AZ-204 Implement Azure security Practice Test 5 — 15 Questions

Question 1

You are developing an API that uses managed identity to access Azure Key Vault. The API runs in an Azure App Service with system-assigned managed identity enabled. You need to retrieve a secret value. Which API endpoint should your code call?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

https://myvault.vault.azure.net/secrets/{secret-name}?api-version=7.0. It uses the full Key Vault REST API endpoint with the specific vault name ('myvault'), the 'secrets' resource path, the secret name, and the required 'api-version' query parameter (7.0). The managed identity in the App Service authenticates via Azure AD, and the code must call this specific endpoint to retrieve the secret value, as the vault name is part of the DNS name and the API version is mandatory.

Answer

https://vault.azure.net/secrets/{secret-name}

Answer

https://login.microsoftonline.com/{tenant}/oauth2/token

Answer

https://management.azure.com/subscriptions/{sub}/...

Question 2

You are developing a web app that authenticates users via Microsoft Entra ID. The app needs to read the user's profile and send emails on their behalf. You want to minimize user consent prompts. Which OAuth 2.0 grant type should you use?

Accepted Answer

Authorization code flow with PKCE. The authorization code flow with PKCE (Proof Key for Code Exchange) is the recommended OAuth 2.0 grant type for public clients (like a web app) that need delegated user authentication and consent. It allows the app to obtain an access token to read the user's profile and a refresh token to send emails on their behalf, while minimizing consent prompts by using a single consent request for both permissions. PKCE adds a cryptographic challenge to prevent authorization code interception attacks, making it secure for web apps without a client secret.

Answer

Client credentials flow

Answer

Resource owner password credentials

Answer

Implicit flow

Question 3

A developer is implementing Key Vault certificate retrieval. The application runs on Azure App Service and must avoid stored credentials. Which design should be used?

Accepted Answer

Enable managed identity and grant least-privilege access to the target resource. Azure App Service supports Managed Identity, which allows the application to authenticate to Key Vault without storing any credentials in code or configuration. By enabling a system-assigned or user-assigned managed identity and granting it least-privilege access (e.g., via an access policy with `Get` permission for secrets), the app can securely retrieve certificates using the Azure Identity SDK's `DefaultAzureCredential` class, which automatically obtains an access token from Azure AD.

Answer

Use a shared administrator account

Answer

Store a client secret in source control

Answer

Disable authentication for the target resource

Question 4

A single-page app signs in users with Microsoft Entra ID and calls a protected API. The app cannot safely keep a client secret. Which OAuth flow should be used?

Accepted Answer

Authorization code flow with PKCE. The authorization code flow with PKCE (Proof Key for Code Exchange) is the recommended OAuth flow for single-page apps that cannot securely store a client secret. PKCE ensures that even if the authorization code is intercepted, it cannot be exchanged for tokens without the original code verifier, mitigating the risk of code injection attacks. This flow aligns with Microsoft's best practices for native and browser-based applications using Microsoft Entra ID.

Answer

Implicit flow

Answer

Client credentials flow

Answer

Resource owner password credentials flow

Question 5

An API receives JWT access tokens from Microsoft Entra ID. Which two token properties should the API validate before accepting a request?

Accepted Answer

Issuer and signature are valid for the trusted tenant. The API must validate the token's issuer (iss) claim to ensure it matches the trusted Microsoft Entra ID tenant's issuer URL, confirming the token's origin. It must also verify the token's cryptographic signature to ensure it hasn't been tampered with. Additionally, the API must validate the token's audience (aud) claim, ensuring it matches the API's own Application ID URI or client ID, which confirms the token was intended for this specific API.

Answer

The user's display name is present

Answer

The token was sent in a query string

Question 6

A background service must call Microsoft Graph without a signed-in user. Which Microsoft identity platform permission model is required?

Accepted Answer

Application permissions with client credentials flow. When a background service or daemon calls Microsoft Graph without a signed-in user, it must authenticate as itself using application permissions (app roles) rather than delegated permissions. The client credentials flow (OAuth 2.0 grant type) allows the service to obtain an access token using its own credentials (client ID and client secret or certificate), without any user interaction. This flow is designed for server-to-server scenarios where the application acts on its own behalf.

Answer

Password hash synchronization

Answer

Delegated permissions only

Answer

Device code flow

Question 7

A developer is implementing least-privilege storage access. The application runs on Azure App Service and must avoid stored credentials. Which design should be used?

Accepted Answer

Enable managed identity and grant least-privilege access to the target resource. Managed identity in Azure App Service allows the application to authenticate to Azure Storage without storing any credentials in code or configuration. By enabling a system-assigned or user-assigned managed identity, the app obtains an Azure AD token automatically, which is used to access the storage resource. Granting the managed identity only the required permissions (e.g., 'Storage Blob Data Reader' for read-only access) enforces least-privilege access, eliminating the need for stored secrets.

Answer

Use a shared administrator account

Answer

Disable authentication for the target resource

Answer

Store a client secret in source control

Question 8

A single-page app signs in users with Microsoft Entra ID and calls a protected API. The app cannot safely keep a client secret. Which OAuth flow should be used? The design must avoid adding custom operational scripts.

