AZ-204 Implement Azure security Practice Test 6 — 15 Questions

Question 1

An API receives JWT access tokens from Microsoft Entra ID. Which two token properties should the API validate before accepting a request? The team wants the control to be enforceable during normal operations.

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Issuer and signature are valid for the trusted tenant. Validating the issuer and signature ensures the JWT was issued by the trusted Microsoft Entra ID tenant and has not been tampered with. The issuer claim (iss) must match the tenant-specific issuer URL (e.g., https://login.microsoftonline.com/{tenant-id}/v2.0), and the signature must be verified using the public keys from the OpenID Connect metadata endpoint. This is a fundamental security requirement for any API that accepts tokens from Entra ID.

Answer

The user's display name is present

Answer

The token was sent in a query string

Question 2

A background service must call Microsoft Graph without a signed-in user. Which Microsoft identity platform permission model is required? The team wants the control to be enforceable during normal operations.

Accepted Answer

Application permissions with client credentials flow. The scenario requires an unattended background service to call Microsoft Graph without a signed-in user. Application permissions, combined with the client credentials flow (OAuth 2.0 grant type), allow the service to authenticate as itself using a client ID and client secret or certificate, obtaining an access token with pre-authorized application-level permissions. This model enforces control during normal operations because the permissions are granted directly to the application and cannot be delegated by a user, ensuring consistent access regardless of user presence.

Answer

Password hash synchronization

Answer

Delegated permissions only

Answer

Device code flow

Question 3

The team is writing an Azure Function that needs to retrieve secrets from Azure Key Vault at runtime. The security policy prohibits storing client secrets, connection strings, or certificates in application settings or source code. What is the recommended approach?

Accepted Answer

Enable a system-assigned managed identity on the Function App and grant it Key Vault Secrets User (or Get/List access policy) permission on the vault. A system-assigned managed identity provides a secure, credential-free way for an Azure Function to authenticate to Key Vault. Azure automatically manages the identity's lifecycle and tokens, eliminating the need to store any secrets in application settings or code. The Function App uses the managed identity to obtain an Azure AD token, which it presents to Key Vault to retrieve secrets, fully complying with the security policy.

Answer

Create an App Registration, generate a client secret, store the secret in an Application Setting, and authenticate using ClientSecretCredential

Answer

Generate a Key Vault SAS token and embed it in the function's connection string setting

Answer

Use the Key Vault REST API with the vault's access key embedded in the code

Question 4

Multiple teams need different levels of access to the same Azure Key Vault: the DevOps team needs to create and rotate secrets, the application team needs read-only secret access, and the auditing team needs list-only access. The security team wants audit logs of all access decisions and the ability to manage permissions through a single system. What access model should the developer recommend?

Accepted Answer

Use Azure RBAC for Key Vault with role assignments scoped per team: Key Vault Secrets Officer for DevOps, Key Vault Secrets User for the app team, and Key Vault Reader for auditing. Azure RBAC for Key Vault provides a unified, centralized access management system that meets all requirements. The Key Vault Secrets Officer role allows DevOps to create and rotate secrets, the Key Vault Secrets User role grants read-only access to the application team, and the Key Vault Reader role provides list-only access for auditing. Additionally, RBAC integrates with Azure Monitor to deliver audit logs of all access decisions, satisfying the security team's need for a single management plane.

Answer

Create separate access policies for each team with the minimum required permissions

Answer

Create a separate Key Vault per team to enforce isolation between access levels

Answer

Issue shared access signatures for each team scoped to the operations they need

Question 5

A background data pipeline runs on a schedule and must read user profile data from Microsoft Graph. No user is present during execution. The service authenticates to Microsoft Entra ID and calls the Graph API. Which permission type and OAuth 2.0 flow are correct for this scenario?

Accepted Answer

Application permissions with the client credentials flow, authenticating with the app's client ID and secret (or certificate). This scenario requires a background service to access Microsoft Graph without any user interaction. Application permissions are designed for such non-interactive, service-to-service calls, and the client credentials OAuth 2.0 flow (defined in RFC 6749 section 4.4) allows the app to authenticate using its own identity (client ID and secret or certificate) to obtain an access token. Delegated permissions would be incorrect because they require a signed-in user context, which is absent here.

