AZ-204 Implement Azure security Practice Test 9 — 15 Questions

Question 1

Which TWO permissions should be granted to an application's managed identity to allow it to read secrets from Azure Key Vault and use them to access Azure Storage?

Accepted Answer

Key Vault Secrets User role (includes get and list). To read secrets from Azure Key Vault, the Key Vault Secrets User role provides the necessary 'get' and 'list' permissions using the principle of least privilege. To access Azure Storage after retrieving a secret (e.g., a connection string), the Storage Blob Data Contributor role is required. Therefore, two distinct roles (D and E) satisfy the requirements. The Key Vault Secrets Officer role (B) would also allow reading secrets but grants excessive permissions beyond what is required for just reading, so it is not a least-privilege choice.

Answer

Key Vault Crypto User role

Answer

Key Vault Secrets Officer role (includes all operations)

Answer

Key Vault Reader role

Question 2

Refer to the exhibit. You are deploying an ARM template that assigns the 'Storage Blob Data Contributor' role to the managed identity of an App Service named 'myapp' at the storage account 'mystorageacct' scope. The deployment fails with an error that 'principalId' is null. What is the most likely cause?

Accepted Answer

The App Service 'myapp' does not have a managed identity enabled.. The error 'principalId' is null indicates that the ARM template is attempting to assign a role to a principal that does not exist. In this scenario, the principal is the managed identity of the App Service 'myapp'. If the App Service does not have a managed identity enabled, the 'principalId' property in the role assignment resource will be null, causing the deployment to fail. Enabling a system-assigned or user-assigned managed identity on the App Service is required before the role assignment can succeed.

Answer

The role definition ID is incorrect.

Answer

The storage account name 'mystorageacct' does not exist.

Answer

The role assignment name is not unique.

Question 3

Refer to the exhibit. You run the Azure CLI command to store a secret in Key Vault. Later, you run 'az keyvault secret show --vault-name myvault --name MySecret'. What will be displayed?

Accepted Answer

The secret's metadata and the value 'P@ssw0rd123'.. The `az keyvault secret show` command retrieves the secret's metadata along with its value in plaintext. When you store a secret using `az keyvault secret set`, the value is stored securely, and the `show` command returns the full secret object, including the `value` field, as demonstrated in the exhibit where the stored value is 'P@ssw0rd123'.

Answer

The secret's metadata only, without the value.

Answer

The secret's metadata with the value masked as '*****'.

Answer

An error because you cannot retrieve a secret after it is set.

Question 4

Refer to the exhibit. You deploy this ARM template to an App Service named 'myapp'. After deployment, users report they are able to access the app without being prompted to log in. What is the most likely reason?

Accepted Answer

The Azure Active Directory registration is missing the client secret.. The ARM template configures the `identityProviders` section with Azure Active Directory settings, but without a `clientSecret` property. The EasyAuth middleware requires a valid client secret to complete the OAuth 2.0 authorization code flow; without it, the authentication provider is effectively disabled, allowing unauthenticated access.

Answer

The redirect URI is not configured in the Azure AD app registration.

Answer

The issuer URL is incorrect; it should include the tenant ID.

Answer

The client ID is from a different tenant.

Question 5

A company stores sensitive data in Azure Blob Storage. They require that all access to the storage account be authenticated via Microsoft Entra ID and that users must have the 'Storage Blob Data Reader' role assigned. A developer reports being unable to read blobs using the Azure portal despite having the role assigned. What is the most likely cause?

Accepted Answer

The user does not have the Azure RBAC Reader role on the storage account's resource group to view the storage account in the portal.. The Azure portal requires the 'Reader' role on the storage account's resource group (or subscription) to list and navigate to the storage account in the portal UI. Even if a user has 'Storage Blob Data Reader' at the storage account scope, without the Azure RBAC 'Reader' role on the resource group, the portal cannot enumerate the storage account resource, preventing access via the portal. The 'Storage Blob Data Reader' role only grants data-plane permissions (read blobs), not control-plane permissions needed to see the resource in the portal.

Answer

The storage account firewall is blocking the user's IP address.

Answer

The storage account is using a system-assigned managed identity for authentication.

Answer

The role is assigned at the storage account scope but the user is trying to access a different storage account.

Question 6

You are configuring an Azure App Service web app to authenticate users with Microsoft Entra ID. You need to ensure that only users from your organization's tenant can access the app. Which setting should you configure?

