AZ-204 Implement Azure security Practice Test 3 — 15 Questions

Question 1

Your company uses Azure Key Vault to store secrets. You need to ensure that if a secret is deleted, it can be recovered within 30 days. Which Key Vault feature should you enable?

Accepted Answer

Soft-delete. Soft-delete is the correct feature because it allows you to recover a deleted secret within a configurable retention period (default 90 days, but can be set to as low as 1 day). When soft-delete is enabled, a deleted secret is marked as deleted but remains recoverable until the retention period expires. This directly meets the requirement to recover a secret within 30 days.

Answer

Purge protection

Answer

RBAC (Role-Based Access Control)

Answer

Access policies

Question 2

Your company stores sensitive documents in an Azure Storage account. You need to ensure that only authorized Microsoft Entra ID users can read the documents, and that shared keys (account access keys) cannot be used. Which two steps must you take? (Choose the most appropriate single answer that describes the combined action.)

Accepted Answer

Disable shared key access and configure RBAC roles for Microsoft Entra ID users. To ensure that only authorized Microsoft Entra ID users can read documents and that shared keys cannot be used, you must disable shared key access and configure RBAC roles to authorize specific users. Option A does exactly that. Option D disables shared key access but uses user-delegation SAS tokens, which can be used by anyone possessing the token, not only authorized Entra ID users. Therefore, only option A fully meets the requirement.

Answer

Enable Microsoft Entra ID authentication and use SAS tokens with a stored access policy

Answer

Enable firewall and virtual network service endpoints, then assign RBAC roles

Answer

Use user-delegation SAS tokens and disable shared key access

Question 3

You deploy a web application in Azure App Service. You need to authenticate users via Microsoft Entra ID (Microsoft Entra ID) with minimal custom code. Which App Service feature should you configure?

Accepted Answer

App Service Authentication (Easy Auth). App Service Authentication (also known as Easy Auth) is the correct choice because it provides a turnkey authentication layer that integrates directly with Microsoft Entra ID. It requires minimal custom code by handling the OAuth 2.0 authorization code flow, token validation, and session management at the App Service platform level, allowing you to simply configure the identity provider in the Azure portal.

Answer

Microsoft Entra ID B2C

Answer

Application Gateway with WAF

Answer

App Service Managed Identity

Question 4

Your company stores API keys and connection strings in Azure Key Vault. You need to grant an Azure Function read access to these secrets using the principle of least privilege. Which identity type should you assign to the Function App?

Accepted Answer

System-assigned managed identity. A system-assigned managed identity is the correct choice because it is directly tied to the lifecycle of the Azure Function, automatically managed by Azure, and requires no manual credential rotation. It provides the most restrictive scope (only that specific Function App) and adheres to the principle of least privilege by granting access only to the identity that needs it, without the overhead of managing a separate identity or service principal.

Answer

User-assigned managed identity

Answer

Service principal

Answer

Access policy on the Key Vault

Question 5

You are developing an Azure Function that reads secrets from Azure Key Vault. The function must not use any static credentials in configuration files. You need to authenticate to Key Vault using the function's own identity. Which Azure service feature should you enable?

Accepted Answer

Assign a managed identity to the function app and grant it access to the Key Vault. Azure Functions can use a system-assigned or user-assigned managed identity to authenticate to Azure Key Vault without storing any static credentials. When enabled, the function app obtains an Azure AD token from the Managed Identity endpoint (169.254.169.254) and uses it to access Key Vault secrets, eliminating the need for connection strings, keys, or certificates in configuration files.

Answer

Use storage account access keys to authenticate to Key Vault

Answer

Generate a shared access signature (SAS) token for the Key Vault

Answer

Create a service principal and store its certificate in the function app's local storage

Question 6

Your company stores customer payment data in an Azure SQL Database. You need to ensure that only the application's managed identity can access the database, and no SQL logins or passwords are used. Which authentication method should you configure?

Accepted Answer

Use Microsoft Entra ID authentication with the managed identity configured as a contained database user. Configuring the managed identity as a contained database user in Azure SQL Database using Microsoft Entra ID authentication allows the application to authenticate without any SQL logins or passwords. The managed identity provides an automatically managed service principal in Entra ID, which can be mapped to a contained database user (CREATE USER [<identity-name>] FROM EXTERNAL PROVIDER). This enables token-based authentication using OAuth 2.0, ensuring that only the application's identity can access the database.

