AZ-204 Azure Security & Identity

Question 1

Which Azure service allows an application to retrieve secrets without storing credentials in code or configuration files?

Accepted Answer

Azure Key Vault

Answer

Azure Key Vault centrally stores secrets, keys, and certificates so applications can retrieve them at runtime without hardcoding credentials.

Question 2

What type of Managed Identity is automatically created and tied to the lifecycle of a specific Azure resource?

Accepted Answer

System-assigned managed identity

Answer

A system-assigned managed identity is created automatically when you enable it on an Azure resource and is deleted when the resource is deleted.

Question 3

Which OAuth 2.0 flow should a daemon application use to acquire an Azure AD token when acting on its own behalf with no user interaction?

Accepted Answer

Client Credentials flow

Answer

The Client Credentials flow authenticates the application itself using a client ID and secret/certificate, with no user involved.

Question 4

What is the recommended way to allow an Azure App Service to read secrets from Azure Key Vault without managing credentials?

Accepted Answer

Use a Key Vault reference with a system-assigned managed identity

Answer

Key Vault references in App Service use the app's managed identity to fetch secrets automatically at runtime with no credential storage.

Question 5

Which Azure AD feature allows you to require multi-factor authentication for users accessing specific applications based on risk signals?

Accepted Answer

Conditional Access

Answer

Conditional Access policies evaluate signals such as user, location, device, and app to enforce access controls like MFA.

AZ-204 - Microsoft Azure Developer Associate Practice Test