AZ-204 Implement Azure security Practice Test 2 — 15 Questions

Question 1

Which THREE of the following are valid ways to authenticate an Azure Function to an Azure SQL Database using managed identities?

Accepted Answer

Enable system-assigned managed identity on the function app and grant it access to the SQL database.. Enabling a system-assigned managed identity on the function app (Option A) creates an Azure AD identity tied to the function app. Alternatively, you can create a user-assigned managed identity and assign it to the function app (Option D). In both scenarios, once the function app has a managed identity, you grant that identity access to the SQL database by using the managed identity's principal ID to create a contained database user mapped to the managed identity (Option C). This allows the function to authenticate via Azure AD token-based authentication without storing credentials.

Answer

Assign the managed identity directly to the Azure SQL Database logical server.

Answer

Create a service principal and assign it to the function app.

Question 2

A company is designing a secure microservices architecture on Azure Kubernetes Service (AKS). The security requirements include: encrypting secrets at rest and in transit, rotating secrets automatically, and avoiding hard-coded credentials in application code. Which THREE solutions should the company use? (Choose three.)

Accepted Answer

Use the Azure Key Vault CSI Driver to mount secrets as volumes in pods.. The Azure Key Vault CSI Driver enables pods to mount secrets from Azure Key Vault as volumes, ensuring secrets are never hard-coded in application code. Storing secrets in Azure Key Vault (D) provides encryption at rest and critical features like soft-delete and purge protection. AKS-managed Microsoft Entra ID integration with pod managed identities (E) allows pods to securely authenticate to Key Vault without hard-coded credentials. This combined approach encrypts secrets at rest (in Key Vault) and in transit (via HTTPS), and supports automatic rotation by syncing with Key Vault's versioned secrets without requiring application restarts.

Answer

Inject secrets as environment variables from ConfigMaps.

Answer

Use Kubernetes Secrets with a scheduled CronJob to rotate them.

Question 3

A company uses Azure Functions to process sensitive customer data. The functions are triggered by Service Bus messages. The security requirements mandate that all function code must be encrypted in transit and at rest, and that access to the function must be authenticated using Microsoft Entra ID. Which TWO configurations should be implemented? (Choose two.)

Accepted Answer

Configure the function app's authentication to 'Microsoft Entra ID' with 'Require authentication' set to 'On'.. Enabling Microsoft Entra ID authentication with 'Require authentication' set to 'On' ensures that only authenticated identities can invoke the function, meeting the access control requirement. This integrates directly with the function app's built-in authentication/authorization layer, which validates tokens from Microsoft Entra ID before the function code runs. Setting the function app's 'HTTPS Only' to 'On' enforces that all communication with the function app occurs over HTTPS, thereby ensuring encryption of data in transit.

Answer

Enable 'App Service Authentication' and set the action to 'Allow anonymous requests'.

Answer

Use Service Bus managed identity with access keys for authentication.

Answer

Set the function app's 'HTTP version' to 'HTTP/2' to improve encryption.

Question 4

You are developing a serverless application using Azure Functions that processes sensitive data. The function is triggered by an Azure Storage queue. You need to ensure that data in transit between the function and the storage account is encrypted using a customer-managed key (CMK) and that the storage account's firewall only allows access from the function's virtual network. Which two actions should you take? (Choose two.)

Accepted Answer

Configure the storage account firewall to allow access only from the function's virtual network.. The stem incorrectly states that data in transit between the function and storage account can be encrypted using a customer-managed key (CMK). CMK is for encryption at rest. Data in transit is secured via TLS/HTTPS using platform-managed keys. Option C, 'Enable 'Secure transfer required' on the storage account,' enforces HTTPS, ensuring in-transit encryption. Option B, 'Configure the storage account firewall to allow access only from the function's virtual network,' directly addresses the network access restriction. While enabling VNet integration on the function app (Option D) is a necessary prerequisite action for the function to utilize the virtual network, Option B is the specific action on the storage account to enforce the firewall rule. Given the ambiguity, if the question intends to focus on direct actions on the storage account for both requirements, B and C would be chosen.

Answer

Configure a customer-managed key in Azure Key Vault and associate it with the storage account.

Answer

Enable VNet integration on the function app to route traffic through a virtual network.

