AZ-204 Azure Security & Identity 2 — Questions and Answers
Question 1: What Azure AD object represents an application's identity and is used to authenticate against Azure AD to obtain tokens?
- User principal
- Managed identity
- Service principal (Correct answer)
- Enterprise application
Correct answer: Service principal
A service principal is the local representation of an Azure AD application registration within a tenant, used for authentication and authorization.
Question 2: Which Microsoft Authentication Library (MSAL) method acquires a token silently from cache before making a network request?
- AcquireTokenInteractive
- AcquireTokenForClient
- AcquireTokenSilent (Correct answer)
- AcquireTokenByUsernamePassword
Correct answer: AcquireTokenSilent
AcquireTokenSilent attempts to retrieve a valid token from the MSAL token cache without user interaction or a new network call.
Question 3: Which Azure Key Vault object type stores asymmetric cryptographic keys used for signing and encryption operations?
- Secret
- Certificate
- Key (Correct answer)
- Managed HSM
Correct answer: Key
Azure Key Vault Keys store RSA or EC cryptographic key material and support operations such as encrypt, decrypt, sign, and verify.
Question 4: Which Azure service enables you to centrally manage, rotate, and audit access to secrets across multiple applications and environments?
- Azure App Configuration
- Azure Key Vault (Correct answer)
- Azure Policy
- Azure Defender for Cloud
Correct answer: Azure Key Vault
Azure Key Vault provides centralized secret management with access logging, automated rotation, and RBAC-based access control.
Question 5: What header must a client include when calling an Azure AD-protected API to prove it has a valid access token?
- X-Auth-Token: Bearer {token}
- Authorization: Bearer {token} (Correct answer)
- Access-Token: {token}
- X-MS-Token: {token}
Correct answer: Authorization: Bearer {token}
APIs protected by Azure AD expect the access token in the HTTP `Authorization` header using the `Bearer` scheme.
Question 6: Which Azure AD token type contains claims about the authenticated user and is intended to be read by the client application?
- Access token
- Refresh token
- ID token (Correct answer)
- Client assertion
Correct answer: ID token
The ID token is a JWT issued by Azure AD that contains user identity claims such as name, email, and object ID for the client to consume.
AZ-204 Azure Security & Identity 2
What Azure AD object represents an application's identity and is used to authenticate against Azure AD to obtain tokens?