AZ-204 Implement Azure security — Timed 15 Questions

Question 1

An API receives JWT access tokens from Microsoft Entra ID. Which two token properties should the API validate before accepting a request? The design must avoid adding custom operational scripts.

Accepted Answer

Issuer and signature are valid for the trusted tenant. The API must validate that the JWT's issuer (iss claim) matches the trusted tenant's issuer URL (e.g., https://login.microsoftonline.com/{tenant-id}/v2.0) and that the token's cryptographic signature is valid using the public keys from the OpenID Connect discovery endpoint. This ensures the token was genuinely issued by Microsoft Entra ID for the expected tenant and has not been tampered with. Additionally, the API must validate the token's audience (aud claim) to ensure it matches the API's own Application ID URI or client ID. This confirms the token was specifically intended for this API and not for another application.

Answer

The user's display name is present

Answer

The token was sent in a query string

Question 2

Match each Azure authentication mechanism to its description.

Accepted Answer

Azure Active Directory (Azure AD): Microsoft's cloud-based identity and access management service. These are key authentication mechanisms in Azure. Azure AD is the identity service; Managed Identities are automatic service principals; Service Principals are explicit identities for apps; SAS tokens grant limited access to storage.

Answer

Managed Identity: A secret key used to authenticate to Azure SQL Database

Answer

Service Principal: A user account in Azure AD for human users

Question 3

You are implementing a microservices solution on Azure Kubernetes Service (AKS). You need to securely store and retrieve connection strings to a database without hardcoding them in the application code. The solution should automatically rotate secrets every 90 days. What should you use?

Accepted Answer

Azure Key Vault with Key Vault Secrets Provider for AKS. Azure Key Vault with the Key Vault Secrets Provider for AKS allows mounting secrets as volumes, and Key Vault supports automatic rotation and versioning. Option A is correct because it integrates rotation. Option B lacks automatic rotation and is less secure than Key Vault for sensitive secrets. Option C (Azure Managed Identity) is an authentication mechanism for applications to access Azure resources, not a solution for storing and automatically rotating database connection strings. While it can be used by pods in AKS to access Key Vault, it doesn't fulfill the core requirement of secret storage and rotation. Option D (Azure App Configuration) is primarily for managing application settings and feature flags. While it can store key-value pairs, it is not designed as a secure secret store with built-in rotation capabilities for sensitive data like database connection strings, unlike Azure Key Vault.

Answer

Kubernetes Secrets with a CronJob to update them

Answer

Azure Managed Identity for the pod

Answer

Azure App Configuration with a managed identity

Question 4

Your company uses Azure DevOps for CI/CD. The security team requires that all pull request (PR) merges to the main branch be signed with a valid code signing certificate to ensure code integrity. Which Azure DevOps feature should you enforce?

Accepted Answer

Set up branch protection with 'Require a merge commit' and enable 'Require signed commits'. Branch policies in Azure DevOps allow you to enforce rules on branches. The 'Require signed commits' policy ensures that all commits pushed to the branch (including those introduced by a PR merge) have a valid GPG or S/MIME signature, which can be configured to require a valid signature from a trusted certificate. This directly addresses the requirement for signed PR merges. 'Require a merge commit' is a separate branch policy that enforces a specific merge strategy, but it does not directly enforce commit signing. Option C (Azure Policy) is for governing Azure resources, not Azure DevOps repository policies. Option D (build validation step) is for pipeline checks, not for enforcing commit signing at the Git level before a merge is allowed.

Answer

Configure a service hook to validate signatures using Azure Functions

Answer

Use Azure Policy to require code signing on the repository

Answer

Add a build validation step in the PR pipeline that checks signatures

Question 5

Your company is deploying a multi-tier application on Azure. The application consists of a web front end, an API layer, and a database. You need to ensure secure communication between tiers. Which TWO actions should you take? (Choose two.)

