AZ-204 Implement Azure security — Timed 40 Questions

Question 1

You have multiple Azure virtual machines that need to access the same Azure Key Vault to retrieve certificates. You want to minimize administrative overhead while ensuring each VM can authenticate without managing credentials. Which identity type should you use?

Accepted Answer

User-assigned managed identity assigned to each VM. Option B is correct because a user-assigned managed identity can be created once and then assigned to multiple Azure VMs, allowing all of them to authenticate to the same Key Vault without storing any credentials. This minimizes administrative overhead compared to managing separate system-assigned identities or service principals, as the identity is independent of any single VM's lifecycle and can be reused across resources.

Answer

System-assigned managed identity on each VM

Answer

Service principal with client secret stored in each VM

Answer

Storage account key

Question 2

A developer accidentally deleted a secret from Azure Key Vault. Soft-delete is enabled with a retention period of 90 days. After 60 days, you attempt to recover the secret. What should you do?

Accepted Answer

Run the Azure CLI command: az keyvault secret recover. Option A is correct because when soft-delete is enabled on Azure Key Vault, deleted secrets are retained for the specified retention period (90 days in this case). Since only 60 days have passed, the secret is still in a soft-deleted state and can be recovered using the `az keyvault secret recover` command, which restores the secret to an active state.

Answer

Enable purge protection on the Key Vault first, then recover the secret.

Answer

Recover is not possible because the retention period of 90 days has not elapsed.

Answer

Run the Azure CLI command: az keyvault secret undelete

Question 3

A company stores sensitive data in an Azure Storage account. They need to restrict access based on the client's IP address and require that clients use a valid SAS token. Which mechanism should they use?

Accepted Answer

SAS token with IP ACL.. A SAS token with an IP ACL (access control list) allows you to restrict access to a specific client IP address or range of IP addresses while also requiring a valid SAS token for authentication. This meets both requirements: IP-based restriction and SAS token validation. The IP ACL is specified as part of the SAS token's signed IP (sip) parameter, which enforces that requests must originate from the allowed IP range.

Answer

Microsoft Entra ID authentication.

Answer

Shared Key.

Answer

Firewall and virtual networks.

Question 4

You are developing an application that stores user secrets. You need to ensure that the secrets are encrypted at rest and rotated automatically. Which Azure service should you integrate?

Accepted Answer

Azure Key Vault.. Azure Key Vault is the correct choice because it provides centralized management of secrets, keys, and certificates with built-in encryption at rest using FIPS 140-2 Level 2 validated hardware security modules (HSMs). It also supports automatic rotation of secrets through integration with Azure Event Grid and Azure Functions, enabling you to schedule or trigger key rotation policies without manual intervention.

Answer

Azure Storage.

Answer

Azure Security Center.

Answer

Microsoft Entra ID.

Question 5

You have an Azure Function app that needs to retrieve a secret from Azure Key Vault at runtime. You want to avoid storing any credentials in code or configuration. Which mechanism should you use?

Accepted Answer

Managed identity. Managed identity (B) is the correct mechanism because it allows the Azure Function app to authenticate to Azure Key Vault without storing any credentials in code or configuration. Azure automatically manages the identity and provides a token from Azure AD that the function can use to access the vault, eliminating the need for secrets or keys in the application.

Answer

Service principal with client secret

Answer

Access key

Answer

Shared access signature (SAS)

Question 6

A developer deleted a secret from Azure Key Vault with soft-delete and purge protection enabled (retention 90 days). After 50 days, the secret is needed again. What is the correct recovery method?

Accepted Answer

Recover the secret using Azure CLI 'az keyvault secret recover'. Option B is correct because Azure Key Vault with soft-delete and purge protection enabled retains deleted secrets for the specified retention period (90 days in this case). Since only 50 days have passed, the secret is still in a soft-deleted state and can be recovered using the 'az keyvault secret recover' command, which restores the secret to its original state without data loss.

Answer

Purge the secret and then restore from a backup

Answer

Recreate the secret with the same name

Answer

Use an Azure Resource Manager template to undelete the secret

Question 7

A developer needs to grant an Azure Function read access to secrets in Azure Key Vault without storing any credentials in the function code or configuration. Which approach should they use?

Accepted Answer

Managed identity. Managed identity (B) is the correct approach because it allows the Azure Function to authenticate to Azure Key Vault without storing any credentials in code or configuration. Azure automatically manages the identity, and the function can obtain an access token from Azure AD to read secrets, eliminating the need for secrets, certificates, or keys in the application.

Answer

Service principal with a certificate

Answer

Access policy with a client secret

Answer

Shared access signature (SAS)

Question 8

A company has an Azure Storage account that stores sensitive data. They need to ensure that all access to the storage account is secured using Microsoft Entra ID authentication and that no storage account keys are used. Which configuration should be applied to enforce this?

