AZ-204 Implement Azure security Practice Question
An API receives JWT access tokens from Microsoft Entra ID. Which two token properties should the API validate before accepting a request?
⚠ Common exam trap
Many candidates confuse optional user claims (like display name) with mandatory security claims (iss, aud, signature), or think token transport method (query string vs. header) is a validation property rather than a security best practice.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Issuer and signature are valid for the trusted tenant
The API must validate the token's issuer (iss) claim to ensure it matches the trusted Microsoft Entra ID tenant's issuer URL, confirming the token's origin. It must also verify the token's cryptographic signature to ensure it hasn't been tampered with. Additionally, the API must validate the token's audience (aud) claim, ensuring it matches the API's own Application ID URI or client ID, which confirms the token was intended for this specific API.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Issuer and signature are valid for the trusted tenant
Why this is correct
Validating the issuer (the 'iss' claim) confirms the token originated from the expected Microsoft Entra ID tenant, preventing tokens from unauthorized identity providers. Concurrently, verifying the token's cryptographic signature, using the issuer's public key, ensures its integrity and authenticity. This critical step guarantees the token has not been tampered with since it was issued and genuinely came from the claimed authority, establishing trust in the token's source.
- ✗
The user's display name is present
Why it's wrong here
The presence of the user's display name (the 'name' claim) within a JWT is purely for informational or presentation purposes, such as personalizing a user interface. It does not serve as a security control or contribute to the cryptographic validation of the token's authenticity, integrity, or authorization. Whether this claim exists or is populated has no bearing on whether the token is valid or trustworthy from a security perspective, making it irrelevant for access control decisions.
- ✓
Token audience matches the API application ID URI or client ID
Why this is correct
The audience ('aud' claim) specifies the intended recipient of the token, which for an API must precisely match its own Application ID URI or Client ID registered in Microsoft Entra ID. This validation is paramount because it prevents a token issued for one specific resource from being illicitly used to gain access to a different, unintended resource. Verifying the audience ensures the token's scope of access is correctly restricted to the API that is processing it.
- ✗
The token was sent in a query string
Why it's wrong here
Transmitting a sensitive access token within a URL's query string is a severe security vulnerability that should always be rejected. Query string parameters are frequently logged by web servers, proxies, and browsers, and can be exposed in browser history, referrer headers, and shared links, making the token highly susceptible to interception and replay attacks. Bearer tokens must exclusively be sent in the `Authorization` HTTP header to maintain confidentiality and prevent unauthorized access.
Go deeper
Related to this question
About these practice questions
This AZ-204 question is part of Courseiva's 881-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.