Microsoft Certified: Azure Developer Associate Azure Security, Identity, and Key Vault 1 — Questions and Answers
Question 1: What is a managed identity in Azure, and what problem does it solve?
- A user account managed by Azure AD for service-to-service auth, eliminating stored credentials (Correct answer)
- An identity for VM guest OS logins only
- A service principal with a client certificate
- A role assignment for resource groups
Correct answer: A user account managed by Azure AD for service-to-service auth, eliminating stored credentials
Managed identities are Azure AD identities automatically managed by Azure for services, removing the need to store and rotate credentials in code.
Question 2: What Azure Key Vault object type stores sensitive string values like API keys and connection strings?
- Key
- Certificate
- Secret (Correct answer)
- Token
Correct answer: Secret
Key Vault Secrets store arbitrary string values such as connection strings, passwords, and API keys with access control and audit logging.
Question 3: Which Azure AD application registration element proves the app's identity to Azure AD when requesting tokens?
- Application (client) ID
- Client secret or certificate (credential) (Correct answer)
- Redirect URI
- Tenant ID
Correct answer: Client secret or certificate (credential)
A client secret or certificate is the credential that proves the application's identity to Azure AD during the OAuth 2.0 client credentials flow.
Question 4: What OAuth 2.0 flow should a confidential server-side web app use to authenticate users via Azure AD?
- Implicit flow
- Authorization code flow (Correct answer)
- Client credentials flow
- Device code flow
Correct answer: Authorization code flow
The authorization code flow is the recommended OAuth flow for server-side apps, exchanging a code for tokens securely on the back channel.
Question 5: What Azure Key Vault feature automatically renews certificates before they expire?
- Key rotation policy
- Certificate autorenew lifetime action (Correct answer)
- Secret versioning
- Soft-delete retention
Correct answer: Certificate autorenew lifetime action
Key Vault certificates support lifetime action policies that trigger automatic renewal a set number of days before expiry.
Question 6: Which MSAL (Microsoft Authentication Library) method acquires a token silently from the cache before falling back to interactive login?
- AcquireTokenInteractive
- AcquireTokenOnBehalfOf
- AcquireTokenSilent (Correct answer)
- AcquireTokenByUsernamePassword
Correct answer: AcquireTokenSilent
`AcquireTokenSilent` returns a cached or refreshed access token without user interaction, only prompting when silent acquisition fails.
Microsoft Certified: Azure Developer Associate Azure Security, Identity, and Key Vault 1
What is a managed identity in Azure, and what problem does it solve?