MCSD Authentication, Authorization & Identity 3

Question 1

When building a multi-tenant Azure AD application, what does the 'common' endpoint (login.microsoftonline.com/common) allow?

Accepted Answer

Authentication for users from any Azure AD tenant or personal Microsoft accounts

Answer

Authentication limited to the application's home tenant only

Answer

Authentication using only certificate-based credentials

Answer

Authentication bypassing multi-factor authentication requirements

Question 2

The OAuth 2.0 On-Behalf-Of (OBO) flow is used in which scenario?

Accepted Answer

A middle-tier API calls a downstream API on behalf of the user who called the middle-tier API

Answer

A background service accesses resources without any user interaction

Answer

A user grants access to a third-party application to their resources

Answer

An application exchanges a SAML assertion for an OAuth access token

Question 3

In Azure AD, what is the primary difference between using 'App Roles' versus 'Azure AD Security Groups' for authorization in a custom application?

Accepted Answer

App Roles are included in the token automatically; Groups require a separate Graph API call for large memberships

Answer

App Roles support external users; Security Groups only support internal users

Answer

App Roles are defined in the tenant; Security Groups are defined within the application

Answer

App Roles expire after 24 hours; Security Groups are permanent

Question 4

When validating a JWT access token in a .NET Web API, which claim should be verified to ensure the token was intended for your specific API?

Accepted Answer

aud (audience) claim

Answer

iss (issuer) claim

Answer

sub (subject) claim

Answer

exp (expiration) claim

Question 5

What does PKCE (Proof Key for Code Exchange) add to the Authorization Code Flow, and why is it important?

Accepted Answer

It creates a cryptographic binding between the authorization request and the token request to prevent code interception attacks

Answer

It encrypts the authorization code during transmission using a symmetric key

Answer

It adds multi-factor authentication as a mandatory step in the flow

Answer

It enables refresh tokens for public clients that cannot store secrets

Question 6

In Azure AD, what is a Service Principal?

Accepted Answer

The local representation of an application or managed identity in a specific Azure AD tenant that defines its access policies and permissions

Answer

A privileged administrator account used for emergency access

Answer

A federated identity from an external identity provider like Google or Facebook

Answer

A built-in Azure role that grants tenant-wide administrative permissions

Question 7

How should a .NET application retrieve a secret from Azure Key Vault using Managed Identity, following MCSD security best practices?

Accepted Answer

Use DefaultAzureCredential from Azure.Identity SDK to authenticate to Key Vault with the assigned Managed Identity, requiring no stored credentials

Answer

Store the Key Vault access key in appsettings.json and use it to authenticate to Key Vault

Answer

Embed the certificate thumbprint in the application code to authenticate to Key Vault

Answer

Use a service account username and password stored as environment variables to access Key Vault