Accepted Answer

Disable shared key access. Disabling shared key access (Option B) is the correct configuration because it explicitly blocks all authentication using storage account keys (both primary and secondary), forcing all requests to use Microsoft Entra ID (formerly Azure AD) for authorization. This ensures that only identities with appropriate RBAC roles (e.g., Storage Blob Data Owner) can access the storage account, meeting the requirement to eliminate key-based access entirely.

Answer

Enable firewall rules

Answer

Enable advanced threat protection

Answer

Enable soft delete

Question 9

A company stores secrets (e.g., connection strings) in Azure Key Vault and needs them automatically rotated every 90 days. Which solution should they implement?

Accepted Answer

Use Event Grid to trigger an Azure Function or Automation runbook that rotates the secret. Option C is correct because Azure Key Vault does not natively support automatic secret rotation; you must implement a custom solution using Event Grid to detect expiration events and trigger an Azure Function or Automation runbook that generates a new secret and updates the vault. This pattern leverages Key Vault's eventing capabilities to automate the rotation workflow without manual intervention.

Answer

Configure Key Vault access policies to enforce rotation

Answer

Enable Key Vault firewall to limit access

Answer

Enable soft-delete on the vault

Question 10

Your company uses Azure Key Vault to store secrets. You need to ensure that if a secret is deleted, it can be recovered within 30 days. Which Key Vault feature should you enable?

Accepted Answer

Soft-delete. Soft-delete is the correct feature because it allows you to recover a deleted secret within a configurable retention period (default 90 days, but can be set to as low as 1 day). When soft-delete is enabled, a deleted secret is marked as deleted but remains recoverable until the retention period expires. This directly meets the requirement to recover a secret within 30 days.

Answer

Purge protection

Answer

RBAC (Role-Based Access Control)

Answer

Access policies

Question 11

Your company stores sensitive documents in an Azure Storage account. You need to ensure that only authorized Microsoft Entra ID users can read the documents, and that shared keys (account access keys) cannot be used. Which two steps must you take? (Choose the most appropriate single answer that describes the combined action.)

Accepted Answer

Disable shared key access and configure RBAC roles for Microsoft Entra ID users. Option A is correct because disabling shared key access on the Azure Storage account prevents the use of account access keys, which are shared secrets. Configuring Azure RBAC roles (e.g., Storage Blob Data Reader) for Microsoft Entra ID users ensures that only authenticated and authorized users can read the documents, enforcing identity-based access control as required.

Answer

Enable Microsoft Entra ID authentication and use SAS tokens with a stored access policy

Answer

Enable firewall and virtual network service endpoints, then assign RBAC roles

Question 12

You deploy a web application in Azure App Service. You need to authenticate users via Microsoft Entra ID (Microsoft Entra ID) with minimal custom code. Which App Service feature should you configure?

Accepted Answer

App Service Authentication (Easy Auth). App Service Authentication (also known as Easy Auth) is the correct choice because it provides a turnkey authentication layer that integrates directly with Microsoft Entra ID. It requires minimal custom code by handling the OAuth 2.0 authorization code flow, token validation, and session management at the App Service platform level, allowing you to simply configure the identity provider in the Azure portal.

Answer

Microsoft Entra ID B2C

Answer

Application Gateway with WAF

Answer

App Service Managed Identity

Question 13

Your company stores API keys and connection strings in Azure Key Vault. You need to grant an Azure Function read access to these secrets using the principle of least privilege. Which identity type should you assign to the Function App?

Accepted Answer

System-assigned managed identity. A system-assigned managed identity is the correct choice because it is directly tied to the lifecycle of the Azure Function, automatically managed by Azure, and requires no manual credential rotation. It provides the most restrictive scope (only that specific Function App) and adheres to the principle of least privilege by granting access only to the identity that needs it, without the overhead of managing a separate identity or service principal.

Answer

User-assigned managed identity

Answer

Service principal

Answer

Access policy on the Key Vault

Question 14

You are developing an Azure Function that reads secrets from Azure Key Vault. The function must not use any static credentials in configuration files. You need to authenticate to Key Vault using the function's own identity. Which Azure service feature should you enable?

Accepted Answer

Assign a managed identity to the function app and grant it access to the Key Vault. Option B is correct because Azure Functions can use a system-assigned or user-assigned managed identity to authenticate to Azure Key Vault without storing any static credentials. When enabled, the function app obtains an Azure AD token from the Managed Identity endpoint (169.254.169.254) and uses it to access Key Vault secrets, eliminating the need for connection strings, keys, or certificates in configuration files.

Answer

Use storage account access keys to authenticate to Key Vault

Answer

Generate a shared access signature (SAS) token for the Key Vault

Answer

Create a service principal and store its certificate in the function app's local storage

Question 15

Your company stores customer payment data in an Azure SQL Database. You need to ensure that only the application's managed identity can access the database, and no SQL logins or passwords are used. Which authentication method should you configure?