Question 5

You are designing a solution to store secrets for a microservices application running on Azure Kubernetes Service (AKS). The secrets must be automatically rotated and remain available if the Key Vault is temporarily unavailable. Which TWO options meet the requirements?

Accepted Answer

Use the AKS add-on for Azure Key Vault (Secrets Store CSI driver) with a sync to Kubernetes secrets.. The AKS add-on for Azure Key Vault (Secrets Store CSI driver) can sync secrets to Kubernetes secrets, ensuring they remain available as cached copies even if Key Vault is temporarily unreachable. The driver polls Key Vault for changes, meeting the automatic rotation requirement. Similarly, deploying a sidecar container that periodically retrieves secrets from Key Vault and stores them in a shared volume also meets both requirements: the sidecar handles automatic rotation by polling, and the shared volume ensures availability even if Key Vault is temporarily down.

Answer

Have each microservice read secrets directly from Key Vault using the SDK.

Answer

Assign a managed identity to each pod and use it to authenticate to Key Vault.

Answer

Store secrets as plain text in Kubernetes secrets.

Question 6

You are a security engineer for a large enterprise that uses Microsoft Entra ID. The company deploys a custom web application in Azure that authenticates users via the OAuth 2.0 authorization code flow with PKCE. The application is registered in Microsoft Entra ID. Recently, security auditors discovered that a compromised client secret was used to obtain tokens without user consent. You must update the application registration to prevent this type of attack. The application should still work with the authorization code flow and PKCE. You need to ensure that only interactive user authentication can obtain tokens, and that client secrets cannot be used to request tokens directly. Which option meets these requirements?

Accepted Answer

Remove the client secret from the app registration and configure the application to use a client certificate for authentication. Set the application type to 'Public client/native' and disable 'Allow public client flows' (if needed).. To prevent a compromised client secret from being used to obtain tokens without user consent, the application must be configured as a public client. Public clients (like native or single-page applications) cannot securely store client secrets or certificates. Therefore, the client secret must be removed. For a public client to use the authorization code flow with PKCE, the application type must be set to 'Public client/native' and 'Allow public client flows' must be explicitly enabled in the app registration. This ensures that tokens can only be obtained through an interactive user flow, secured by PKCE, without relying on a shared secret.

Answer

Keep the client secret but enable 'Allow public client flows' and set the redirect URI to use a custom scheme.

Answer

Change the authentication flow to client credentials grant and assign a managed identity to the application.

Answer

Increase the client secret expiration to 2 years and rotate the secret monthly.

Question 7

You have multiple Azure virtual machines that need to access the same Azure Key Vault to retrieve certificates. You want to minimize administrative overhead while ensuring each VM can authenticate without managing credentials. Which identity type should you use?

Accepted Answer

User-assigned managed identity assigned to each VM. A user-assigned managed identity can be created once and then assigned to multiple Azure VMs, allowing all of them to authenticate to the same Key Vault without storing any credentials. This minimizes administrative overhead compared to managing separate system-assigned identities or service principals, as the identity is independent of any single VM's lifecycle and can be reused across resources.

Answer

System-assigned managed identity on each VM

Answer

Service principal with client secret stored in each VM

Answer

Storage account key

Question 8

A developer accidentally deleted a secret from Azure Key Vault. Soft-delete is enabled with a retention period of 90 days. After 60 days, you attempt to recover the secret. What should you do?

Accepted Answer

Run the Azure CLI command: az keyvault secret recover. When soft-delete is enabled on Azure Key Vault, deleted secrets are retained for the specified retention period (90 days in this case). Since only 60 days have passed, the secret is still in a soft-deleted state and can be recovered using the `az keyvault secret recover` command, which restores the secret to an active state.

Answer

Enable purge protection on the Key Vault first, then recover the secret.

Answer

Recover is not possible because the retention period of 90 days has not elapsed.

Answer

Run the Azure CLI command: az keyvault secret undelete

Question 9

A company stores sensitive data in an Azure Storage account. They need to restrict access based on the client's IP address and require that clients use a valid SAS token. Which mechanism should they use?

