AZ-204 Implement Azure security Practice Test 4 — 15 Questions

Question 1

You are developing an ASP.NET Core web API that is hosted on Azure App Service. The API needs to read secrets from Azure Key Vault at startup. You want to avoid storing any credentials in the application code or configuration. Which approach should you use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable the system-assigned managed identity for the App Service and configure Key Vault access policies to allow that identity.. Enabling a system-assigned managed identity for the App Service allows it to authenticate to Azure Key Vault without any credentials stored in code or configuration. The managed identity is automatically managed by Azure AD (now Microsoft Entra ID) and can be granted access to Key Vault secrets via access policies, eliminating the need for client IDs, client secrets, or connection strings.

Answer

Use the Key Vault SDK with a client ID and client secret stored in App Service application settings.

Answer

Use Microsoft Entra ID application roles to assign the App Service a role that allows reading secrets.

Answer

Store the Key Vault URL and a connection string with the secret in the application's app.config file.

Question 2

You are designing an ASP.NET Core web API that authenticates users via Microsoft Entra ID. The application needs to authorize access to resources based on custom roles (e.g., 'Admin', 'Editor') that are not defined in Microsoft Entra ID app roles or groups. The role mappings are dynamic and stored in an application database. How should you implement authorization in the API?

Accepted Answer

Use the OnTokenValidated event in OpenID Connect middleware to query the database and add custom role claims to the identity.. It uses the OnTokenValidated event in OpenID Connect middleware to enrich the user's identity with custom role claims from the application database after token validation. This approach allows dynamic role mappings stored externally to be injected into the ClaimsPrincipal, which can then be evaluated by the standard [Authorize] attribute with role policies. It avoids modifying Entra ID configuration and keeps role management flexible within the application.

Answer

Define the roles as Microsoft Entra ID app roles and assign them to users. This is the standard way to handle roles.

Answer

Store the roles in the Microsoft Entra ID token by customizing the token issuance in Microsoft Entra ID.

Answer

Use the [Authorize] attribute with a custom authorization filter that checks the database on every request without modifying the claims.

Question 3

You are developing an ASP.NET Core web app that uses Azure SQL Database. The SQL connection string contains a password that must be rotated every 30 days. The app runs on Azure App Service. You want to store the connection string securely and enable automatic rotation without redeploying the app. Which approach should you use?

Accepted Answer

Store the connection string in an App Setting and use Key Vault references. Configure a Key Vault policy to automatically rotate the secret.. Azure App Service supports Key Vault references in App Settings, allowing you to securely store the connection string in Key Vault and reference it without exposing the password. By configuring a Key Vault policy to automatically rotate the secret (e.g., using a scheduled rotation or event-driven trigger), the password can be rotated every 30 days without redeploying the app, as the App Service runtime resolves the reference at runtime.

Answer

Store the connection string in an App Setting as a plain text value and use deployment slots to swap when the password changes.

Answer

Use a managed identity to access the SQL database directly, bypassing the connection string entirely.

Answer

Store the connection string in Azure Key Vault and use an ARM template with a secret reference at deployment time.

Question 4

You are using Azure API Management (APIM) to expose a REST API. The backend API requires mutual TLS (client certificate) for authentication. The client certificate is stored in Azure Key Vault. You need to configure APIM to use this certificate when calling the backend, without exposing the certificate contents in the policy files. Which APIM feature and policy should you use?

Accepted Answer

Use the authentication-certificate policy with a named value that references the Key Vault certificate.. The `authentication-certificate` policy in Azure API Management can reference a client certificate stored in Azure Key Vault via a named value. Named values securely store secrets and can point to Key Vault certificates without exposing the certificate contents in policy files. This allows APIM to present the certificate during mutual TLS authentication to the backend API.

Answer

Use the authentication-managed-identity policy to authenticate to the backend.

Answer

Upload the client certificate directly to APIM's Certificate store and reference it in the policy.

Answer

Use a JavaScript policy to fetch the certificate from Key Vault and attach it.

Question 5

You are developing an ASP.NET Core web API that is hosted on Azure App Service. The API needs to read secrets from Azure Key Vault at startup. You want to avoid storing any credentials in the application code or configuration. Which approach should you use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

new SecretClient(new Uri(keyVaultUrl), new DefaultAzureCredential()). `DefaultAzureCredential` automatically attempts to authenticate using the environment's managed identity when running on Azure App Service. Since a system-assigned managed identity is enabled, `DefaultAzureCredential` will chain through available credential sources and successfully use the managed identity endpoint to obtain a token for Key Vault, without requiring any explicit tenant ID, client ID, or secret.