Accepted Answer

Authorization code flow with PKCE. The authorization code flow with PKCE (Proof Key for Code Exchange) is the recommended OAuth 2.0 flow for single-page applications (SPAs) that cannot securely store a client secret. PKCE uses a dynamically generated cryptographic code verifier and challenge, ensuring that even if the authorization code is intercepted, it cannot be exchanged for tokens without the original verifier. This flow is designed for public clients (like SPAs) and avoids the need for custom operational scripts.

Answer

Implicit flow

Answer

Client credentials flow

Answer

Resource owner password credentials flow

Question 9

A background service must call Microsoft Graph without a signed-in user. Which Microsoft identity platform permission model is required? The design must avoid adding custom operational scripts.

Accepted Answer

Application permissions with client credentials flow. Application permissions with the client credentials flow are required because the background service must call Microsoft Graph without a signed-in user. This flow uses OAuth 2.0 client credentials grant (RFC 6749) where the service authenticates as itself using a client secret or certificate, not on behalf of a user. Delegated permissions (Option B) always require a signed-in user context, making them unsuitable for unattended background services.

Answer

Password hash synchronization

Answer

Delegated permissions only

Answer

Device code flow

Question 10

A developer is implementing Key Vault certificate retrieval. The application runs on Azure App Service and must avoid stored credentials. Which design should be used? The design must avoid adding custom operational scripts.

Accepted Answer

Enable managed identity and grant least-privilege access to the target resource. Managed identity (system-assigned or user-assigned) allows the App Service to authenticate to Key Vault without any stored credentials, because Azure automatically rotates the identity's service principal and provides an access token via the Azure Instance Metadata Service (IMDS) endpoint. By granting least-privilege access (e.g., a Key Vault access policy with only 'Get' on secrets), the design meets the requirement to avoid stored credentials and custom operational scripts.

Answer

Use a shared administrator account

Answer

Store a client secret in source control

Answer

Disable authentication for the target resource

Question 11

A single-page app signs in users with Microsoft Entra ID and calls a protected API. The app cannot safely keep a client secret. Which OAuth flow should be used? The architecture review board prefers a managed Azure-native control.

Accepted Answer

Authorization code flow with PKCE. The authorization code flow with PKCE (Proof Key for Code Exchange) is the correct choice because it is designed for public clients (like single-page apps) that cannot securely store a client secret. PKCE uses a dynamically generated cryptographic code verifier and challenge to prevent authorization code interception attacks, making it the recommended OAuth 2.0 flow for SPAs calling protected APIs in Microsoft Entra ID.

Answer

Implicit flow

Answer

Client credentials flow

Answer

Resource owner password credentials flow

Question 12

An API receives JWT access tokens from Microsoft Entra ID. Which two token properties should the API validate before accepting a request? The architecture review board prefers a managed Azure-native control.

Accepted Answer

Issuer and signature are valid for the trusted tenant. The API must validate the issuer (iss) claim to ensure the token was issued by a trusted tenant (e.g., https://login.microsoftonline.com/{tenant-id}/v2.0) and verify the token's digital signature using the public keys from the OpenID Connect metadata endpoint. This prevents tokens from untrusted tenants or forged tokens from being accepted. Additionally, the API must validate the audience (aud) claim to ensure the token was specifically intended for this API, preventing it from being used by unintended applications.

Answer

The user's display name is present

Answer

The token was sent in a query string

Question 13

A background service must call Microsoft Graph without a signed-in user. Which Microsoft identity platform permission model is required?

Accepted Answer

Application permissions with client credentials flow. For a background service calling Microsoft Graph without a signed-in user, the application must authenticate as itself, not on behalf of a user. Application permissions, combined with the client credentials flow (OAuth 2.0), allow the service to obtain an access token using its own identity (client ID and client secret or certificate), without any user interaction. This is the only model that supports non-interactive, daemon-style access to Microsoft Graph.

Answer

Password hash synchronization

Answer

Delegated permissions only

Answer

Device code flow

Question 14

A developer is implementing least-privilege storage access. The application runs on Azure App Service and must avoid stored credentials. Which design should be used? The design must avoid adding custom operational scripts.

Accepted Answer

Enable managed identity and grant least-privilege access to the target resource. Azure Managed Identity provides an automatically managed identity in Azure AD that allows the App Service to authenticate to any service supporting Azure AD authentication without storing any credentials. By granting the managed identity only the specific permissions required (least-privilege) on the target storage resource (e.g., Storage Blob Data Reader), the application avoids stored credentials and eliminates the need for custom operational scripts. This aligns with the principle of zero standing credentials and is the recommended approach for Azure App Service.

Answer

Use a shared administrator account

Answer

Disable authentication for the target resource

Answer

Store a client secret in source control

Question 15

A single-page app signs in users with Microsoft Entra ID and calls a protected API. The app cannot safely keep a client secret. Which OAuth flow should be used? The team wants the control to be enforceable during normal operations.

Accepted Answer

Authorization code flow with PKCE. The authorization code flow with PKCE (Proof Key for Code Exchange) is the recommended OAuth flow for single-page apps because it prevents the client secret from being exposed by using a dynamically generated code verifier and challenge. This flow ensures that even if the authorization code is intercepted, it cannot be exchanged for tokens without the original code verifier, making it secure for public clients that cannot safely store secrets.

Answer

Implicit flow

Answer

Client credentials flow

Answer

Resource owner password credentials flow