AZ-204 Implement Azure security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Microsoft Authentication Library (MSAL)

  Why it's wrong here

  MSAL (Microsoft Authentication Library) is specifically designed for client applications, such as web, mobile, or desktop apps, to interact with the Microsoft identity platform to acquire security tokens. Its primary function is to manage user authentication flows, token caching, and refresh operations on the client side. A web API, conversely, requires a server-side mechanism or middleware to validate the authenticity, integrity, and authorization claims of incoming bearer tokens presented by these clients, which is a fundamentally different responsibility from token acquisition.

• ✓

  Microsoft.Identity.Web

  Why this is correct

  Microsoft.Identity.Web is the recommended and most current library for integrating Microsoft identity platform authentication and authorization into ASP.NET Core web APIs and web applications. It provides a comprehensive set of middleware and helper classes that significantly simplify the process of validating incoming bearer tokens issued by Microsoft Entra ID. This includes automatically handling token signature verification, issuer and audience validation, lifetime checks, and extracting claims, thereby ensuring robust security for API endpoints.

• ✗

  ADAL.NET

  Why it's wrong here

  ADAL.NET (Azure Active Directory Authentication Library for .NET) is an older, deprecated library that should not be used for new development. While it previously facilitated authentication with Azure Active Directory, it does not support the latest security protocols, modern token formats (like those required for Microsoft Graph), or current authentication flows. Utilizing ADAL.NET in new projects would introduce security vulnerabilities, lack support for contemporary identity features, and prevent access to ongoing improvements in the Microsoft identity platform.

• ✗

  Azure.Identity

  Why it's wrong here

  The Azure.Identity library provides credential types for authenticating applications to various Azure services, such as Azure Key Vault, Azure Storage, or Azure Cosmos DB. Its purpose is to simplify credential management and offer a unified authentication experience for accessing *Azure resources* from within an application using managed identities, service principals, or developer credentials. It is not designed for the server-side validation of incoming bearer tokens presented by client applications to a custom web API, which requires specialized token validation middleware.