AZ-204 Implement Azure security Practice Test 6 — 15 Questions

Question 1

Your company is deploying a multi-tier application on Azure. The application consists of a web front end, an API layer, and a database. You need to ensure secure communication between tiers. Which TWO actions should you take? (Choose two.)

Accepted Answer

Use TLS for all internal service-to-service communication. Option C is correct because TLS (Transport Layer Security) encrypts data in transit between application tiers, preventing eavesdropping and man-in-the-middle attacks. For internal service-to-service communication, using TLS ensures that sensitive data passed between the web front end, API layer, and database remains confidential and tamper-proof, which is a fundamental security best practice for multi-tier applications.

Answer

Enable HTTPS on the web front end

Answer

Enable Azure Storage encryption at rest

Answer

Use managed identities to authenticate between tiers

Question 2

You need to design a solution to securely store and access secrets (e.g., API keys, connection strings) for a set of Azure Functions. The solution must minimize administrative overhead and avoid storing secrets in code or configuration files. Which THREE should you include? (Choose three.)

Accepted Answer

Store secrets in Azure Key Vault. Azure Key Vault is the correct service for securely storing secrets like API keys and connection strings because it provides centralized, hardware-backed secret management with access policies and auditing. By referencing Key Vault secrets from Azure Functions via a managed identity, you avoid storing secrets in code or configuration files, which aligns with the requirement to minimize administrative overhead and eliminate plaintext secrets.

Answer

Store secrets in application settings as plain text

Answer

Use Azure App Configuration for feature flags

Question 3

Your company wants to implement a zero-trust security model for its Azure resources. Which THREE practices should you adopt? (Choose three.)

Accepted Answer

Implement just-in-time (JIT) access for administrative roles. Option A is correct because just-in-time (JIT) access for administrative roles reduces the attack surface by granting elevated permissions only when needed and for a limited time. In Azure, JIT is implemented via Azure AD Privileged Identity Management (PIM), which enforces activation requests, approval workflows, and automatic deactivation. This aligns with the zero-trust principle of 'never trust, always verify' by minimizing standing privileges.

Answer

Place all resources behind a firewall

Answer

Use a VPN to connect to the corporate network

Question 4

Refer to the exhibit. You have an Azure Policy definition as shown. Your team creates a storage account with network rules set to 'Deny' by default, and then adds an IP rule to allow traffic from a specific IP range. What compliance state will this storage account be reported as?

Accepted Answer

Compliant. The policy audits if the storage account type is 'Microsoft.Storage/storageAccounts' AND defaultAction equals 'Allow'. Since the defaultAction is 'Deny', the condition is false, so the resource is compliant. Option B is correct.

Answer

Error

Answer

Exempt

Answer

Non-compliant

Question 5

Refer to the exhibit. You are creating a custom Azure RBAC role. You assign this role to a user for the Production resource group. The user needs to read the contents of a blob in a container. Which permission is necessary for the user to list the container's blobs?

Accepted Answer

Microsoft.Storage/storageAccounts/blobServices/containers/blobs/list. The role includes 'Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read' data action for blob read, but does not include 'Microsoft.Storage/storageAccounts/blobServices/containers/read' action to list containers. However, the question asks to list blobs within a container, which requires 'Microsoft.Storage/storageAccounts/blobServices/containers/read' to list blobs? Actually, listing blobs is a data operation: 'Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read' allows reading blob content and properties but not listing? Wait, listing blobs requires the data action 'Microsoft.Storage/storageAccounts/blobServices/containers/blobs/list'? The exhibit shows only read, not list. But the options: Option A is the data action for reading blobs, but listing requires 'list' action. However, in Azure RBAC, 'list' is included in 'read' for blobs? Actually, the Microsoft documentation: 'Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read' allows reading blob content, but listing blobs requires 'Microsoft.Storage/storageAccounts/blobServices/containers/blobs/list'? No, listing is a separate operation. But the role only has read. The correct answer is Option D? Let's think: The user needs to read blob contents; the role already has 'blobs/read'. But the question says 'list the container's blobs' - that is a separate permission. The role does not include it. So the user cannot list blobs. But the options: Option A is 'Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read' - that is already present. Option B is 'Microsoft.Storage/storageAccounts/blobServices/containers/read' - that is for listing containers, not blobs. Option C is 'Microsoft.Storage/storageAccounts/blobServices/containers/blobs/list' - that is the correct permission for listing blobs. Option D is 'Microsoft.Storage/storageAccounts/read' - too broad. So Option C is needed to list blobs. But the question says 'Which permission is necessary' implying that the current role lacks it. So the user needs to add the list action. But the role already has the read action for blobs, but listing is not included. So the correct answer is Option C. However, the stem says 'The user needs to read the contents of a blob' and 'list the container's blobs' - but the role already has read, so to list they need list. The exhibit shows the role has 'blobs/read' data action. So the missing permission is 'list'. So Option C. But wait, the role also has 'actions' for 'containers/read' which is an ARM action, not data. That allows listing containers but not blobs. So indeed, to list blobs, you need the data action 'list'. So Option C is correct.

