AZ-204 Implement Azure security Practice Test 7 — 15 Questions

Question 1

You need to restrict access to an Azure web app so that only traffic from a specific virtual network (VNet) can reach it. The web app is already deployed. What should you configure on the web app?

Accepted Answer

Access restrictions. Access restrictions (also known as IP restrictions) allow you to define allow/deny rules based on source IP addresses or Virtual Network (VNet) service endpoints. By configuring a service endpoint-based rule that permits traffic only from your specific VNet, you can block all other inbound traffic to the web app. This is the correct mechanism for restricting access at the web app level without modifying the underlying infrastructure.

Answer

VNet integration

Answer

Network Security Group (NSG) on the subnet

Answer

Point-to-Site VPN

Question 2

Your organization uses Azure Policy to enforce compliance. You need to ensure that all Azure SQL databases have Advanced Data Security (ADS) enabled. What type of Azure Policy effect should you use to automatically enable ADS if it is not already enabled?

Accepted Answer

DeployIfNotExists. DeployIfNotExists effect can automatically enable Advanced Data Security (ADS) on Azure SQL databases if it is not already enabled, by deploying the necessary configuration. Option A (Audit) only audits compliance but does not remediate. Option B (Modify) is typically used for tags and not for enabling ADS. Option C (Deny) blocks creation of non-compliant resources but does not automatically enable ADS on existing resources. Therefore, D is correct.

Answer

Audit

Answer

Modify

Answer

Deny

Question 3

You need to design a solution to securely store and access secrets (e.g., API keys, connection strings) for a set of Azure Functions. The solution must minimize administrative overhead and avoid storing secrets in code or configuration files. Which THREE should you include? (Choose three.)

Accepted Answer

Store secrets in Azure Key Vault. Azure Key Vault is the correct service for securely storing secrets like API keys and connection strings because it provides centralized, hardware-backed secret management with access policies and auditing. By referencing Key Vault secrets from Azure Functions via a managed identity, you avoid storing secrets in code or configuration files, which aligns with the requirement to minimize administrative overhead and eliminate plaintext secrets. Enabling Key Vault soft-delete and purge protection is a critical security best practice to prevent accidental or malicious permanent deletion of secrets, ensuring data resilience and compliance, which is essential for a robust 'secure solution'.

Answer

Store secrets in application settings as plain text

Answer

Use Azure App Configuration for feature flags

Question 4

Your company wants to implement a zero-trust security model for its Azure resources. Which THREE practices should you adopt? (Choose three.)

Accepted Answer

Implement just-in-time (JIT) access for administrative roles. Just-in-time (JIT) access for administrative roles reduces the attack surface by granting elevated permissions only when needed and for a limited time. In Azure, JIT is implemented via Azure AD Privileged Identity Management (PIM), which enforces activation requests, approval workflows, and automatic deactivation. This aligns with the zero-trust principle of 'never trust, always verify' by minimizing standing privileges.

Answer

Place all resources behind a firewall

Answer

Use a VPN to connect to the corporate network

Question 5

Refer to the exhibit. You have an Azure Policy definition as shown. Your team creates a storage account with network rules set to 'Deny' by default, and then adds an IP rule to allow traffic from a specific IP range. What compliance state will this storage account be reported as?

Accepted Answer

Compliant. The Azure Policy definition in the exhibit uses the 'DenyAction' effect, which only denies or audits specific actions (such as 'Microsoft.Storage/storageAccounts/write'). It does not evaluate the configuration of network rules on the storage account. Therefore, the storage account's network rule settings (defaultAction 'Deny' and IP rule) have no bearing on compliance with this policy. The resource is compliant because the policy's condition does not apply to network rules, and the write action was not blocked since the account was created successfully.

Answer

Error

Answer

Exempt

Answer

Non-compliant

Question 6

Refer to the exhibit. You are using Azure CLI to list blobs in a container. The command fails with an authorization error. The storage account has firewall rules enabled, and you are running the CLI from a machine that is not on the allowed network list. What is the most likely cause of the failure?

Accepted Answer

The storage account firewall is blocking the request because your IP is not in the allow list. The storage account firewall explicitly blocks all traffic except from IP addresses or subnets in the allow list. Since the CLI is running from a machine whose IP is not on that list, the request is denied at the network layer before any authentication or authorization checks occur. This is the most direct cause of the authorization error.

Answer

You do not have the 'Storage Blob Data Reader' role assigned

Answer

The container name is misspelled

Answer

The storage account requires TLS 1.2 and your CLI uses an older version

Question 7

You are developing a web app that authenticates users via Microsoft Entra ID. The app needs to call a downstream API on behalf of the signed-in user. Which OAuth 2.0 flow should you implement?

Accepted Answer

Authorization code flow with PKCE. The authorization code flow with PKCE is the correct choice because the app needs to authenticate a signed-in user and then call a downstream API on their behalf. This flow securely exchanges an authorization code for an access token, and PKCE (Proof Key for Code Exchange) prevents authorization code interception attacks, which is essential for public clients like web apps. It is the recommended OAuth 2.0 flow for single-page apps and native apps, but also applicable to web apps that require high security.

Answer

Client credentials flow

Answer

Implicit flow

Answer

Device code flow

Question 8

Your Azure App Service app must access Azure Key Vault secrets without storing credentials in code. Which service should you use to manage identities?

Accepted Answer

Managed identity. Managed identity (B) is correct because it provides an automatically managed Azure AD identity for your App Service app, allowing it to authenticate to Azure Key Vault without storing any credentials in code or configuration. The identity is tied to the app's lifecycle and can be used with Azure RBAC to grant access to secrets, eliminating the need for manual credential management.