Accepted Answer

Use Microsoft Entra ID authentication with the managed identity configured as a contained database user. Option B is correct because configuring the managed identity as a contained database user in Azure SQL Database using Microsoft Entra ID authentication allows the application to authenticate without any SQL logins or passwords. The managed identity provides an automatically managed service principal in Entra ID, which can be mapped to a contained database user (CREATE USER [<identity-name>] FROM EXTERNAL PROVIDER). This enables token-based authentication using OAuth 2.0, ensuring that only the application's identity can access the database.

Answer

SQL Server authentication with a strong password stored in Key Vault

Answer

Enable Transparent Data Encryption (TDE) and use the database's certificate

Answer

Configure the Azure SQL firewall to allow only the application's outbound IP

Question 16

Your company uses Azure Key Vault to manage encryption keys for data at rest in Azure Storage. You need to ensure that the storage account uses a customer-managed key (CMK) stored in Key Vault. Additionally, you need to periodically rotate the key automatically. Which configuration should you implement?

Accepted Answer

Create a key in Key Vault, assign the storage account's managed identity access to that key, and configure a Key Vault rotation policy to automatically rotate the key regularly. Option A is correct because it combines the three essential elements for using a customer-managed key (CMK) with automatic rotation in Azure Key Vault. First, you must create a key in Key Vault (not use the default system-managed key). Second, the storage account's managed identity must be granted 'Get', 'Unwrap Key', and 'Wrap Key' permissions on that key so it can encrypt/decrypt the storage account's root key. Third, you configure a Key Vault rotation policy (using the Azure Key Vault key rotation feature) to automatically create new key versions on a schedule (e.g., every 90 days), which the storage account automatically picks up without manual intervention.

Answer

Enable soft-delete and purge protection on the Key Vault to allow key recovery during rotation

Answer

Use Azure Key Vault's default key (system-managed) and rely on built-in rotation

Answer

Manually rotate the key every 90 days by generating a new version and updating the storage account

Question 17

Your company uses Azure App Service to host a web application. You need to allow only authenticated users from your Microsoft Entra ID tenant to access the app, without writing any authentication code. Which feature should you configure?

Accepted Answer

Azure App Service Authentication (EasyAuth) with Microsoft Entra ID as identity provider.. Azure App Service Authentication (EasyAuth) is the correct feature because it provides a built-in, code-free way to authenticate users by integrating with Microsoft Entra ID (formerly Azure AD). When configured, the App Service automatically validates tokens and redirects unauthenticated users to the identity provider, enforcing authentication at the platform level without requiring any changes to the application code.

Answer

IP restrictions in the app’s web.config.

Answer

Client certificate authentication.

Answer

Shared access signatures (SAS) for the app URL.

Question 18

Your company stores secrets in Azure Key Vault. You need to ensure that when a secret is disabled, it does not become accessible to applications that already have a cached copy. Which additional step must you take?

Accepted Answer

Rotate the secret immediately. When a secret is disabled in Azure Key Vault, the vault itself will reject new access requests, but applications that have already retrieved and cached the secret can continue using it until the cache expires or is refreshed. To immediately invalidate the cached copy, you must rotate the secret (change its value) so that any subsequent attempt to use the old cached value fails because it no longer matches the secret stored in Key Vault. Disabling alone does not force applications to re-authenticate or re-fetch; rotation ensures the cached value becomes obsolete.

Answer

Delete the secret

Answer

Enable soft-delete and purge protection

Answer

Use Key Vault access policies to deny access

Question 19

You are developing a web API that must authenticate requests using Microsoft Entra ID (Microsoft Entra ID) and OAuth 2.0 bearer tokens. You want to validate the token in your API code. Which library should you use?

Accepted Answer

Microsoft.Identity.Web. Microsoft.Identity.Web is the recommended library for integrating ASP.NET Core web APIs with Microsoft Entra ID. It provides built-in token validation, policy enforcement, and handles the OAuth 2.0 bearer token flow, including JWT validation, issuer signing keys, and audience checks, without requiring manual configuration of middleware.

Answer

Microsoft Authentication Library (MSAL)

Answer

ADAL.NET

Answer

Azure.Identity

Question 20

You are developing a web API hosted on Azure App Service. The API must authenticate requests using Microsoft Entra ID OAuth 2.0 bearer tokens. You want to validate the token in your ASP.NET Core API code with minimal custom validation logic. Which library should you use?

Accepted Answer

Microsoft.Identity.Web. Microsoft.Identity.Web is the correct choice because it provides a high-level, opinionated library that integrates directly with ASP.NET Core's authentication pipeline, handling token validation, scopes, and app roles with minimal custom code. It abstracts away the complexity of JWT bearer token validation against Microsoft Entra ID, including automatic OpenID Connect discovery and token signature verification.

Answer

Microsoft Authentication Library (MSAL)

Answer

Azure Identity client library

Answer

Azure Management Libraries for .NET