Accepted Answer

Set the Issuer URL to https://login.microsoftonline.com/{tenant-id}/v2.0. Setting the Issuer URL to `https://login.microsoftonline.com/{tenant-id}/v2.0` restricts token validation to only tokens issued by your specific Microsoft Entra ID tenant. This ensures that only users from your organization's tenant can authenticate, as the app will reject tokens from other tenants or the common endpoint.

Answer

Set the Issuer URL to https://login.microsoftonline.com/common/v2.0

Answer

Set the Client ID to the application's Application ID.

Answer

Set the Allowed token audiences to include the app's Application ID URI.

Question 7

A company uses Azure API Management (APIM) to expose APIs to external partners. They want to validate JSON Web Tokens (JWTs) from partners' Microsoft Entra ID tenants before requests reach the backend. The solution must support multiple partner tenants and minimize latency. What should you implement?

Accepted Answer

Use APIM inbound policy with validate-jwt and specify openid-config URL for each partner tenant.. The `validate-jwt` policy in APIM can be configured with an `openid-config` URL for each partner tenant, allowing APIM to fetch the tenant-specific signing keys and validate JWTs issued by any Microsoft Entra ID tenant. This approach supports multiple tenants without adding a broker or per-tenant authorization servers, and it minimizes latency by performing validation at the APIM gateway before requests reach the backend.

Answer

Use Azure AD B2C as a token broker between partners and the API.

Answer

Configure OAuth 2.0 authorization server in APIM for each partner tenant.

Answer

Use client certificate authentication in APIM to map certificates to partner tenants.

Question 8

You are developing a serverless application using Azure Functions that processes sensitive data. The function needs to access Azure Key Vault to retrieve a secret. You want to use managed identity for authentication. What should you do first?

Accepted Answer

Enable the system-assigned managed identity on the function app and grant it the Key Vault Secrets User role.. To use managed identity for authentication with Azure Key Vault, the first step is to enable a system-assigned managed identity on the function app, which creates an identity in Azure AD tied to the resource. Then, you must grant that identity the appropriate role (e.g., Key Vault Secrets User) on the Key Vault to authorize secret retrieval. This eliminates the need for storing credentials in code or configuration.

Answer

Enable the system-assigned managed identity on the Key Vault.

Answer

Store the client ID and client secret of a service principal in the function app settings.

Answer

Create a user-assigned managed identity and assign it to the Key Vault.

Question 9

A company uses Azure SQL Database and needs to encrypt sensitive columns (e.g., credit card numbers) at rest and in transit, with the ability to allow specific applications to decrypt. They want to manage encryption keys centrally in Azure Key Vault and avoid managing certificates. Which technology should they use?

Accepted Answer

Always Encrypted with column master key in Azure Key Vault.. Always Encrypted with a column master key stored in Azure Key Vault is the correct choice because it encrypts sensitive columns (like credit card numbers) at rest and in transit, ensuring data remains encrypted throughout the entire pipeline, including during query processing. The column master key in Azure Key Vault allows centralized key management without handling certificates, and only applications with access to the corresponding column encryption key can decrypt the data, meeting the requirement for application-specific decryption.

Answer

Transparent Data Encryption (TDE) with Azure Key Vault.

Answer

Dynamic Data Masking (DDM) with Azure Key Vault.

Answer

Row-Level Security (RLS) with Azure Key Vault.

Question 10

You are deploying an Azure Kubernetes Service (AKS) cluster. You need to ensure that pods can access Azure resources (e.g., Azure Storage) using a managed identity without storing credentials. What should you configure?

Accepted Answer

Use Azure AD Workload Identity for Kubernetes (or aad-pod-identity) to assign managed identities to pods.. Azure AD Workload Identity (or the older aad-pod-identity) allows you to assign an Azure managed identity to a pod. The pod can then authenticate to Azure resources (e.g., Azure Storage) without storing any credentials, as the identity is projected into the pod via token exchange with the Azure Instance Metadata Service (IMDS). This directly meets the requirement of using a managed identity without credential storage.

Answer

Configure Azure AD integration on the AKS cluster for user authentication.

Answer

Create a service principal and distribute its secret to pods as a Kubernetes secret.

Answer

Enable managed identity on the AKS cluster and use cluster-level identity.