Answer

Service principal with client secret

Answer

Storage account access key

Answer

Client certificate

Question 9

You need to restrict access to an Azure web app so that only traffic from a specific virtual network (VNet) can reach it. The web app is already deployed. What should you configure on the web app?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Set public access level to private and assign RBAC roles to users. Setting the public access level to private disables anonymous access, and assigning RBAC roles such as Storage Blob Data Reader to Entra ID users ensures only authenticated users from your tenant can read blobs. Option A is incorrect because a SAS token can be shared externally, allowing access to users outside your tenant. Option C is incorrect because a network firewall only restricts by IP address and does not authenticate users; anonymous traffic from allowed IPs would still be permitted. Option D is incorrect because storage account access keys grant full administrative access to the account, not read-only access for specific users, and distributing keys is insecure.

Answer

Generate a shared access signature (SAS) for the container

Answer

Configure a network firewall to allow only your tenant's IP range

Answer

Use storage account access keys and distribute them to users

Question 10

You are deploying a sensitive application on Azure Kubernetes Service (AKS). You need to ensure that secrets, such as database connection strings, are encrypted at rest and in transit, and that the cluster has no static credentials. Which feature should you enable?

Accepted Answer

Use Azure Key Vault Provider for Secrets Store CSI Driver. The Azure Key Vault Provider for Secrets Store CSI Driver integrates with AKS to securely fetch secrets from Azure Key Vault, encrypting them at rest (Key Vault uses AES-256) and in transit (TLS 1.2+). It eliminates static credentials by using a managed identity or service principal to authenticate to Key Vault, ensuring no secrets are stored on disk or in etcd.

Answer

Enable etcd encryption at rest

Answer

Enable Azure Disk Encryption on the node pools

Answer

Assign a managed identity to the AKS cluster

Question 11

Your company uses Azure API Management to expose APIs to external partners. You need to validate that each incoming request includes a valid JSON Web Token (JWT) issued by your Microsoft Entra ID tenant, and reject requests without valid tokens. What should you configure?

Accepted Answer

Add a validate-jwt policy in the inbound processing policy. The validate-jwt policy is the correct choice because it allows API Management to inspect the JWT token in the inbound request, verify its signature against the Microsoft Entra ID tenant’s keys, and enforce claims such as issuer and audience. This policy rejects requests with missing, expired, or invalid tokens, meeting the requirement to validate each incoming request.

Answer

Configure an OAuth 2.0 authorization server in API Management

Answer

Require a subscription key for each API

Answer

Use an IP access restriction policy

Question 12

You are developing a serverless function using Azure Functions that needs to write logs to a Log Analytics workspace. The function uses a managed identity. Which RBAC role should you assign to the function's managed identity?

Accepted Answer

Log Analytics Contributor. The Log Analytics Contributor role is required because it grants the managed identity the necessary permissions to send data to a Log Analytics workspace, including the ability to create and manage data collection rules and write log data. This role is specifically designed for scenarios where an Azure resource, such as an Azure Function, needs to ingest logs into Log Analytics via the Data Collection API.

Answer

Log Analytics Reader

Answer

Monitoring Contributor

Answer

Storage Blob Data Contributor

Question 13

Your organization has a custom application that stores customer data in Azure Cosmos DB. You need to encrypt the data at rest using a customer-managed key stored in Azure Key Vault. Which type of Cosmos DB encryption should you configure?

Accepted Answer

Use customer-managed keys (CMK) with Azure Key Vault. Azure Cosmos DB supports customer-managed keys (CMK) integrated with Azure Key Vault to encrypt data at rest. This allows you to bring your own key (BYOK) and control key rotation, revocation, and access policies, meeting the requirement for a customer-managed key stored in Azure Key Vault.

Answer

Enable Azure Disk Encryption on the Cosmos DB instance

Answer

Enable Transparent Data Encryption (TDE)

Answer

Implement client-side encryption using the SDK

Question 14

You are designing a solution for a multi-tenant SaaS application where each tenant's data is stored in separate Azure SQL databases. You need to ensure that no tenant can access another tenant's database, even if the application is compromised. What should you implement?

Accepted Answer

Assign each tenant a managed identity with a dedicated SQL login and database-level permissions. Assigning each tenant a managed identity with a dedicated SQL login and database-level permissions ensures that even if the application is compromised, the attacker cannot access another tenant's database. Managed identities provide an Azure AD-backed identity for the application, and by mapping each tenant to a separate SQL login with permissions scoped to their specific database, you enforce tenant isolation at the database authentication and authorization layer. This prevents cross-tenant access because the application can only authenticate to the database corresponding to the tenant's managed identity.

Answer

Configure a server-level firewall rule for each tenant's IP range

Answer

Implement connection pooling with a single identity

Answer

Use a single database-level login and row-level security (RLS) to filter data

Question 15

Your Azure Logic App needs to send emails using Microsoft Graph API on behalf of the signed-in user. The user is authenticated with Microsoft Entra ID. Which authentication method should you use in the Logic App?

Accepted Answer

Use OAuth 2.0 authorization code flow with delegated permissions. The OAuth 2.0 authorization code flow with delegated permissions is correct because the Logic App needs to act on behalf of the signed-in user, not as an application itself. This flow allows the user to authenticate via Microsoft Entra ID and grant the Logic App delegated permissions to call Microsoft Graph API (e.g., to send emails as the user). The authorization code is exchanged for an access token that includes the user's context, enabling the API to enforce user-level permissions.

Answer

Use a system-assigned managed identity

Answer

Use client credentials flow with an app registration

Answer

Use Basic authentication with user credentials