AZ-204 Implement Azure security Practice Question
You are developing a daemon application that runs on an on-premises server and must call a protected web API hosted in Azure. The API is secured with Microsoft Entra ID. The daemon cannot use a user sign-in and must authenticate as itself. You need to choose the appropriate authentication flow and configuration. Which two actions should you perform? (Choose two.)
⚠ Common exam trap
The trap here is mixing up interactive flows like authorization code with PKCE or implicit grant with app-only flows, when a daemon without a user must use client credentials.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use the OAuth 2.0 client credentials flow.
A daemon with no user context must use the OAuth 2.0 client credentials flow, which authenticates the application itself. This flow requires a credential such as a client secret or certificate configured in the app registration. Together, these two actions allow the daemon to obtain an access token from Microsoft Entra ID and call the protected API using application permissions.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Use the OAuth 2.0 client credentials flow.
Why this is correct
The client credentials flow is designed for non-interactive, app-only authentication where the application authenticates as itself using its own credentials. It allows the daemon to obtain a token from Microsoft Entra ID without a user context. This is the correct flow for a daemon calling a protected API with application permissions.
- ✗
Use the OAuth 2.0 authorization code flow with PKCE.
Why it's wrong here
The authorization code flow with PKCE requires a user to sign in interactively, which is not possible for a daemon with no user present. PKCE protects public clients during user authentication, but it does not provide app-only authentication. This flow is designed for interactive clients, so it fails the requirement of authenticating as the application itself.
- ✓
Configure the application registration with a client secret or certificate.
Why this is correct
The client credentials flow requires the application to present a credential, such as a client secret or a certificate, to authenticate with Microsoft Entra ID. Since the daemon runs on-premises and cannot use managed identity, a certificate or secret is necessary. This configuration enables the app to prove its identity and obtain an access token.
- ✗
Grant delegated permissions to the API and request them at runtime.
Why it's wrong here
Delegated permissions are used when an application acts on behalf of a signed-in user. Since the daemon has no user context, delegated permissions cannot be granted or used. The client credentials flow requires application permissions, not delegated permissions, so this option does not meet the scenario's needs.
- ✗
Use the OAuth 2.0 implicit grant flow to obtain tokens directly.
Why it's wrong here
The implicit grant flow is intended for browser-based single-page applications and does not support app-only authentication. It also does not provide refresh tokens and is not recommended for daemons. This flow cannot authenticate a non-interactive service, so it is incorrect for this scenario.
Go deeper
Related to this question
About these practice questions
This AZ-204 question is part of Courseiva's 883-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Microsoft exam blueprint
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.