Answer

new SecretClient(new Uri(keyVaultUrl), new ClientSecretCredential(tenantId, clientId, clientSecret))

Answer

new SecretClient(new Uri(keyVaultUrl), new ChainedTokenCredential())

Answer

new SecretClient(new Uri(keyVaultUrl), new InteractiveBrowserCredential())

Question 6

You have an Azure App Service web app that uses a system-assigned managed identity. The app needs to read a secret stored in Azure Key Vault. You need to grant the app the minimum required permissions to access the secret. Which RBAC role should you assign to the managed identity at the Key Vault scope?

Accepted Answer

Key Vault Secrets User. The Key Vault Secrets User role grants the minimum required permission to read secrets from Azure Key Vault. This role provides the 'Microsoft.KeyVault/vaults/secrets/getSecret/action' permission, which is exactly what the app needs to retrieve the secret value. It does not grant any write or management capabilities, adhering to the principle of least privilege.

Answer

Key Vault Reader

Answer

Key Vault Secrets Officer

Answer

Contributor

Question 7

You deploy an Azure App Service web app that uses a system-assigned managed identity. The app needs to read a secret stored in Azure Key Vault to connect to a third-party service. You want to grant the minimum required permissions to the managed identity. Which Azure RBAC role should you assign to the managed identity at the Key Vault scope?

Accepted Answer

Key Vault Secrets User. The 'Key Vault Secrets User' role grants the minimum required permission—'Microsoft.KeyVault/vaults/secrets/getSecret/action'—for a managed identity to read a secret from Azure Key Vault. This role is specifically designed for read-only access to secrets, aligning with the principle of least privilege for the app's need to retrieve a secret for third-party service authentication.

Answer

Key Vault Reader

Answer

Key Vault Secrets Officer

Answer

Key Vault Contributor

Question 8

You are developing an ASP.NET Core web API that uses Microsoft Entra ID for authentication via Microsoft.Identity.Web. The application needs to authorize actions based on custom roles such as "Editor" and "Reviewer". These roles are not defined in Microsoft Entra ID app roles or directory roles; instead, they are stored in an application database and can be assigned dynamically by administrators. You need to implement authorization with minimal impact on performance and without modifying the application's authentication flow. Which approach should you use?

Accepted Answer

Use a custom middleware to modify the User principal after authentication, adding role claims from the database. It allows you to add role claims from the application database to the User principal after authentication via custom middleware, without altering the authentication flow. This approach leverages the existing Microsoft.Identity.Web authentication pipeline and caches the role claims in the principal, minimizing performance impact by avoiding repeated database lookups on every request.

Answer

Add custom claims to the token via Microsoft Entra ID custom claims policies

Answer

Implement a custom authorization filter that reads the user's roles from the database on each request and caches them

Answer

Use Microsoft Entra ID app roles and assign them to users or groups

Question 9

Your company has an application running on Azure Virtual Machines that needs to access secrets in Azure Key Vault. You want to restrict network access to the Key Vault so that only the virtual network/subnet containing the VMs can reach it. You also want to ensure that the solution works with the least management overhead. Which configuration should you use?

Accepted Answer

Configure Key Vault firewall to allow access from the virtual network and subnet using service endpoints.. Configuring Key Vault firewall with virtual network service endpoints allows you to restrict access to the Key Vault to a specific virtual network and subnet without exposing the VMs to the internet. This approach leverages Azure's backbone network for traffic, providing secure and direct connectivity with minimal management overhead, as service endpoints are automatically maintained by Azure.

Answer

Configure Key Vault firewall with IP-based rules that allow the VM's public IP address.

Answer

Configure a Private Endpoint for the Key Vault in the same virtual network as the VMs.

Answer

Use a shared access signature (SAS) to access Key Vault secrets.

Question 10

Your company has several Azure subscriptions, and you need to create a custom role that allows security engineers to start and stop Azure virtual machines but not delete them or modify their network interfaces. The role must be scoped to a specific resource group. How should you define this custom role?

Accepted Answer

Create a custom role with allowed actions for start and stop, and explicitly deny delete actions using NotActions.. Custom roles in Azure RBAC allow you to define granular permissions using Actions and NotActions. To allow start/stop but prevent delete, you can define a broad action like 'Microsoft.Compute/virtualMachines/*' (which includes start/stop and delete) and then use 'NotActions' to explicitly exclude 'Microsoft.Compute/virtualMachines/delete'. Since network interface modifications fall under the 'Microsoft.Network' resource provider, they are not included in 'Microsoft.Compute/virtualMachines/*' and thus are implicitly denied by this role definition. Scoping the role to a specific resource group ensures the permissions apply only to that resource group, meeting the requirement.

