AZ-200 Azure Security & Identity 1 — Questions and Answers
Question 1: What is a managed identity in Azure, and why should developers use it?
- A user account managed by IT administrators
- An automatically managed Azure AD identity for Azure services, eliminating the need to store credentials in code (Correct answer)
- A service principal that requires manual certificate rotation
- An identity used exclusively for Azure DevOps pipelines
Correct answer: An automatically managed Azure AD identity for Azure services, eliminating the need to store credentials in code
Managed identities provide an Azure AD identity automatically managed by Azure, allowing services to authenticate to other Azure services without credentials in code.
Question 2: What is the difference between a system-assigned and user-assigned managed identity?
- System-assigned has a longer lifetime; user-assigned is deleted with the resource
- System-assigned is tied to a single resource and deleted with it; user-assigned is standalone and reusable (Correct answer)
- System-assigned supports multiple resources; user-assigned is single-use
- There is no functional difference
Correct answer: System-assigned is tied to a single resource and deleted with it; user-assigned is standalone and reusable
System-assigned identities are created and deleted with the resource, while user-assigned identities exist independently and can be assigned to multiple resources.
Question 3: Which Azure Key Vault object type should be used to store a database connection string?
- Key
- Certificate
- Secret (Correct answer)
- Policy
Correct answer: Secret
Key Vault Secrets are designed to store sensitive string values like passwords, connection strings, and API keys securely.
Question 4: How does Azure AD OAuth2 client credentials flow work for service-to-service authentication?
- The app uses a user's delegated token
- The app authenticates directly with Azure AD using its client ID and secret/certificate to obtain an access token (Correct answer)
- The app relies on managed identity only
- The app uses a shared access key
Correct answer: The app authenticates directly with Azure AD using its client ID and secret/certificate to obtain an access token
Client credentials flow allows an application to authenticate as itself (not a user) by presenting its client ID and secret or certificate to Azure AD to get an access token.
Question 5: What is the purpose of RBAC role assignments in Azure?
- Define network security rules
- Grant a security principal (user/group/identity) specific permissions to an Azure resource (Correct answer)
- Configure Azure Policy compliance rules
- Set up multi-factor authentication
Correct answer: Grant a security principal (user/group/identity) specific permissions to an Azure resource
RBAC role assignments attach a role definition to a security principal at a specific scope, granting the permissions defined in that role to the principal.
Question 6: Which Azure Key Vault soft-delete feature prevents accidental permanent deletion of secrets?
- Purge protection (Correct answer)
- Key rotation policy
- Access policy deny assignment
- Versioning
Correct answer: Purge protection
Purge protection prevents a soft-deleted Key Vault or its objects from being permanently purged during the retention period, even by administrators.
AZ-200 Azure Security & Identity 1
What is a managed identity in Azure, and why should developers use it?