AZ-204 Implement Azure security Practice Test 8 — 15 Questions

Question 1

Which TWO actions should you take to secure an Azure Kubernetes Service (AKS) cluster that runs a critical workload? (Choose two.)

Accepted Answer

Enable Azure AD integration with Kubernetes RBAC. Integrating Azure AD with Kubernetes RBAC provides centralized identity management and fine-grained access control for the AKS cluster. This allows you to authenticate users via Azure AD and authorize their actions using Kubernetes RBAC roles, ensuring that only authenticated and authorized users can perform operations on the cluster, which is critical for securing a production workload.

Answer

Store secrets as Kubernetes secrets without encryption

Answer

Enable SSH access to all nodes for troubleshooting

Answer

Deploy Azure Firewall in the cluster VNet

Question 2

Which THREE components are required to implement Azure AD B2C custom policies for sign-up and sign-in? (Choose three.)

Accepted Answer

A user journey definition. A user journey definition is a core component of an Azure AD B2C custom policy. It orchestrates the sequence of technical profiles and orchestration steps that define the sign-up and sign-in experience, including self-asserted pages, multifactor authentication, and validation. Without a user journey, the policy cannot specify the flow of claims exchanges and user interactions.

Answer

An Azure AD (Microsoft Entra ID) tenant for employee identities

Answer

An Azure subscription

Question 3

Refer to the exhibit. You are reviewing an Azure Policy definition. When applied to a subscription, what is the effect of this policy?

Accepted Answer

Deny deployment of resources in locations other than eastus or westus. The policy definition uses the 'deny' effect with a condition that evaluates to true when the resource location is not equal to 'eastus' or 'westus'. This means any deployment attempt to a region outside these two will be blocked. The 'deny' effect prevents the resource creation entirely, rather than just auditing or modifying it.

Answer

Audit resources in locations other than eastus or westus

Answer

Append a tag to resources in eastus or westus

Answer

Deny deployment of resources in eastus or westus

Question 4

Refer to the exhibit. An administrator runs this Azure CLI command. What is the result?

Accepted Answer

Assigns the Reader role to a service principal at the resource group scope. The Azure CLI command `az role assignment create --assignee --role Reader --resource-group ` assigns the Reader role to a service principal (identified by its object ID) at the specified resource group scope. The Reader role grants read-only access to resources within that resource group, which matches the command's parameters and the expected outcome.

Answer

Assigns the Contributor role to a service principal at the resource group scope

Answer

Assigns a managed identity to the resource group

Answer

Assigns the Reader role to a user at the subscription scope

Question 5

Refer to the exhibit. You created a custom RBAC role definition. A user assigned this role at the subscription scope. What can the user do?

Accepted Answer

Read Azure SQL Database configurations and data. The custom RBAC role definition includes the 'Microsoft.Sql/servers/databases/read' action, which grants read access to Azure SQL Database configurations and data at the subscription scope. This action allows the user to view database settings and query data, but does not permit write or create operations.

Answer

Read any resource in the subscription

Answer

Write to Azure SQL Databases

Answer

Create new Azure SQL Databases

Question 6

Your web app running on Azure App Service requires access to a storage account using managed identity. You enable the system-assigned managed identity on the App Service and assign the 'Storage Blob Data Contributor' role at the storage account scope. However, the app receives 403 errors when trying to read blobs. What is the most likely cause?

Accepted Answer

The managed identity token is being requested with the wrong audience. You need to specify 'https://storage.azure.com' as the resource.. When using managed identity with Azure Storage, the access token must be requested with the correct audience (resource). For Azure Blob Storage, the audience must be 'https://storage.azure.com'. If the app requests the token with a different audience (e.g., the default Azure Resource Manager endpoint 'https://management.azure.com'), the token will be rejected by the storage service, resulting in a 403 error despite the role assignment being in place.

Answer

Managed identity is not supported for Azure App Service; use a connection string instead.

Answer

The role assignment has not propagated yet; wait 30 minutes.

Answer

The storage account has a firewall rule that blocks the App Service outbound IPs.

Question 7

You are designing a solution for a healthcare application that stores patient data in Azure Cosmos DB. The data must be encrypted at rest using a customer-managed key stored in Azure Key Vault. You need to ensure that the key can be rotated without downtime. Which approach should you recommend?

Accepted Answer

Enable automatic key rotation on the Key Vault key and use the key's versionless identifier in Cosmos DB.. Using a versionless key identifier in Azure Cosmos DB allows the service to automatically use the latest version of the customer-managed key stored in Azure Key Vault. When the key is rotated in Key Vault, Cosmos DB picks up the new version without any manual intervention, ensuring zero downtime and continuous encryption at rest.

Answer

Configure Azure Security Center to automatically rotate the key.

Answer

After rotating the key in Key Vault, manually update the Cosmos DB account with the new key version.

Answer

Use the Cosmos DB account key rotation feature to regenerate the key.

Question 8

You are deploying a function app that processes sensitive data. You need to ensure that all function app secrets (e.g., connection strings) are stored securely and automatically rotated. Which service should you use?

Accepted Answer

Azure Key Vault. Azure Key Vault is the correct service because it provides centralized, hardware-backed storage for secrets such as connection strings, API keys, and certificates. It supports automatic rotation policies via integration with Azure Event Grid and can be triggered by expiration events or custom logic, ensuring secrets are rotated without manual intervention. Function apps can securely reference Key Vault secrets using a managed identity, eliminating the need to store secrets in code or configuration files.

Answer

Azure Managed Identity

Answer

Azure App Configuration

Answer

Azure DevOps Variable Groups

Question 9

Your API is secured using Azure AD (now Microsoft Entra ID) tokens. You need to validate the token in your custom code. Which library should you use to validate the token's signature, issuer, and audience?

