AZ-204 Implement Azure security Practice Test 3 — 15 Questions

Question 1

You deploy an Azure App Service web app that uses a system-assigned managed identity. The app needs to read a secret stored in Azure Key Vault to connect to a third-party service. You want to grant the minimum required permissions to the managed identity. Which Azure RBAC role should you assign to the managed identity at the Key Vault scope?

Accepted Answer

Key Vault Secrets User. Option C is correct because the 'Key Vault Secrets User' role grants the minimum required permission—'Microsoft.KeyVault/vaults/secrets/getSecret/action'—for a managed identity to read a secret from Azure Key Vault. This role is specifically designed for read-only access to secrets, aligning with the principle of least privilege for the app's need to retrieve a secret for third-party service authentication.

Answer

Key Vault Reader

Answer

Key Vault Secrets Officer

Answer

Key Vault Contributor

Question 2

You are developing an ASP.NET Core web API that uses Microsoft Entra ID for authentication via Microsoft.Identity.Web. The application needs to authorize actions based on custom roles such as "Editor" and "Reviewer". These roles are not defined in Microsoft Entra ID app roles or directory roles; instead, they are stored in an application database and can be assigned dynamically by administrators. You need to implement authorization with minimal impact on performance and without modifying the application's authentication flow. Which approach should you use?

Accepted Answer

Use a custom middleware to modify the User principal after authentication, adding role claims from the database. Option D is correct because it allows you to add role claims from the application database to the User principal after authentication via custom middleware, without altering the authentication flow. This approach leverages the existing Microsoft.Identity.Web authentication pipeline and caches the role claims in the principal, minimizing performance impact by avoiding repeated database lookups on every request.

Answer

Add custom claims to the token via Microsoft Entra ID custom claims policies

Answer

Implement a custom authorization filter that reads the user's roles from the database on each request and caches them

Answer

Use Microsoft Entra ID app roles and assign them to users or groups

Question 3

Your company has an application running on Azure Virtual Machines that needs to access secrets in Azure Key Vault. You want to restrict network access to the Key Vault so that only the virtual network/subnet containing the VMs can reach it. You also want to ensure that the solution works with the least management overhead. Which configuration should you use?

Accepted Answer

Configure Key Vault firewall to allow access from the virtual network and subnet using service endpoints.. Option C is correct because configuring Key Vault firewall with virtual network service endpoints allows you to restrict access to the Key Vault to a specific virtual network and subnet without exposing the VMs to the internet. This approach leverages Azure's backbone network for traffic, providing secure and direct connectivity with minimal management overhead, as service endpoints are automatically maintained by Azure.

Answer

Configure Key Vault firewall with IP-based rules that allow the VM's public IP address.

Answer

Configure a Private Endpoint for the Key Vault in the same virtual network as the VMs.

Answer

Use a shared access signature (SAS) to access Key Vault secrets.

Question 4

Your company has several Azure subscriptions, and you need to create a custom role that allows security engineers to start and stop Azure virtual machines but not delete them or modify their network interfaces. The role must be scoped to a specific resource group. How should you define this custom role?

Accepted Answer

Create a custom role with allowed actions for start and stop, and explicitly deny delete actions using NotActions.. Option B is correct because custom roles in Azure RBAC allow you to define granular permissions using Actions and NotActions. By specifying start and stop actions (e.g., Microsoft.Compute/virtualMachines/start/action and Microsoft.Compute/virtualMachines/deallocate/action) and excluding delete actions via NotActions (e.g., Microsoft.Compute/virtualMachines/delete), you can precisely control what security engineers can do. Scoping the role to a specific resource group ensures the permissions apply only to that resource group, meeting the requirement.

Answer

Assign the built-in Contributor role to the resource group.

Answer

Use Azure Policy to prevent deletion of VMs in that resource group.

Answer

Add the engineers to an Microsoft Entra ID administrative unit and assign permissions for VM operations.

Question 5

You have an Azure App Service web app that uses a system-assigned managed identity. The web app needs to authenticate to an Azure SQL Database to read and write data. You want to use the managed identity to avoid storing credentials in connection strings. Which steps are required to configure this access?

