Microsoft Certified: Azure Developer Associate Azure Security, Identity, and Key Vault 2

Question 1

What Azure AD consent type allows an administrator to grant permissions for all users in a tenant at once?

Accepted Answer

Admin consent

Answer

Admin consent grants an application's requested permissions to all users in the tenant, bypassing per-user consent for sensitive or organization-wide scopes.

Question 2

What is the difference between delegated permissions and application permissions in Azure AD?

Accepted Answer

Delegated permissions act on behalf of a signed-in user; application permissions act as the application itself

Answer

Delegated permissions allow the app to act with the signed-in user's identity and privileges, while application permissions (app roles) allow the app to act as itself.

Question 3

Which Azure Key Vault soft-delete feature protects against accidental deletion by retaining deleted vaults for a configurable period?

Accepted Answer

Soft delete

Answer

Soft delete retains deleted Key Vault resources for a retention period (default 90 days) during which they can be recovered.

Question 4

What Azure service enables developers to use the `DefaultAzureCredential` class that automatically picks the best available credential?

Accepted Answer

Azure Identity SDK (`Azure.Identity`)

Answer

`DefaultAzureCredential` is part of the `Azure.Identity` library and tries a chain of credential sources (managed identity, env vars, CLI, etc.) in order.

Question 5

What Azure AD feature issues short-lived access tokens scoped to a specific resource, reducing blast radius if a token is stolen?

Accepted Answer

Token lifetime policy

Answer

Token lifetime policies in Azure AD control how long access and refresh tokens are valid, limiting exposure if tokens are compromised.

Microsoft Certified: Azure Developer Associate Practice Test

Microsoft Certified: Azure Developer Associate Practice Test

Microsoft Certified: Azure Developer Associate Azure Security, Identity, and Key Vault 2