AZ-204 Azure Security & Identity 1 — Questions and Answers
Question 1: Which Azure service allows an application to retrieve secrets without storing credentials in code or configuration files?
- Azure Active Directory B2C
- Azure Key Vault (Correct answer)
- Azure Security Center
- Azure Policy
Correct answer: Azure Key Vault
Azure Key Vault centrally stores secrets, keys, and certificates so applications can retrieve them at runtime without hardcoding credentials.
Question 2: What type of Managed Identity is automatically created and tied to the lifecycle of a specific Azure resource?
- User-assigned managed identity
- System-assigned managed identity (Correct answer)
- Service principal
- Application identity
Correct answer: System-assigned managed identity
A system-assigned managed identity is created automatically when you enable it on an Azure resource and is deleted when the resource is deleted.
Question 3: Which OAuth 2.0 flow should a daemon application use to acquire an Azure AD token when acting on its own behalf with no user interaction?
- Authorization Code flow
- Implicit flow
- Client Credentials flow (Correct answer)
- On-Behalf-Of flow
Correct answer: Client Credentials flow
The Client Credentials flow authenticates the application itself using a client ID and secret/certificate, with no user involved.
Question 4: What is the recommended way to allow an Azure App Service to read secrets from Azure Key Vault without managing credentials?
- Store the Key Vault access key in App Settings
- Use a Key Vault reference with a system-assigned managed identity (Correct answer)
- Pass the client secret via environment variable
- Use a service principal with a certificate in App Settings
Correct answer: Use a Key Vault reference with a system-assigned managed identity
Key Vault references in App Service use the app's managed identity to fetch secrets automatically at runtime with no credential storage.
Question 5: Which Azure AD feature allows you to require multi-factor authentication for users accessing specific applications based on risk signals?
- Azure AD Identity Protection
- Conditional Access (Correct answer)
- Privileged Identity Management
- Azure AD B2B
Correct answer: Conditional Access
Conditional Access policies evaluate signals such as user, location, device, and app to enforce access controls like MFA.
Question 6: Which role in Azure RBAC provides read-only access to Azure Key Vault secrets?
- Key Vault Contributor
- Key Vault Secrets Officer
- Key Vault Secrets User (Correct answer)
- Key Vault Reader
Correct answer: Key Vault Secrets User
The Key Vault Secrets User role grants read access (get, list) to secrets in Azure Key Vault using Azure RBAC permission model.
AZ-204 Azure Security & Identity 1
Which Azure service allows an application to retrieve secrets without storing credentials in code or configuration files?