Accepted Answer

SAS token with IP ACL.. A SAS token with an IP ACL (access control list) allows you to restrict access to a specific client IP address or range of IP addresses while also requiring a valid SAS token for authentication. This meets both requirements: IP-based restriction and SAS token validation. The IP ACL is specified as part of the SAS token's signed IP (sip) parameter, which enforces that requests must originate from the allowed IP range.

Answer

Microsoft Entra ID authentication.

Answer

Shared Key.

Answer

Firewall and virtual networks.

Question 10

You are developing an application that stores user secrets. You need to ensure that the secrets are encrypted at rest and rotated automatically. Which Azure service should you integrate?

Accepted Answer

Azure Key Vault.. Azure Key Vault is the correct choice because it provides centralized management of secrets, keys, and certificates with built-in encryption at rest using FIPS 140-2 Level 2 validated hardware security modules (HSMs). It also supports automatic rotation of secrets through integration with Azure Event Grid and Azure Functions, enabling you to schedule or trigger key rotation policies without manual intervention.

Answer

Azure Storage.

Answer

Azure Security Center.

Answer

Microsoft Entra ID.

Question 11

You have an Azure Function app that needs to retrieve a secret from Azure Key Vault at runtime. You want to avoid storing any credentials in code or configuration. Which mechanism should you use?

Accepted Answer

Managed identity. Managed identity (B) is the correct mechanism because it allows the Azure Function app to authenticate to Azure Key Vault without storing any credentials in code or configuration. Azure automatically manages the identity and provides a token from Azure AD that the function can use to access the vault, eliminating the need for secrets or keys in the application.

Answer

Service principal with client secret

Answer

Access key

Answer

Shared access signature (SAS)

Question 12

A developer deleted a secret from Azure Key Vault with soft-delete and purge protection enabled (retention 90 days). After 50 days, the secret is needed again. What is the correct recovery method?

Accepted Answer

Recover the secret using Azure CLI 'az keyvault secret recover'. Azure Key Vault with soft-delete and purge protection enabled retains deleted secrets for the specified retention period (90 days in this case). Since only 50 days have passed, the secret is still in a soft-deleted state and can be recovered using the 'az keyvault secret recover' command, which restores the secret to its original state without data loss.

Answer

Purge the secret and then restore from a backup

Answer

Recreate the secret with the same name

Answer

Use an Azure Resource Manager template to undelete the secret

Question 13

A developer needs to grant an Azure Function read access to secrets in Azure Key Vault without storing any credentials in the function code or configuration. Which approach should they use?

Accepted Answer

Managed identity. Managed identity (B) is the correct approach because it allows the Azure Function to authenticate to Azure Key Vault without storing any credentials in code or configuration. Azure automatically manages the identity, and the function can obtain an access token from Azure AD to read secrets, eliminating the need for secrets, certificates, or keys in the application.

Answer

Service principal with a certificate

Answer

Access policy with a client secret

Answer

Shared access signature (SAS)

Question 14

A company has an Azure Storage account that stores sensitive data. They need to ensure that all access to the storage account is secured using Microsoft Entra ID authentication and that no storage account keys are used. Which configuration should be applied to enforce this?

Accepted Answer

Disable shared key access. Disabling shared key access (Option B) is the correct configuration because it explicitly blocks all authentication using storage account keys (both primary and secondary), forcing all requests to use Microsoft Entra ID (formerly Azure AD) for authorization. This ensures that only identities with appropriate RBAC roles (e.g., Storage Blob Data Owner) can access the storage account, meeting the requirement to eliminate key-based access entirely.

Answer

Enable firewall rules

Answer

Enable advanced threat protection

Answer

Enable soft delete

Question 15

A company stores secrets (e.g., connection strings) in Azure Key Vault and needs them automatically rotated every 90 days. Which solution should they implement?

Accepted Answer

Use Event Grid to trigger an Azure Function or Automation runbook that rotates the secret. Azure Key Vault does not natively support automatic secret rotation; you must implement a custom solution using Event Grid to detect expiration events and trigger an Azure Function or Automation runbook that generates a new secret and updates the vault. This pattern leverages Key Vault's eventing capabilities to automate the rotation workflow without manual intervention.

Answer

Configure Key Vault access policies to enforce rotation

Answer

Enable Key Vault firewall to limit access

Answer

Enable soft-delete on the vault