AZ-204 Implement Azure security Practice Question
An API receives JWT access tokens from Microsoft Entra ID. Which two token properties should the API validate before accepting a request? The architecture review board prefers a managed Azure-native control.
⚠ Common exam trap
A common mix-up: candidates confuse 'claims that are present in the token' (like display name) with 'claims that must be validated for security' (issuer, audience, signature), leading them to select non-essential claims as validation requirements.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Issuer and signature are valid for the trusted tenant
The API must validate the issuer (iss) claim to ensure the token was issued by a trusted tenant (e.g., https://login.microsoftonline.com/{tenant-id}/v2.0) and verify the token's digital signature using the public keys from the OpenID Connect metadata endpoint. This prevents tokens from untrusted tenants or forged tokens from being accepted. Additionally, the API must validate the audience (aud) claim to ensure the token was specifically intended for this API, preventing it from being used by unintended applications.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Issuer and signature are valid for the trusted tenant
Why this is correct
Issuer and signature validation confirms the token came from the expected identity provider.
- ✗
The user's display name is present
Why it's wrong here
Display name is not a security validation control.
- ✓
Token audience matches the API application ID URI or client ID
Why this is correct
The audience proves the token was issued for this API.
- ✗
The token was sent in a query string
Why it's wrong here
Bearer tokens should not be accepted because they appear in query strings.
Go deeper
Related to this question
About these practice questions
This AZ-204 question is part of Courseiva's 881-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.