Accepted Answer

Microsoft.IdentityModel.Tokens and System.IdentityModel.Tokens.Jwt. The Microsoft.IdentityModel.Tokens and System.IdentityModel.Tokens.Jwt libraries provide the core token validation logic (signature verification, issuer, audience) that can be used in custom code, independent of any framework. These libraries implement the JWT validation pipeline as defined in RFC 7519, allowing you to call TokenValidationParameters and JwtSecurityTokenHandler.ValidateToken() to manually verify the token's integrity and claims.

Answer

ASP.NET Core Identity

Answer

Microsoft Graph SDK

Answer

Microsoft Authentication Library (MSAL)

Question 10

You have a multi-tenant application that uses Azure AD (Microsoft Entra ID) for authentication. You want to allow only specific tenants to access your app. What is the recommended approach?

Accepted Answer

In the application code, validate the 'tid' claim against a list of allowed tenant IDs.. The 'tid' claim in the Azure AD-issued token uniquely identifies the tenant. By validating this claim against a hardcoded list of allowed tenant IDs in your application code, you can enforce multi-tenant access control without relying on Azure AD tenant-level restrictions or issuer URL validation, which can be less precise.

Answer

Configure the app manifest to require user assignment and assign users from allowed tenants.

Answer

Validate the 'iss' claim to ensure it matches one of your allowed tenant issuer URLs.

Answer

Use Azure AD tenant restrictions to block all tenants except the allowed ones.

Question 11

Your application uses Azure Key Vault to store secrets. You need to ensure that the application can access secrets without storing any credentials in the application code or configuration files. What should you use?

Accepted Answer

Azure Managed Identity. Azure Managed Identity enables Azure resources (such as App Service, Functions, or VMs) to authenticate to Azure Key Vault without storing any credentials in code or configuration files. This is the recommended approach for secure access. Option A is correct. Option B is incorrect because Key Vault access policies control permissions but do not eliminate the need for authentication credentials. Option C is incorrect because a connection string inherently includes credentials, violating the requirement. Option D is incorrect because a client certificate still requires storing and managing the certificate, which introduces credential management overhead.

Answer

Key Vault access policies

Answer

A connection string with the secret

Answer

A client certificate stored in the application

Question 12

You are developing a serverless API using Azure Functions. The API should only be accessible from a specific virtual network. You need to configure network security. What should you do?

Accepted Answer

Configure a private endpoint for the Function App and disable public access.. To ensure the Azure Function API is *only* accessible from a specific virtual network, the most secure and direct approach is to configure a private endpoint for the Function App within that VNet. A private endpoint assigns a private IP address from your VNet to the Function App, making it accessible privately within the VNet. Crucially, you must then disable public access to the Function App. This combination ensures that all traffic must flow through the private endpoint from within the VNet, thereby meeting the requirement for network-level isolation and restricting access exclusively to the specified VNet. Option C's explanation is misleading as VNet integration primarily enables outbound connectivity, and an NSG on the VNet-integrated subnet does not directly block public internet access to the Function App's public endpoint.

Answer

Place the Functions in Azure API Management and configure IP restrictions.

Answer

Configure IP address restrictions on the Function App to allow only the VNet's public IP range.

Answer

Deploy the Function App in a Premium plan and configure VNet integration, then use a Network Security Group to restrict traffic.

Question 13

Your application uses Azure Key Vault to store cryptographic keys used for signing. You need to ensure that the keys can be used by multiple applications, but only one application should be able to delete the key. What should you do?

Accepted Answer

Assign the 'Key Vault Crypto Officer' role to the application that needs to delete, and 'Key Vault Crypto User' to others.. Azure RBAC for Key Vault allows granular permissions. The 'Key Vault Crypto Officer' role includes delete permission for keys, while the 'Key Vault Crypto User' role only allows cryptographic operations (sign, verify, encrypt, decrypt) without delete. This meets the requirement of allowing multiple applications to use keys but restricting deletion to one specific application.

Answer

Enable soft-delete and purge protection on the key vault.

Answer

Create a key rotation policy that automatically deletes old keys.

Answer

Configure the key vault firewall to allow only the authorized application's IP.

Question 14

Your application uses Azure App Service and needs to authenticate users via Microsoft Entra ID. You want to minimize code changes. Which feature should you use?

Accepted Answer

App Service Authentication (Easy Auth). App Service Authentication (also known as Easy Auth) is the correct choice because it enables authentication with Microsoft Entra ID (formerly Azure AD) at the platform level, requiring no code changes in your application. It automatically handles token validation, session management, and redirects by intercepting HTTP requests before they reach your app code, which directly satisfies the requirement to minimize code changes.

Answer

Azure AD B2C

Answer

Microsoft.Identity.Web library

Answer

MSAL.js

Question 15

Which TWO of the following are valid ways to authenticate an Azure function to an Azure SQL database using managed identity?

Accepted Answer

Create a user-assigned managed identity, assign it to the function app, and use its client ID in the connection string.. A user-assigned managed identity can be created, assigned to the function app, and then used in the SQL connection string by specifying the client ID (e.g., 'User ID=<client_id>;Authentication=Active Directory Managed Identity;'). This allows the function to authenticate to Azure SQL without storing credentials. Option E is also correct because enabling a system-assigned managed identity and setting the connection string with 'Authentication=Active Directory Managed Identity' lets the function app authenticate using its own identity, which is automatically managed by Azure.

Answer

Create a service principal and assign it to the function app.

Answer

Use the function app's default connection string with a username and password.

Answer

Upload a client certificate to the function app and use it to authenticate.