Answer

Delegated permissions with the authorization code flow, initiating a browser redirect to collect user consent

Answer

Delegated permissions with the device code flow, prompting a user to authenticate on a separate device

Answer

Application permissions with the on-behalf-of flow, passing the calling user's token to the Graph API

Question 6

External partners are given Shared Access Signatures to upload product images to a specific Blob Storage container named 'images'. A partner reports accidentally uploading files to the 'contracts' container, which should not be accessible. What is the most likely configuration mistake?

Accepted Answer

The SAS was generated at the storage account level, granting write access that applies to multiple containers rather than being scoped to the 'images' container only. A SAS generated at the storage account level grants permissions across all containers within that account. When the SAS URI includes only the account endpoint (e.g., https://.blob.core.windows.net/) and a set of permissions (like write), the token can be used to access any container, including 'contracts'. To restrict access to a single container, the SAS must be scoped to the container resource URI (e.g., https://.blob.core.windows.net/images) and the signed resource type must be 'c' (container) or 'b' (blob), not 's' (service).

Answer

The SAS expiry time is too long, giving partners time to discover and access other containers

Answer

The partner used a storage account key instead of the provided SAS token

Answer

The SAS was signed with a stored access policy that did not name the correct container

Question 7

Twenty Azure Functions across different teams all need read access to the same Azure Cosmos DB account. The security team wants to revoke or modify this access for all twenty functions at once without visiting each Function App individually. What managed identity design satisfies this requirement?

Accepted Answer

Create one user-assigned managed identity, attach it to all twenty Function Apps, and grant it the Cosmos DB Built-in Data Reader role. A single user-assigned managed identity can be created once and then attached to all twenty Function Apps. Granting that identity the Cosmos DB Built-in Data Reader role at the Cosmos DB account scope means that revoking or modifying the role assignment centrally affects all functions simultaneously, without needing to visit each app individually.

Answer

Enable a system-assigned managed identity on each Function App and grant each identity the Cosmos DB Built-in Data Reader role

Answer

Create a service principal, store its client secret in Key Vault, and reference the secret from all twenty Function Apps via Key Vault references

Answer

Store the Cosmos DB connection string in Azure App Configuration and reference it from all twenty Function Apps

Question 8

Arrange the steps to create and use a shared access signature (SAS) for an Azure Storage blob in the correct order.

Accepted Answer

Create storage account, create container, upload blob, generate SAS, construct URL, then access.. First create storage and container, upload blob, generate SAS, construct URL, then access.

Answer

Upload blob, create storage account, create container, generate SAS, construct URL, then access.

Answer

Generate SAS, create storage account, create container, upload blob, construct URL, then access.

Answer

Create storage account, create container, generate SAS, upload blob, construct URL, then access.

Question 9

Arrange the steps to implement Azure Key Vault for storing and retrieving secrets in an application in the correct order.

Accepted Answer

Create Key Vault, then Add a secret, then Grant access to the secret, then Retrieve the secret, then Use the secret. The correct sequence for implementing Azure Key Vault is: first create the Key Vault, then add the secret, grant access to the secret (e.g., via access policies or RBAC), retrieve the secret in the application, and finally use it. This ensures proper resource creation and security before accessing sensitive data.

Answer

Create Key Vault, then Grant access to the secret, then Add a secret, then Retrieve the secret, then Use the secret

Answer

Create Key Vault, then Add a secret, then Retrieve the secret, then Grant access to the secret, then Use the secret

Answer

Add a secret, then Create Key Vault, then Grant access to the secret, then Retrieve the secret, then Use the secret

Question 10

Match each Azure compute service to its execution model.

