AZ-200 Azure Security & Identity

Question 1

What is a managed identity in Azure, and why should developers use it?

Accepted Answer

An automatically managed Azure AD identity for Azure services, eliminating the need to store credentials in code

Answer

A user account managed by IT administrators

Answer

A service principal that requires manual certificate rotation

Answer

An identity used exclusively for Azure DevOps pipelines

Question 2

What is the difference between a system-assigned and user-assigned managed identity?

Accepted Answer

System-assigned is tied to a single resource and deleted with it; user-assigned is standalone and reusable

Answer

System-assigned has a longer lifetime; user-assigned is deleted with the resource

Answer

System-assigned supports multiple resources; user-assigned is single-use

Answer

There is no functional difference

Question 3

Which Azure Key Vault object type should be used to store a database connection string?

Accepted Answer

Secret

Answer

Key

Answer

Certificate

Answer

Policy

Question 4

How does Azure AD OAuth2 client credentials flow work for service-to-service authentication?

Accepted Answer

The app authenticates directly with Azure AD using its client ID and secret/certificate to obtain an access token

Answer

The app uses a user's delegated token

Answer

The app relies on managed identity only

Answer

The app uses a shared access key

Question 5

What is the purpose of RBAC role assignments in Azure?

Accepted Answer

Grant a security principal (user/group/identity) specific permissions to an Azure resource

Answer

Define network security rules

Answer

Configure Azure Policy compliance rules

Answer

Set up multi-factor authentication

Question 6

Which Azure Key Vault soft-delete feature prevents accidental permanent deletion of secrets?

Accepted Answer

Purge protection

Answer

Key rotation policy

Answer

Access policy deny assignment

Answer

Versioning