Accepted Answer

Create a contained database user in the SQL database mapped to the managed identity, grant required database roles, and use Microsoft Entra ID token-based authentication from the app.. Option B is correct because to use a system-assigned managed identity with Azure SQL Database, you must create a contained database user mapped to the managed identity in the SQL database, grant it the necessary database roles (e.g., db_datareader, db_datawriter), and then acquire an access token for Microsoft Entra ID (formerly Azure AD) from the managed identity endpoint to authenticate. This token-based approach avoids storing credentials and leverages the managed identity's automatic credential rotation.

Answer

Assign the managed identity the 'SQL DB Contributor' RBAC role on the database, then use SQL authentication with the identity's client ID.

Answer

Enable Microsoft Entra ID authentication on the SQL server, add the managed identity as an Microsoft Entra ID admin, and use integrated security in the connection string.

Answer

Configure the connection string with the managed identity's principal ID as the user ID and leave the password empty.

Question 6

You are building a web application that uses Microsoft Entra ID for authentication. The application needs to call Microsoft Graph API to read user profiles and send emails on behalf of the signed-in user. You want to ensure that the user's consent is obtained only once and that the application can refresh tokens silently. Which OAuth 2.0 flow should you implement?

Accepted Answer

OAuth 2.0 Authorization Code flow with PKCE (Proof Key for Code Exchange).. The Authorization Code flow with PKCE is the recommended OAuth 2.0 flow for public client applications (like single-page apps or mobile apps) that need delegated access to Microsoft Graph. It allows the application to obtain an authorization code, exchange it for an access token and a refresh token, and use the refresh token to silently acquire new tokens without requiring the user to re-consent. This flow ensures that user consent is obtained only once and supports silent token refresh, meeting the requirements.

Answer

OAuth 2.0 Client Credentials flow.

Answer

OAuth 2.0 Implicit Grant flow.

Answer

OAuth 2.0 Resource Owner Password Credentials (ROPC) flow.

Question 7

You have an Azure App Service that uses a system-assigned managed identity. You need to grant it permission to read a secret from Azure Key Vault. Which RBAC role should you assign at the Key Vault scope?

Accepted Answer

Key Vault Secrets User. The system-assigned managed identity needs to read a secret from Azure Key Vault. The 'Key Vault Secrets User' RBAC role grants exactly that permission — the ability to read secret contents. This is the least-privilege role that allows the 'Microsoft.KeyVault/vaults/secrets/read' action, which is required for reading secret values.

Answer

Key Vault Reader

Answer

Key Vault Contributor

Answer

Key Vault Certificate User

Question 8

You need to create a custom RBAC role that allows a security group to start and stop Azure virtual machines in a specific resource group, but not delete them or modify their network interfaces. Which set of actions should you include in the role definition?

Accepted Answer

Microsoft.Compute/virtualMachines/start/action and Microsoft.Compute/virtualMachines/deallocate/action. Option A is correct because the custom RBAC role needs to allow starting and stopping (deallocating) VMs without permitting deletion or network interface modifications. The actions Microsoft.Compute/virtualMachines/start/action and Microsoft.Compute/virtualMachines/deallocate/action precisely grant the ability to start a VM and deallocate it (which stops and releases resources), while excluding delete or write permissions on the VM or its network interfaces.

Answer

Microsoft.Compute/virtualMachines/start/action and Microsoft.Compute/virtualMachines/powerOff/action

Answer

Microsoft.Compute/virtualMachines/restart/action and Microsoft.Compute/virtualMachines/deallocate/action

Answer

Microsoft.Compute/virtualMachines/start/action and Microsoft.Compute/virtualMachines/write

Question 9

You have an Azure App Service web app with a system-assigned managed identity. You need to grant it permission to read secrets from an Azure Key Vault. Which RBAC role should you assign to the managed identity at the Key Vault scope?

Accepted Answer

Key Vault Secrets User. The system-assigned managed identity needs to read secrets from Key Vault. The 'Key Vault Secrets User' role grants exactly that permission — it allows the identity to perform secret read operations (Get, List) on the secrets in the vault. This is the correct RBAC role for read-only access to secrets, as opposed to keys or certificates.

Answer

Key Vault Reader

Answer

Key Vault Crypto User

Answer

Contributor

Question 10

You are developing an API that uses managed identity to access Azure Key Vault. The API runs in an Azure App Service with system-assigned managed identity enabled. You need to retrieve a secret value. Which API endpoint should your code call?