Answer

Microsoft.Storage/storageAccounts/read

Answer

Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read

Answer

Microsoft.Storage/storageAccounts/blobServices/containers/read

Question 6

Refer to the exhibit. You are using Azure CLI to list blobs in a container. The command fails with an authorization error. The storage account has firewall rules enabled, and you are running the CLI from a machine that is not on the allowed network list. What is the most likely cause of the failure?

Accepted Answer

The storage account firewall is blocking the request because your IP is not in the allow list. Firewall rules deny access from non-allowed IPs. Option A is correct. Option B is for data plane operations that require RBAC? However, the CLI can use storage account key or SAS; the error is likely due to firewall. Option C is about TLS, which would give a different error. Option D is about container level, but the command syntax is correct.

Answer

You do not have the 'Storage Blob Data Reader' role assigned

Answer

The container name is misspelled

Answer

The storage account requires TLS 1.2 and your CLI uses an older version

Question 7

You are developing a web app that authenticates users via Microsoft Entra ID. The app needs to call a downstream API on behalf of the signed-in user. Which OAuth 2.0 flow should you implement?

Accepted Answer

Authorization code flow with PKCE. Option C is correct because the authorization code flow with PKCE is the recommended flow for single-page apps and native apps that need to call APIs on behalf of the user. Option A is wrong because the implicit flow is deprecated and less secure. Option B is wrong because client credentials is for non-user scenarios. Option D is wrong because device code flow is for devices without browsers.

Answer

Client credentials flow

Answer

Implicit flow

Answer

Device code flow

Question 8

Your Azure App Service app must access Azure Key Vault secrets without storing credentials in code. Which service should you use to manage identities?

Accepted Answer

Managed identity. Option B is correct because managed identities provide an automatically managed identity for Azure resources to access Key Vault securely. Option A is wrong because service principals require manual credential management. Option C is wrong because certificates still require storage. Option D is wrong because shared access keys are for storage, not Key Vault.

Answer

Service principal with client secret

Answer

Storage account access key

Answer

Client certificate

Question 9

You need to restrict access to an Azure Storage blob container so that only users from your Microsoft Entra tenant can read blobs, and deny all other access including anonymous traffic. What should you configure?

Accepted Answer

Set public access level to private and assign RBAC roles to users. Option D is correct because disabling anonymous access and enabling Azure AD authentication with RBAC ensures only authenticated users from your tenant can access blobs. Option A is wrong because SAS tokens can be shared externally. Option B is wrong because firewall rules do not authenticate users. Option C is wrong because access keys provide full access, not user-specific.

Answer

Generate a shared access signature (SAS) for the container

Answer

Configure a network firewall to allow only your tenant's IP range

Answer

Use storage account access keys and distribute them to users

Question 10

You are deploying a sensitive application on Azure Kubernetes Service (AKS). You need to ensure that secrets, such as database connection strings, are encrypted at rest and in transit, and that the cluster has no static credentials. Which feature should you enable?