Question 11

Your organization uses Azure Key Vault to store secrets. Developers need to retrieve secrets during application runtime. You want to minimize latency and avoid network overhead. Which approach should you recommend?

Accepted Answer

Implement caching of secrets in the application with a short time-to-live (TTL) and use Key Vault as the source of truth.. It directly addresses the need to minimize latency and network overhead by caching secrets locally with a short TTL, while still using Azure Key Vault as the authoritative source. This pattern reduces the frequency of network calls to Key Vault, which is critical for high-throughput applications where every millisecond matters. The short TTL ensures that secret updates are eventually reflected without stale data persisting indefinitely.

Answer

Enable the Key Vault firewall and allow only trusted Azure services.

Answer

Store the secrets directly in application configuration files.

Answer

Enable Key Vault soft-delete to ensure secrets are recoverable.

Question 12

You are designing a solution that uses Azure Event Hubs to ingest telemetry data. The data must be encrypted at rest and in transit. Additionally, you need to ensure that only authorized applications can publish messages to the event hub. Which combination of features should you use?

Accepted Answer

Use SAS tokens or managed identities for authentication, and rely on default encryption at rest and in transit.. Azure Event Hubs automatically encrypts data at rest with Azure Storage Service Encryption (SSE) and in transit with TLS 1.2. For authorization, SAS tokens or managed identities provide the necessary application-level authentication to publish messages. This combination meets all stated requirements without additional configuration.

Answer

Use managed identities for applications and enable encryption at rest using customer-managed keys.

Answer

Use Azure Private Link to connect applications to Event Hubs.

Answer

Enable Azure Firewall on the Event Hubs namespace and use IP filtering.

Question 13

Which TWO actions should you take to secure an Azure Function app that is triggered by an HTTP request? (Choose two.)

Accepted Answer

Enable App Service Authentication and configure Microsoft Entra ID as the identity provider.. Enabling App Service Authentication with Microsoft Entra ID (formerly Azure AD) provides a managed identity layer that validates JWT tokens from Microsoft Entra ID before the request reaches your function code. This ensures only authenticated users or applications can invoke the HTTP-triggered function, offloading token validation and session management from your code. Option C is correct because storing secrets in Azure Key Vault and referencing them via Key Vault references (syntax @Microsoft.KeyVault(SecretUri=...)) in the function app settings prevents hardcoding credentials in configuration files or source code, aligning with the principle of least privilege and secure secret management.

Answer

Use function-level authorization keys (function or admin keys) for all HTTP triggers.

Answer

Set the function app's public access to 'Off' and use virtual network integration.

Answer

Enable Cross-Origin Resource Sharing (CORS) with allowed origins set to '*'.

Question 14

Which TWO methods can you use to authenticate an Azure App Service web app to Azure SQL Database without storing credentials in code? (Choose two.)

Accepted Answer

Store the SQL connection string in Azure Key Vault and use a Key Vault reference in the app settings.. Azure App Service supports Key Vault references in application settings, allowing you to reference secrets stored in Azure Key Vault without hardcoding credentials. This pattern uses the Managed Service Identity (MSI) of the App Service to authenticate to Key Vault at runtime, retrieving the SQL connection string securely. Option B is correct because enabling a system-assigned managed identity on the App Service and granting it access to the Azure SQL Database via an Azure AD user or contained database user eliminates the need for any stored credentials, as the app authenticates directly to SQL using the managed identity token.

Answer

Use a connection string with a SQL username and password.

Answer

Use a service principal with a client secret stored in app settings.

Answer

Use a client certificate installed on the App Service.

Question 15

Refer to the exhibit. You have a custom RBAC role definition. A user assigned this role reports they can read, write, and delete blobs, but cannot list the containers in the storage account. What is the most likely reason?

Accepted Answer

The user does not have the Reader role on the storage account to navigate in the Azure portal.. The user can perform blob operations (read, write, delete) because the custom RBAC role includes the necessary data actions (e.g., Microsoft.Storage/storageAccounts/blobServices/containers/blobs/*). However, listing containers requires the control plane action Microsoft.Storage/storageAccounts/blobServices/containers/read, which is not included in the role. Without the Reader role on the storage account (which grants this action), the user cannot list containers in the Azure portal, even though they can interact with blobs directly via tools that bypass the portal's container enumeration.

Answer

The role does not grant delete permissions on containers.

Answer

The role lacks dataActions for reading blobs.

Answer

The role does not include the action to list containers.