Answer

Assign the built-in Contributor role to the resource group.

Answer

Use Azure Policy to prevent deletion of VMs in that resource group.

Answer

Add the engineers to an Microsoft Entra ID administrative unit and assign permissions for VM operations.

Question 11

You have an Azure App Service web app that uses a system-assigned managed identity. The web app needs to authenticate to an Azure SQL Database to read and write data. You want to use the managed identity to avoid storing credentials in connection strings. Which steps are required to configure this access?

Accepted Answer

Create a contained database user in the SQL database mapped to the managed identity, grant required database roles, and use Microsoft Entra ID token-based authentication from the app.. To use a system-assigned managed identity with Azure SQL Database, you must create a contained database user mapped to the managed identity in the SQL database, grant it the necessary database roles (e.g., db_datareader, db_datawriter), and then acquire an access token for Microsoft Entra ID (formerly Azure AD) from the managed identity endpoint to authenticate. This token-based approach avoids storing credentials and leverages the managed identity's automatic credential rotation.

Answer

Assign the managed identity the 'SQL DB Contributor' RBAC role on the database, then use SQL authentication with the identity's client ID.

Answer

Enable Microsoft Entra ID authentication on the SQL server, add the managed identity as an Microsoft Entra ID admin, and use integrated security in the connection string.

Answer

Configure the connection string with the managed identity's principal ID as the user ID and leave the password empty.

Question 12

You are building a web application that uses Microsoft Entra ID for authentication. The application needs to call Microsoft Graph API to read user profiles and send emails on behalf of the signed-in user. You want to ensure that the user's consent is obtained only once and that the application can refresh tokens silently. Which OAuth 2.0 flow should you implement?

Accepted Answer

OAuth 2.0 Authorization Code flow with PKCE (Proof Key for Code Exchange).. The Authorization Code flow with PKCE is the recommended OAuth 2.0 flow for public client applications (like single-page apps or mobile apps) that need delegated access to Microsoft Graph. It allows the application to obtain an authorization code, exchange it for an access token and a refresh token, and use the refresh token to silently acquire new tokens without requiring the user to re-consent. This flow ensures that user consent is obtained only once and supports silent token refresh, meeting the requirements.

Answer

OAuth 2.0 Client Credentials flow.

Answer

OAuth 2.0 Implicit Grant flow.

Answer

OAuth 2.0 Resource Owner Password Credentials (ROPC) flow.

Question 13

You have an Azure App Service that uses a system-assigned managed identity. You need to grant it permission to read a secret from Azure Key Vault. Which RBAC role should you assign at the Key Vault scope?

Accepted Answer

Key Vault Secrets User. The system-assigned managed identity needs to read a secret from Azure Key Vault. The 'Key Vault Secrets User' RBAC role grants exactly that permission — the ability to read secret contents. This is the least-privilege role that allows the 'Microsoft.KeyVault/vaults/secrets/read' action, which is required for reading secret values.

Answer

Key Vault Reader

Answer

Key Vault Contributor

Answer

Key Vault Certificate User

Question 14

You need to create a custom RBAC role that allows a security group to start and stop Azure virtual machines in a specific resource group, but not delete them or modify their network interfaces. Which set of actions should you include in the role definition?

Accepted Answer

Microsoft.Compute/virtualMachines/start/action and Microsoft.Compute/virtualMachines/deallocate/action. The custom RBAC role needs to allow starting and stopping (deallocating) VMs without permitting deletion or network interface modifications. The actions Microsoft.Compute/virtualMachines/start/action and Microsoft.Compute/virtualMachines/deallocate/action precisely grant the ability to start a VM and deallocate it (which stops and releases resources), while excluding delete or write permissions on the VM or its network interfaces.

Answer

Microsoft.Compute/virtualMachines/start/action and Microsoft.Compute/virtualMachines/powerOff/action

Answer

Microsoft.Compute/virtualMachines/restart/action and Microsoft.Compute/virtualMachines/deallocate/action

Answer

Microsoft.Compute/virtualMachines/start/action and Microsoft.Compute/virtualMachines/write

Question 15

You have an Azure App Service web app with a system-assigned managed identity. You need to grant it permission to read secrets from an Azure Key Vault. Which RBAC role should you assign to the managed identity at the Key Vault scope?

Accepted Answer

Key Vault Secrets User. The system-assigned managed identity needs to read secrets from Key Vault. The 'Key Vault Secrets User' role grants exactly that permission — it allows the identity to perform secret read operations (Get, List) on the secrets in the vault. This is the correct RBAC role for read-only access to secrets, as opposed to keys or certificates.

Answer

Key Vault Reader

Answer

Key Vault Crypto User

Answer

Contributor