Answer

SQL Server authentication with a strong password stored in Key Vault

Answer

Enable Transparent Data Encryption (TDE) and use the database's certificate

Answer

Configure the Azure SQL firewall to allow only the application's outbound IP

Question 7

Your company uses Azure Key Vault to manage encryption keys for data at rest in Azure Storage. You need to ensure that the storage account uses a customer-managed key (CMK) stored in Key Vault. Additionally, you need to periodically rotate the key automatically. Which configuration should you implement?

Accepted Answer

Create a key in Key Vault, assign the storage account's managed identity access to that key, and configure a Key Vault rotation policy to automatically rotate the key regularly. It combines the three essential elements for using a customer-managed key (CMK) with automatic rotation in Azure Key Vault. First, you must create a key in Key Vault (not use the default system-managed key). Second, the storage account's managed identity must be granted 'Get', 'Unwrap Key', and 'Wrap Key' permissions on that key so it can encrypt/decrypt the storage account's root key. Third, you configure a Key Vault rotation policy (using the Azure Key Vault key rotation feature) to automatically create new key versions on a schedule (e.g., every 90 days), which the storage account automatically picks up without manual intervention.

Answer

Enable soft-delete and purge protection on the Key Vault to allow key recovery during rotation

Answer

Use Azure Key Vault's default key (system-managed) and rely on built-in rotation

Answer

Manually rotate the key every 90 days by generating a new version and updating the storage account

Question 8

Your company uses Azure App Service to host a web application. You need to allow only authenticated users from your Microsoft Entra ID tenant to access the app, without writing any authentication code. Which feature should you configure?

Accepted Answer

Azure App Service Authentication (EasyAuth) with Microsoft Entra ID as identity provider.. Azure App Service Authentication (EasyAuth) is the correct feature because it provides a built-in, code-free way to authenticate users by integrating with Microsoft Entra ID (formerly Azure AD). When configured, the App Service automatically validates tokens and redirects unauthenticated users to the identity provider, enforcing authentication at the platform level without requiring any changes to the application code.

Answer

IP restrictions in the app’s web.config.

Answer

Client certificate authentication.

Answer

Shared access signatures (SAS) for the app URL.

Question 9

Your company stores secrets in Azure Key Vault. You need to ensure that when a secret is disabled, it does not become accessible to applications that already have a cached copy. Which additional step must you take?

Accepted Answer

Rotate the secret immediately. When a secret is disabled in Azure Key Vault, the vault itself will reject new access requests, but applications that have already retrieved and cached the secret can continue using it until the cache expires or is refreshed. To immediately invalidate the cached copy, you must rotate the secret (change its value) so that any subsequent attempt to use the old cached value fails because it no longer matches the secret stored in Key Vault. Disabling alone does not force applications to re-authenticate or re-fetch; rotation ensures the cached value becomes obsolete.

Answer

Delete the secret

Answer

Enable soft-delete and purge protection

Answer

Use Key Vault access policies to deny access

Question 10

You are developing a web API that must authenticate requests using Microsoft Entra ID (Microsoft Entra ID) and OAuth 2.0 bearer tokens. You want to validate the token in your API code. Which library should you use?

Accepted Answer

Microsoft.Identity.Web. Microsoft.Identity.Web is the recommended library for integrating ASP.NET Core web APIs with Microsoft Entra ID. It provides built-in token validation, policy enforcement, and handles the OAuth 2.0 bearer token flow, including JWT validation, issuer signing keys, and audience checks, without requiring manual configuration of middleware.

Answer

Microsoft Authentication Library (MSAL)

Answer

ADAL.NET

Answer

Azure.Identity

Question 11

You are developing a web API hosted on Azure App Service. The API must authenticate requests using Microsoft Entra ID OAuth 2.0 bearer tokens. You want to validate the token in your ASP.NET Core API code with minimal custom validation logic. Which library should you use?