Accepted Answer

Azure Functions: Serverless, event-driven compute that runs code in response to triggers. Azure compute services offer different execution models: Azure Functions (serverless, event-driven), Azure Logic Apps (serverless workflow), Azure Kubernetes Service (container orchestration). Common confusions involve associating serverless with containers or PaaS with orchestration.

Answer

Azure Container Instances: Serverless, event-driven compute that runs code in response to triggers

Answer

Azure App Service: Container orchestration for managing and scaling clusters of containerized applications

Question 11

You are developing a web app that uses Azure AD B2C for customer identity. The app must allow users to sign in with their social media accounts like Facebook and Google. Which Azure AD B2C policy type should you configure?

Accepted Answer

Sign-up and sign-in policy. The sign-up and sign-in policy (now called a user flow in the Azure portal) is the correct choice because it is the Azure AD B2C policy type specifically designed to handle both user registration and authentication in a single flow. This policy can be configured to include social identity providers like Facebook and Google, allowing users to sign in using those accounts. It orchestrates the OAuth 2.0 and OpenID Connect protocols to redirect users to the social provider's authorization endpoint and then process the returned tokens.

Answer

Profile editing policy

Answer

Password reset policy

Answer

Conditional access policy

Question 12

You are developing an API that processes sensitive personal data. The API is exposed via Azure API Management (APIM). You need to ensure that only authorized applications can call the API, and you want to validate the token at the APIM gateway without modifying the backend code. What is the most efficient approach?

Accepted Answer

Configure a validate-jwt policy in APIM inbound processing. The validate-jwt policy in APIM's inbound processing validates the OAuth 2.0 token at the gateway level, ensuring only authorized applications can call the API without modifying backend code. This is the most efficient approach because it offloads token validation to APIM, reducing backend complexity and centralizing security enforcement.

Answer

Implement token validation in the backend API code

Answer

Use APIM's OAuth 2.0 authorization server

Answer

Use subscription keys in APIM

Question 13

You have an Azure Storage account that hosts blobs for a public website. You need to grant a partner application read-only access to a specific container for 24 hours without using a storage account key. What should you create?

Accepted Answer

A shared access signature (SAS) URI with read permission and expiry set to 24 hours. A shared access signature (SAS) URI with read permission and a 24-hour expiry provides time-limited, delegated access to a specific container without exposing the storage account key. This meets the requirement for read-only access for exactly 24 hours, as the SAS token can be scoped to a single container and its permissions set to read.

Answer

An access policy for the container with read permission

Answer

A storage account key

Answer

A managed identity for the partner application

Question 14

Your company uses Microsoft Sentinel for security information and event management (SIEM). You need to detect and automatically respond to a potential credential theft attack where an anomalous number of failed logins are followed by a successful login from a different geographic location. Which Microsoft Sentinel feature should you use?

Accepted Answer

An analytics rule with an automated response. An analytics rule in Microsoft Sentinel can be configured to detect patterns like anomalous failed logins followed by a successful login from a different geography. The rule can then trigger an automated response, such as running a playbook or creating an incident, to remediate the threat in near real-time. This combines detection and automated action within a single rule, making it the correct choice for this scenario.

Answer

Microsoft Sentinel Data Connectors

Answer

Microsoft Defender for Identity

Answer

Microsoft Sentinel playbooks

Question 15

You are developing an Azure Function that processes messages from an Azure Service Bus queue. The function must use a managed identity to authenticate to the Service Bus to avoid managing secrets. Which configuration step is essential for this setup?

Accepted Answer

Enable system-assigned managed identity on the function app and assign the 'Azure Service Bus Data Receiver' role to the identity. Using a managed identity eliminates the need to manage secrets or connection strings. By enabling a system-assigned managed identity on the function app and assigning the 'Azure Service Bus Data Receiver' role to that identity, the function can authenticate to Azure Service Bus via Azure AD (OAuth 2.0) without any stored credentials. This is the recommended approach for secure, secretless authentication in Azure Functions.

Answer

Store the Service Bus connection string in the function app settings

Answer

Create a Key Vault reference to the connection string

Answer

Use the Service Bus SDK with a SharedAccessSignatureToken