft Entra ID token endpoint with the user access token and client credentials

Question 10

You are developing an ASP.NET Core web API that is hosted on Azure App Service. The API needs to read secrets from Azure Key Vault at startup. You want to avoid storing any credentials in the application code or configuration. Which approach should you use?

Accepted Answer

Enable the system-assigned managed identity for the App Service and configure Key Vault access policies to allow that identity.. Option B is correct because enabling a system-assigned managed identity for the App Service allows it to authenticate to Azure Key Vault without any credentials stored in code or configuration. The managed identity is automatically managed by Azure AD (now Microsoft Entra ID) and can be granted access to Key Vault secrets via access policies, eliminating the need for client IDs, client secrets, or connection strings.

Answer

Use the Key Vault SDK with a client ID and client secret stored in App Service application settings.

Answer

Use Microsoft Entra ID application roles to assign the App Service a role that allows reading secrets.

Answer

Store the Key Vault URL and a connection string with the secret in the application's app.config file.

Question 11

You are designing an ASP.NET Core web API that authenticates users via Microsoft Entra ID. The application needs to authorize access to resources based on custom roles (e.g., 'Admin', 'Editor') that are not defined in Microsoft Entra ID app roles or groups. The role mappings are dynamic and stored in an application database. How should you implement authorization in the API?

Accepted Answer

Use the OnTokenValidated event in OpenID Connect middleware to query the database and add custom role claims to the identity.. Option B is correct because it uses the OnTokenValidated event in OpenID Connect middleware to enrich the user's identity with custom role claims from the application database after token validation. This approach allows dynamic role mappings stored externally to be injected into the ClaimsPrincipal, which can then be evaluated by the standard [Authorize] attribute with role policies. It avoids modifying Entra ID configuration and keeps role management flexible within the application.

Answer

Define the roles as Microsoft Entra ID app roles and assign them to users. This is the standard way to handle roles.

Answer

Store the roles in the Microsoft Entra ID token by customizing the token issuance in Microsoft Entra ID.

Answer

Use the [Authorize] attribute with a custom authorization filter that checks the database on every request without modifying the claims.

Question 12

You are developing an ASP.NET Core web app that uses Azure SQL Database. The SQL connection string contains a password that must be rotated every 30 days. The app runs on Azure App Service. You want to store the connection string securely and enable automatic rotation without redeploying the app. Which approach should you use?

Accepted Answer

Store the connection string in an App Setting and use Key Vault references. Configure a Key Vault policy to automatically rotate the secret.. Option A is correct because Azure App Service supports Key Vault references in App Settings, allowing you to securely store the connection string in Key Vault and reference it without exposing the password. By configuring a Key Vault policy to automatically rotate the secret (e.g., using a scheduled rotation or event-driven trigger), the password can be rotated every 30 days without redeploying the app, as the App Service runtime resolves the reference at runtime.

Answer

Store the connection string in an App Setting as a plain text value and use deployment slots to swap when the password changes.

Answer

Use a managed identity to access the SQL database directly, bypassing the connection string entirely.

Answer

Store the connection string in Azure Key Vault and use an ARM template with a secret reference at deployment time.

Question 13

You are using Azure API Management (APIM) to expose a REST API. The backend API requires mutual TLS (client certificate) for authentication. The client certificate is stored in Azure Key Vault. You need to configure APIM to use this certificate when calling the backend, without exposing the certificate contents in the policy files. Which APIM feature and policy should you use?

Accepted Answer

Use the authentication-certificate policy with a named value that references the Key Vault certificate.. Option A is correct because the `authentication-certificate` policy in Azure API Management can reference a client certificate stored in Azure Key Vault via a named value. Named values securely store secrets and can point to Key Vault certificates without exposing the certificate contents in policy files. This allows APIM to present the certificate during mutual TLS authentication to the backend API.

Answer

Use the authentication-managed-identity policy to authenticate to the backend.

Answer

Upload the client certificate directly to APIM's Certificate store and reference it in the policy.

Answer

Use a JavaScript policy to fetch the certificate from Key Vault and attach it.

Question 14

You are developing an ASP.NET Core web API hosted on Azure App Service. The API needs to read secrets from Azure Key Vault at startup. You have enabled a system-assigned managed identity for the App Service. Which code should you use to create the Key Vault SecretClient?

Accepted Answer

new SecretClient(new Uri(keyVaultUrl), new DefaultAzureCredential()). Option A is correct because `DefaultAzureCredential` automatically attempts to authenticate using the environment's managed identity when running on Azure App Service. Since a system-assigned managed identity is enabled, `DefaultAzureCredential` will chain through available credential sources and successfully use the managed identity endpoint to obtain a token for Key Vault, without requiring any explicit tenant ID, client ID, or secret.

Answer

new SecretClient(new Uri(keyVaultUrl), new ClientSecretCredential(tenantId, clientId, clientSecret))

Answer

new SecretClient(new Uri(keyVaultUrl), new ChainedTokenCredential())

Answer

new SecretClient(new Uri(keyVaultUrl), new InteractiveBrowserCredential())

Question 15

You have an Azure App Service web app that uses a system-assigned managed identity. The app needs to read a secret stored in Azure Key Vault. You need to grant the app the minimum required permissions to access the secret. Which RBAC role should you assign to the managed identity at the Key Vault scope?

Accepted Answer

Key Vault Secrets User. The Key Vault Secrets User role grants the minimum required permission to read secrets from Azure Key Vault. This role provides the 'Microsoft.KeyVault/vaults/secrets/getSecret/action' permission, which is exactly what the app needs to retrieve the secret value. It does not grant any write or management capabilities, adhering to the principle of least privilege.

Answer

Key Vault Reader

Answer

Key Vault Secrets Officer

Answer

Contributor