Accepted Answer

https://myvault.vault.azure.net/secrets/{secret-name}?api-version=7.0. Option B is correct because it uses the full Key Vault REST API endpoint with the specific vault name ('myvault'), the 'secrets' resource path, the secret name, and the required 'api-version' query parameter (7.0). The managed identity in the App Service authenticates via Azure AD, and the code must call this specific endpoint to retrieve the secret value, as the vault name is part of the DNS name and the API version is mandatory.

Answer

https://vault.azure.net/secrets/{secret-name}

Answer

https://login.microsoftonline.com/{tenant}/oauth2/token

Answer

https://management.azure.com/subscriptions/{sub}/...

Question 11

You are developing a web app that authenticates users via Microsoft Entra ID. The app needs to read the user's profile and send emails on their behalf. You want to minimize user consent prompts. Which OAuth 2.0 grant type should you use?

Accepted Answer

Authorization code flow with PKCE. The authorization code flow with PKCE (Proof Key for Code Exchange) is the recommended OAuth 2.0 grant type for public clients (like a web app) that need delegated user authentication and consent. It allows the app to obtain an access token to read the user's profile and a refresh token to send emails on their behalf, while minimizing consent prompts by using a single consent request for both permissions. PKCE adds a cryptographic challenge to prevent authorization code interception attacks, making it secure for web apps without a client secret.

Answer

Client credentials flow

Answer

Resource owner password credentials

Answer

Implicit flow

Question 12

A developer is implementing Key Vault certificate retrieval. The application runs on Azure App Service and must avoid stored credentials. Which design should be used?

Accepted Answer

Enable managed identity and grant least-privilege access to the target resource. Option C is correct because Azure App Service supports Managed Identity, which allows the application to authenticate to Key Vault without storing any credentials in code or configuration. By enabling a system-assigned or user-assigned managed identity and granting it least-privilege access (e.g., via an access policy with `Get` permission for secrets), the app can securely retrieve certificates using the Azure Identity SDK's `DefaultAzureCredential` class, which automatically obtains an access token from Azure AD.

Answer

Use a shared administrator account

Answer

Store a client secret in source control

Answer

Disable authentication for the target resource

Question 13

A single-page app signs in users with Microsoft Entra ID and calls a protected API. The app cannot safely keep a client secret. Which OAuth flow should be used?

Accepted Answer

Authorization code flow with PKCE. The authorization code flow with PKCE (Proof Key for Code Exchange) is the recommended OAuth flow for single-page apps that cannot securely store a client secret. PKCE ensures that even if the authorization code is intercepted, it cannot be exchanged for tokens without the original code verifier, mitigating the risk of code injection attacks. This flow aligns with Microsoft's best practices for native and browser-based applications using Microsoft Entra ID.

Answer

Implicit flow

Answer

Client credentials flow

Answer

Resource owner password credentials flow

Question 14

An API receives JWT access tokens from Microsoft Entra ID. Which two token properties should the API validate before accepting a request?

Accepted Answer

Issuer and signature are valid for the trusted tenant. Option A is correct because the API must validate that the JWT's issuer (iss) claim matches the trusted tenant's issuer URL (e.g., https://login.microsoftonline.com/{tenant-id}/v2.0) and that the token's cryptographic signature is valid, ensuring the token was issued by Microsoft Entra ID and hasn't been tampered with. This prevents token forgery and tokens from untrusted tenants.

Answer

The user's display name is present

Answer

The token was sent in a query string

Question 15

A background service must call Microsoft Graph without a signed-in user. Which Microsoft identity platform permission model is required?

Accepted Answer

Application permissions with client credentials flow. Option D is correct because when a background service or daemon calls Microsoft Graph without a signed-in user, it must authenticate as itself using application permissions (app roles) rather than delegated permissions. The client credentials flow (OAuth 2.0 grant type) allows the service to obtain an access token using its own credentials (client ID and client secret or certificate), without any user interaction. This flow is designed for server-to-server scenarios where the application acts on its own behalf.

Answer

Password hash synchronization

Answer

Delegated permissions only

Answer

Device code flow