Azure Security & Identity Flashcards

What Azure AD object represents an application's identity and is used to authenticate against Azure AD to obtain tokens?

Answer: Service principal

A service principal is the local representation of an Azure AD application registration within a tenant, used for authentication and authorization.

Which Microsoft Authentication Library (MSAL) method acquires a token silently from cache before making a network request?

Answer: AcquireTokenSilent

AcquireTokenSilent attempts to retrieve a valid token from the MSAL token cache without user interaction or a new network call.

Which Azure Key Vault object type stores asymmetric cryptographic keys used for signing and encryption operations?

Answer: Key

Azure Key Vault Keys store RSA or EC cryptographic key material and support operations such as encrypt, decrypt, sign, and verify.

Which Azure service enables you to centrally manage, rotate, and audit access to secrets across multiple applications and environments?

Answer: Azure Key Vault

Azure Key Vault provides centralized secret management with access logging, automated rotation, and RBAC-based access control.

What header must a client include when calling an Azure AD-protected API to prove it has a valid access token?

Answer: Authorization: Bearer {token}

APIs protected by Azure AD expect the access token in the HTTP `Authorization` header using the `Bearer` scheme.

Which Azure AD token type contains claims about the authenticated user and is intended to be read by the client application?

Answer: ID token

The ID token is a JWT issued by Azure AD that contains user identity claims such as name, email, and object ID for the client to consume.