AZ-204 Implement Azure security Practice Test 5 — 15 Questions

Question 1

External partners are given Shared Access Signatures to upload product images to a specific Blob Storage container named 'images'. A partner reports accidentally uploading files to the 'contracts' container, which should not be accessible. What is the most likely configuration mistake?

Accepted Answer

The SAS was generated at the storage account level, granting write access that applies to multiple containers rather than being scoped to the 'images' container only. A SAS generated at the storage account level grants permissions across all containers within that account. When the SAS URI includes only the account endpoint (e.g., https://.blob.core.windows.net/) and a set of permissions (like write), the token can be used to access any container, including 'contracts'. To restrict access to a single container, the SAS must be scoped to the container resource URI (e.g., https://.blob.core.windows.net/images) and the signed resource type must be 'c' (container) or 'b' (blob), not 's' (service).

Answer

The SAS expiry time is too long, giving partners time to discover and access other containers

Answer

The partner used a storage account key instead of the provided SAS token

Answer

The SAS was signed with a stored access policy that did not name the correct container

Question 2

Twenty Azure Functions across different teams all need read access to the same Azure Cosmos DB account. The security team wants to revoke or modify this access for all twenty functions at once without visiting each Function App individually. What managed identity design satisfies this requirement?

Accepted Answer

Create one user-assigned managed identity, attach it to all twenty Function Apps, and grant it the Cosmos DB Built-in Data Reader role. Option A is correct because a single user-assigned managed identity can be created once and then attached to all twenty Function Apps. Granting that identity the Cosmos DB Built-in Data Reader role at the Cosmos DB account scope means that revoking or modifying the role assignment centrally affects all functions simultaneously, without needing to visit each app individually.

Answer

Enable a system-assigned managed identity on each Function App and grant each identity the Cosmos DB Built-in Data Reader role

Answer

Create a service principal, store its client secret in Key Vault, and reference the secret from all twenty Function Apps via Key Vault references

Answer

Store the Cosmos DB connection string in Azure App Configuration and reference it from all twenty Function Apps

Question 3

Arrange the steps to create and use a shared access signature (SAS) for an Azure Storage blob in the correct order.

Question 4

Arrange the steps to implement Azure Key Vault for storing and retrieving secrets in an application in the correct order.

Question 5

Match each Azure authentication mechanism to its description.

Question 6

Match each Azure compute service to its execution model.

Question 7

You are developing a web app that uses Azure AD B2C for customer identity. The app must allow users to sign in with their social media accounts like Facebook and Google. Which Azure AD B2C policy type should you configure?

Accepted Answer

Sign-up and sign-in policy. The sign-up and sign-in policy (now called a user flow in the Azure portal) is the correct choice because it is the Azure AD B2C policy type specifically designed to handle both user registration and authentication in a single flow. This policy can be configured to include social identity providers like Facebook and Google, allowing users to sign in using those accounts. It orchestrates the OAuth 2.0 and OpenID Connect protocols to redirect users to the social provider's authorization endpoint and then process the returned tokens.

Answer

Profile editing policy

Answer

Password reset policy

Answer

Conditional access policy

Question 8

You are implementing a microservices solution on Azure Kubernetes Service (AKS). You need to securely store and retrieve connection strings to a database without hardcoding them in the application code. The solution should automatically rotate secrets every 90 days. What should you use?

Accepted Answer

Azure Key Vault with Key Vault Secrets Provider for AKS. Azure Key Vault with the Key Vault Secrets Provider for AKS allows mounting secrets as volumes, and Key Vault supports automatic rotation and versioning. Option A is correct because it integrates rotation. Option B lacks automatic rotation. Option C is for non-Kubernetes environments. Option D is a service not a store.

Answer

Kubernetes Secrets with a CronJob to update them

Answer

Azure Managed Identity for the pod

Answer

Azure App Configuration with a managed identity

Question 9

Your company uses Azure DevOps for CI/CD. The security team requires that all pull request (PR) merges to the main branch be signed with a valid code signing certificate to ensure code integrity. Which Azure DevOps feature should you enforce?

Accepted Answer

Set up branch protection with 'Require a merge commit' and enable 'Require signed commits'. Branch policy with 'Require a merge commit' forces signed commits; the policy can require a valid signature from a trusted certificate. Option A is required for infrastructure. Option C is for governance. Option D is for pipeline validation, not commit signing.