Accepted Answer

Microsoft.Identity.Web. Microsoft.Identity.Web is the correct choice because it provides a high-level, opinionated library that integrates directly with ASP.NET Core's authentication pipeline, handling token validation, scopes, and app roles with minimal custom code. It abstracts away the complexity of JWT bearer token validation against Microsoft Entra ID, including automatic OpenID Connect discovery and token signature verification.

Answer

Microsoft Authentication Library (MSAL)

Answer

Azure Identity client library

Answer

Azure Management Libraries for .NET

Question 12

Your company uses Azure Key Vault to store secrets. You need to ensure that if a secret is deleted, it can be recovered within 30 days. Which Key Vault feature should you enable?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Assign the application to the Key Vault Secrets User RBAC role at the secret scope. Azure RBAC allows you to assign the Key Vault Secrets User role at the secret scope, which grants read access exclusively to the specified Microsoft Entra ID application for that particular secret. This aligns with the principle of least privilege by restricting access to only the necessary secret, without granting broader permissions at the vault level.

Answer

Assign the application to the Key Vault Contributor RBAC role

Answer

Use Key Vault access policies

Answer

Use managed identity and assign the Key Vault Secrets User role at the vault scope

Question 13

You need to restrict access to an Azure Storage account so that only a specific subnet of a virtual network can access the data. Additionally, you need to allow management access from the Azure portal (e.g., to view containers). Which configuration should you apply?

Accepted Answer

Configure a service endpoint for Microsoft.Storage on the subnet and add a firewall rule to allow the subnet, then enable 'Allow trusted Microsoft services'.. Configuring a service endpoint for Microsoft.Storage on the subnet ensures traffic from that subnet to the storage account stays within the Azure backbone, and the firewall rule restricts access to that subnet. Enabling 'Allow trusted Microsoft services' permits Azure portal management operations (e.g., listing containers) because the portal is a trusted service that bypasses the network rules for control-plane actions.

Answer

Configure IP firewall rules to allow the subnet IP range and add the Azure portal's public IP addresses.

Answer

Configure a private endpoint for the storage account and disable public network access.

Answer

Configure IP ACLs to allow the subnet and also allow all Azure services.

Question 14

You are developing an ASP.NET Core web API that authenticates users via Microsoft Entra ID. The application needs to authorize access to resources based on custom roles (e.g., 'Admin', 'Editor') that are not present in Microsoft Entra ID. The role mappings are dynamic and stored in an application database. How should you implement authorization?

Accepted Answer

Store the role mappings in an Azure SQL Database and use a custom authorization policy that queries the database after authentication.. The custom roles are dynamic and stored in an application database, not in Microsoft Entra ID. After authentication, a custom authorization policy can query the database to retrieve the role mappings for the authenticated user and enforce access control. This approach decouples role management from the identity provider and supports dynamic role assignments.

Answer

Define the roles as Microsoft Entra ID app roles and include them in the token claims.

Answer

Include the roles as claims in the Microsoft Entra ID token by using a custom claim mapping policy.

Answer

Store the role mappings in the web.config file and read them at runtime.

Question 15

You are developing an ASP.NET Core web API that authenticates users via Microsoft Entra ID. The API needs to call a downstream API (also secured by Microsoft Entra ID) on behalf of the signed-in user (On-Behalf-Of flow). You have already configured the web API to authenticate users with Microsoft.Identity.Web. How should you implement the token acquisition for the downstream API?

Accepted Answer

Inject `ITokenAcquisition` and call `GetAccessTokenForUserAsync` with the scopes for the downstream API. Microsoft.Identity.Web provides the `ITokenAcquisition` service specifically for ASP.NET Core applications to acquire tokens for downstream APIs using the OAuth 2.0 On-Behalf-Of flow. Calling `GetAccessTokenForUserAsync` with the required scopes handles the token exchange automatically, leveraging the incoming user token and client credentials configured in the app. This is the recommended approach when using Microsoft.Identity.Web, as it abstracts the complexity of the OBO flow and integrates seamlessly with the ASP.NET Core authentication pipeline.

Answer

Use ADAL.NET's `AcquireTokenOnBehalfOf` method

Answer

Use the `Azure.Identity` library with `DefaultAzureCredential` to acquire a token

Answer

Manually construct an HTTP POST to the Microsoft Entra ID token endpoint with the user access token and client credentials