Accepted Answer

Use TLS for all internal service-to-service communication. TLS (Transport Layer Security) encrypts data in transit between application tiers, preventing eavesdropping and man-in-the-middle attacks. For internal service-to-service communication, using TLS ensures that sensitive data passed between the web front end, API layer, and database remains confidential and tamper-proof. Additionally, configuring Network Security Groups (NSGs) to enforce strict communication rules (e.g., web to API, API to database only) provides network-level segmentation, limiting the attack surface and ensuring that only authorized tiers can communicate with each other, which are fundamental security best practices for multi-tier applications.

Answer

Enable HTTPS on the web front end

Answer

Enable Azure Storage encryption at rest

Answer

Use managed identities to authenticate between tiers

Question 6

Refer to the exhibit. You are creating a custom Azure RBAC role. You assign this role to a user for the Production resource group. The user needs to read the contents of a blob in a container. Which permission is necessary for the user to list the container's blobs?

Accepted Answer

Microsoft.Storage/storageAccounts/blobServices/containers/blobs/list. Listing blobs within a container is a data operation that requires a specific permission. The 'Microsoft.Storage/storageAccounts/blobServices/containers/blobs/list' permission enables the user to enumerate blobs in a container. This is distinct from reading the content of a specific blob, which would require a 'read' permission. Therefore, Option A is the necessary permission for listing the container's blobs.

Answer

Microsoft.Storage/storageAccounts/read

Answer

Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read

Answer

Microsoft.Storage/storageAccounts/blobServices/containers/read

Question 7

Which TWO services can be used to manage secrets and certificates for applications running on Azure? (Choose two.)

Accepted Answer

Azure Key Vault. Azure Key Vault is a cloud service for securely storing and accessing secrets, keys, and certificates. It provides centralized management, access control via Azure RBAC and policies, and integration with Azure services like VMs and App Services for certificate deployment and secret injection at runtime. Azure Automation can also store secrets as encrypted variables and certificates as assets, which can then be used by automation runbooks and other integrated services.

Answer

Azure App Configuration

Answer

Azure Active Directory Certificate Services

Answer

Azure Policy

Question 8

Which TWO of the following are benefits of using Azure Key Vault to store application secrets?

Accepted Answer

Centralized management of secrets with access policies.. Azure Key Vault provides a centralized store for application secrets, such as connection strings and API keys, with fine-grained access control through access policies. These policies allow you to grant specific permissions (e.g., GET, LIST, SET) to individual security principals (users, groups, or service principals), ensuring only authorized entities can access secrets. This centralization simplifies secret management across multiple applications and environments. Additionally, Key Vault integrates with Azure Monitor and Log Analytics, enabling comprehensive auditing and logging of all secret access and management operations, which is crucial for security and compliance.

Answer

Improved application performance by caching secrets.

Answer

Integration with Azure DevOps for automatic secret rotation in pipelines.

Answer

Automatic encryption of secrets at rest and in transit.

Question 9

A company uses Azure Logic Apps to orchestrate workflows that process sensitive data. They need to ensure that workflow runs are logged and auditable, and that the logs are tamper-proof. Which Azure service should they use?

Accepted Answer

Azure Blob Storage with immutable storage policy.. Azure Logic Apps can be configured to send their diagnostic logs to an Azure Storage Account. By applying an immutable storage policy (Write Once, Read Many - WORM) to the container or blobs in that Storage Account, the logs become tamper-proof for the specified retention period, directly meeting the requirement for tamper-proof auditing. This is a standard and direct method for achieving WORM compliance for Azure service diagnostic logs.

Answer

Azure Monitor Log Analytics workspaces.

Answer

Microsoft Sentinel.

Answer

Microsoft Purview Audit (Premium).

Question 10

Which THREE measures can you use to protect data at rest in Azure Cosmos DB? (Choose three.)

Accepted Answer

Enable encryption at rest using Microsoft-managed keys.. Azure Cosmos DB automatically encrypts all data at rest using AES-256 encryption. By default, this is done with Microsoft-managed keys (Option A), ensuring data stored on disk is protected. For enhanced control, customers can configure customer-managed keys (CMK) in Azure Key Vault (Option C), allowing them to manage their own encryption keys. Additionally, using Azure Role-Based Access Control (RBAC) (Option B) is crucial to restrict who can access the Cosmos DB account and its data, thereby protecting data at rest from unauthorized users.