Accepted Answer

Use Azure Key Vault Provider for Secrets Store CSI Driver. Option B is correct because Azure Key Vault Provider for Secrets Store CSI Driver integrates with AKS to mount secrets as volumes without storing them in the cluster. Option A is wrong because etcd encryption is internal to Kubernetes and does not integrate with Key Vault. Option C is wrong because AKS does not offer disk encryption by default. Option D is wrong because managed identity alone does not store secrets.

Answer

Enable etcd encryption at rest

Answer

Enable Azure Disk Encryption on the node pools

Answer

Assign a managed identity to the AKS cluster

Question 11

Your company uses Azure API Management to expose APIs to external partners. You need to validate that each incoming request includes a valid JSON Web Token (JWT) issued by your Microsoft Entra ID tenant, and reject requests without valid tokens. What should you configure?

Accepted Answer

Add a validate-jwt policy in the inbound processing policy. Option D is correct because a validate-jwt policy in the inbound processing pipeline checks the token before the request reaches the backend. Option A is wrong because OAuth 2.0 authorization server doesn't validate tokens per request. Option B is wrong because subscription keys are not tokens. Option C is wrong because IP filtering does not validate tokens.

Answer

Configure an OAuth 2.0 authorization server in API Management

Answer

Require a subscription key for each API

Answer

Use an IP access restriction policy

Question 12

You are developing a serverless function using Azure Functions that needs to write logs to a Log Analytics workspace. The function uses a managed identity. Which RBAC role should you assign to the function's managed identity?

Accepted Answer

Log Analytics Contributor. The Log Analytics Contributor role is required because it grants the managed identity the necessary permissions to send data to a Log Analytics workspace, including the ability to create and manage data collection rules and write log data. This role is specifically designed for scenarios where an Azure resource, such as an Azure Function, needs to ingest logs into Log Analytics via the Data Collection API.

Answer

Log Analytics Reader

Answer

Monitoring Contributor

Answer

Storage Blob Data Contributor

Question 13

Your organization has a custom application that stores customer data in Azure Cosmos DB. You need to encrypt the data at rest using a customer-managed key stored in Azure Key Vault. Which type of Cosmos DB encryption should you configure?

Accepted Answer

Use customer-managed keys (CMK) with Azure Key Vault. Option A is correct because Cosmos DB supports encryption at rest with customer-managed keys (CMK) via Azure Key Vault. Option B is wrong because TDE is for SQL Server, not Cosmos DB. Option C is wrong because client-side encryption is separate. Option D is wrong because Azure Disk Encryption is for VMs.

Answer

Enable Azure Disk Encryption on the Cosmos DB instance

Answer

Enable Transparent Data Encryption (TDE)

Answer

Implement client-side encryption using the SDK

Question 14

You are designing a solution for a multi-tenant SaaS application where each tenant's data is stored in separate Azure SQL databases. You need to ensure that no tenant can access another tenant's database, even if the application is compromised. What should you implement?

Accepted Answer

Assign each tenant a managed identity with a dedicated SQL login and database-level permissions. Option D is correct because using a per-tenant managed identity with a separate SQL login and database-level permissions ensures isolation. Option A is wrong because a single identity with row-level security is vulnerable if the app is compromised. Option B is wrong because connection pooling does not enforce isolation. Option C is wrong because server-level firewall does not prevent app-layer attacks.

Answer

Configure a server-level firewall rule for each tenant's IP range

Answer

Implement connection pooling with a single identity

Answer

Use a single database-level login and row-level security (RLS) to filter data

Question 15

Your Azure Logic App needs to send emails using Microsoft Graph API on behalf of the signed-in user. The user is authenticated with Microsoft Entra ID. Which authentication method should you use in the Logic App?

Accepted Answer

Use OAuth 2.0 authorization code flow with delegated permissions. Option D is correct because the Logic App connector for Microsoft Graph supports OAuth 2.0 with user delegation. Option A is wrong because managed identity cannot act on behalf of a signed-in user. Option B is wrong because Basic Auth is not supported. Option C is wrong because client credentials flow is for app-only access.

Answer

Use a system-assigned managed identity

Answer

Use client credentials flow with an app registration

Answer

Use Basic authentication with user credentials