AZ-204 Research & Evidence-Based Practice 4 — Questions and Answers
Question 1: In Azure API Management, which policy scope applies to every API across all products within the APIM instance?
- API scope
- Operation scope
- Product scope
- Global scope (Correct answer)
Correct answer: Global scope
Policies set at the global scope execute for every inbound and outbound call, making them the broadest applicable scope.
Question 2: Which Azure Key Vault object type manages the full lifecycle of an X.509 certificate, including its associated private key?
- Secret
- Key
- Certificate (Correct answer)
- Token
Correct answer: Certificate
The Key Vault Certificate object handles issuance, renewal, and storage of X.509 certificates along with their private keys.
Question 3: What is the key advantage of a user-assigned managed identity compared to a system-assigned managed identity?
- It provides stronger token encryption
- It can be shared across multiple Azure resources simultaneously (Correct answer)
- It has a longer access token lifetime
- It supports a broader range of Azure services
Correct answer: It can be shared across multiple Azure resources simultaneously
A user-assigned managed identity has an independent lifecycle and can be attached to multiple resources, enabling identity reuse across services.
Question 4: Which OAuth 2.0 grant type is appropriate for a daemon or background service that must authenticate to an API without any user interaction?
- Authorization code
- Implicit
- Client credentials (Correct answer)
- Resource owner password credentials
Correct answer: Client credentials
The client credentials flow lets a service authenticate using its own credentials (client ID and secret/certificate), with no user involved.
Question 5: Which Azure API Management policy limits the number of calls a subscription can make within a specified time window to prevent abuse?
- validate-jwt
- rate-limit-by-key (Correct answer)
- check-header
- rewrite-uri
Correct answer: rate-limit-by-key
The rate-limit-by-key policy enforces a call-rate ceiling keyed on a value such as subscription ID, blocking requests that exceed the quota.
Question 6: In Azure Key Vault, what does enabling soft-delete allow you to do?
- Compress secrets to reduce storage costs
- Encrypt secrets with a customer-managed key
- Recover deleted vaults and objects within a retention period (Correct answer)
- Audit every access attempt to a secret
Correct answer: Recover deleted vaults and objects within a retention period
Soft-delete retains deleted Key Vault resources for a configurable period (7–90 days), allowing recovery before permanent purge.
Question 7: Which Azure API Management policy validates an OAuth 2.0 / OpenID Connect JWT and rejects requests with invalid or missing tokens?
- validate-jwt (Correct answer)
- cors
- set-header
- mock-response
Correct answer: validate-jwt
The validate-jwt policy inspects the Authorization header, verifies the token signature and claims, and returns 401 if validation fails.
AZ-204 Research & Evidence-Based Practice 4
In Azure API Management, which policy scope applies to every API across all products within the APIM instance?