Answer

Enforce TLS 1.2 for all client connections.

Answer

Deploy Azure Firewall in front of the Cosmos DB account.

Question 11

You need to secure access to an Azure Storage account that contains sensitive data. Which TWO of the following are recommended best practices?

Accepted Answer

Use managed identities to access storage from Azure services. Managed identities provide an automatically managed identity in Azure AD, allowing Azure services (e.g., Azure Functions, App Services) to authenticate to Azure Storage without storing any credentials in code or configuration. This eliminates the risk of key leakage and simplifies access management, making it a security best practice. Additionally, configuring firewall rules for Azure Storage allows you to restrict access to specific IP addresses or virtual networks (VNets), ensuring that only authorized clients from trusted network locations can connect to your storage account. This is a fundamental security layer and a critical best practice for protecting sensitive data.

Answer

Rotate storage account keys every 24 hours

Answer

Use SAS tokens with long expiry dates

Answer

Enable anonymous public access for all containers

Question 12

Refer to the exhibit. You are configuring a Key Vault key using an ARM template. What does this configuration achieve?

Accepted Answer

The key will be rotated 90 days after creation. The ARM template configuration sets the rotation policy with an expiry time and a 'timeAfterCreate' property relative to creation. The 'timeAfterCreate' value of 'P90D' means the key will be rotated 90 days after creation, not before expiration. This is achieved by specifying a rotation policy that triggers a new key version at a fixed interval from the key's creation date.

Answer

The key can only be used for encryption

Answer

The key size is 4096 bits

Answer

The key will be rotated 90 days before expiration

Question 13

Refer to the exhibit. You create a custom RBAC role with the shown permissions. You assign this role to a user at the resource group scope. What can the user do?

Accepted Answer

Read secrets from Key Vaults in the resource group. The role includes read access to Key Vaults and secrets within those vaults, allowing the user to read secrets from Key Vaults in the resource group. Option A is correct. Option B is incorrect because assigning the same role to other users requires Microsoft.Authorization/roleAssignments/write permission, which is not included. Option C is incorrect because deleting secrets requires Microsoft.KeyVault/vaults/secrets/delete permission, which is not included. Option D is incorrect because creating new Key Vaults requires Microsoft.KeyVault/vaults/write permission, which is not included in the read-only role.

Answer

Assign the same role to other users

Answer

Delete secrets from Key Vaults in the resource group

Answer

Create new Key Vaults in the resource group

Question 14

You need to ensure that an Azure Functions app can access a blob in Azure Storage using its system-assigned managed identity. What should you do first?

Accepted Answer

Enable the managed identity in the Function App. To use a system-assigned managed identity, it must first be enabled on the Azure Functions app. This action creates the identity in Azure Active Directory. Once the identity is enabled, you can then assign the necessary Azure RBAC role, such as 'Storage Blob Data Reader', to this identity at the storage account scope to grant it permissions to access the blob storage. Therefore, enabling the managed identity is the foundational first step.

Answer

Configure CORS on the storage account

Answer

Assign the Storage Blob Data Reader role to the managed identity at the storage account scope

Answer

Generate a SAS token for the blob

Question 15

You are developing a .NET Core API that uses Azure AD for authentication. You want to restrict access to specific claims. Which middleware component should you use to check claims?

Accepted Answer

Use the UseAuthorization middleware in the pipeline. The UseAuthorization middleware is the component in the ASP.NET Core pipeline responsible for performing authorization checks, including evaluating policies that require specific claims. While the [Authorize] attribute and policies define the authorization requirements, it is the UseAuthorization middleware that executes these checks.

Answer

Use the UseAuthentication middleware to validate tokens

Answer

Use the [Authorize] attribute with a policy that requires a specific claim

Answer

Manually parse the JWT in a custom middleware