Answer

Configure a service hook to validate signatures using Azure Functions

Answer

Use Azure Policy to require code signing on the repository

Answer

Add a build validation step in the PR pipeline that checks signatures

Question 10

You are developing an API that processes sensitive personal data. The API is exposed via Azure API Management (APIM). You need to ensure that only authorized applications can call the API, and you want to validate the token at the APIM gateway without modifying the backend code. What is the most efficient approach?

Accepted Answer

Configure a validate-jwt policy in APIM inbound processing. The validate-jwt policy in APIM's inbound processing validates the OAuth 2.0 token at the gateway level, ensuring only authorized applications can call the API without modifying backend code. This is the most efficient approach because it offloads token validation to APIM, reducing backend complexity and centralizing security enforcement.

Answer

Implement token validation in the backend API code

Answer

Use APIM's OAuth 2.0 authorization server

Answer

Use subscription keys in APIM

Question 11

You have an Azure Storage account that hosts blobs for a public website. You need to grant a partner application read-only access to a specific container for 24 hours without using a storage account key. What should you create?

Accepted Answer

A shared access signature (SAS) URI with read permission and expiry set to 24 hours. A shared access signature (SAS) URI with read permission and a 24-hour expiry provides time-limited, delegated access to a specific container without exposing the storage account key. This meets the requirement for read-only access for exactly 24 hours, as the SAS token can be scoped to a single container and its permissions set to read.

Answer

An access policy for the container with read permission

Answer

A storage account key

Answer

A managed identity for the partner application

Question 12

Your company uses Microsoft Sentinel for security information and event management (SIEM). You need to detect and automatically respond to a potential credential theft attack where an anomalous number of failed logins are followed by a successful login from a different geographic location. Which Microsoft Sentinel feature should you use?

Accepted Answer

An analytics rule with an automated response. An analytics rule in Microsoft Sentinel can be configured to detect patterns like anomalous failed logins followed by a successful login from a different geography. The rule can then trigger an automated response, such as running a playbook or creating an incident, to remediate the threat in near real-time. This combines detection and automated action within a single rule, making it the correct choice for this scenario.

Answer

Microsoft Sentinel Data Connectors

Answer

Microsoft Defender for Identity

Answer

Microsoft Sentinel playbooks

Question 13

You are developing an Azure Function that processes messages from an Azure Service Bus queue. The function must use a managed identity to authenticate to the Service Bus to avoid managing secrets. Which configuration step is essential for this setup?

Accepted Answer

Enable system-assigned managed identity on the function app and assign the 'Azure Service Bus Data Receiver' role to the identity. Option C is correct because using a managed identity eliminates the need to manage secrets or connection strings. By enabling a system-assigned managed identity on the function app and assigning the 'Azure Service Bus Data Receiver' role to that identity, the function can authenticate to Azure Service Bus via Azure AD (OAuth 2.0) without any stored credentials. This is the recommended approach for secure, secretless authentication in Azure Functions.

Answer

Store the Service Bus connection string in the function app settings

Answer

Create a Key Vault reference to the connection string

Answer

Use the Service Bus SDK with a SharedAccessSignatureToken

Question 14

You need to restrict access to an Azure web app so that only traffic from a specific virtual network (VNet) can reach it. The web app is already deployed. What should you configure on the web app?

Accepted Answer

Access restrictions. Access restrictions (also known as IP restrictions) allow you to define allow/deny rules based on source IP addresses or Virtual Network (VNet) service endpoints. By configuring a service endpoint-based rule that permits traffic only from your specific VNet, you can block all other inbound traffic to the web app. This is the correct mechanism for restricting access at the web app level without modifying the underlying infrastructure.

Answer

VNet integration

Answer

Network Security Group (NSG) on the subnet

Answer

Point-to-Site VPN

Question 15

Your organization uses Azure Policy to enforce compliance. You need to ensure that all Azure SQL databases have Advanced Data Security (ADS) enabled. What type of Azure Policy effect should you use to automatically enable ADS if it is not already enabled?

Accepted Answer

DeployIfNotExists. DeployIfNotExists effect can deploy a resource or configuration if it does not exist. Option A is correct. Option B audits but doesn't remediate. Option C denies non-compliant resources but does not automatically enable. Option D is for removing resources.

Answer

Audit

Answer

Modify

Answer

Deny