Microsoft Certified: Azure Developer Associate Azure Security, Identity, and Key Vault 2 — Questions and Answers
Question 1: What Azure AD consent type allows an administrator to grant permissions for all users in a tenant at once?
- User consent
- Delegated consent
- Admin consent (Correct answer)
- Application consent
Correct answer: Admin consent
Admin consent grants an application's requested permissions to all users in the tenant, bypassing per-user consent for sensitive or organization-wide scopes.
Question 2: What is the difference between delegated permissions and application permissions in Azure AD?
- Delegated permissions act on behalf of a signed-in user; application permissions act as the application itself (Correct answer)
- Delegated permissions are for service accounts; application permissions are for users
- Delegated permissions require admin consent; application permissions do not
- They are synonymous terms
Correct answer: Delegated permissions act on behalf of a signed-in user; application permissions act as the application itself
Delegated permissions allow the app to act with the signed-in user's identity and privileges, while application permissions (app roles) allow the app to act as itself.
Question 3: Which Azure Key Vault soft-delete feature protects against accidental deletion by retaining deleted vaults for a configurable period?
- Purge protection
- Soft delete (Correct answer)
- Backup and restore
- Access policy deny
Correct answer: Soft delete
Soft delete retains deleted Key Vault resources for a retention period (default 90 days) during which they can be recovered.
Question 4: What Azure service enables developers to use the `DefaultAzureCredential` class that automatically picks the best available credential?
- Azure Key Vault SDK only
- Azure Identity SDK (`Azure.Identity`) (Correct answer)
- MSAL.NET only
- Microsoft.Azure.Services.AppAuthentication
Correct answer: Azure Identity SDK (`Azure.Identity`)
`DefaultAzureCredential` is part of the `Azure.Identity` library and tries a chain of credential sources (managed identity, env vars, CLI, etc.) in order.
Question 5: What Azure AD feature issues short-lived access tokens scoped to a specific resource, reducing blast radius if a token is stolen?
- Continuous access evaluation
- Conditional Access policy
- Token lifetime policy (Correct answer)
- Bearer token scoping
Correct answer: Token lifetime policy
Token lifetime policies in Azure AD control how long access and refresh tokens are valid, limiting exposure if tokens are compromised.
Question 6: Which Azure role must be assigned to allow an application's managed identity to read secrets from a Key Vault using RBAC authorization?
- Key Vault Contributor
- Key Vault Secrets User (Correct answer)
- Key Vault Administrator
- Key Vault Crypto Officer
Correct answer: Key Vault Secrets User
The `Key Vault Secrets User` role grants read access to secret values, which is the minimum permission needed to retrieve secrets.
Microsoft Certified: Azure Developer Associate Azure Security, Identity, and Key Vault 2
What Azure AD consent type allows an administrator to grant permissions for all users in a tenant at once?