Examkin

Question

Difficulty: MediumApp Registrations and Service Principals

You are developing a custom script that runs on an on-premises server to automate resource provisioning in Azure. The script must authenticate programmatically with Microsoft Entra ID using a dedicated service principal associated with an application registration. Which of the following credential types can be configured directly on the application registration to enable this authentication? (Select TWO)

  1. A client secret (symmetric key) created under the Certificates & secrets settingsAnswer
  2. An uploaded public certificate (asymmetric key) under the Certificates & secrets settingsAnswer
  3. C
    A system-assigned managed identity associated directly with the application registration
  4. D
    A Shared Access Signature (SAS) token mapped to the application registration credentials

Answer

A client secret (symmetric key) created under the Certificates & secrets settings and an uploaded public certificate (asymmetric key) under the Certificates & secrets settings.
Microsoft Entra ID application registrations support two credential types for authenticating a service principal: client secrets (symmetric keys) and certificates (asymmetric keys). Client secrets act as passwords, while certificates allow using cryptography by uploading a public key (.cer, .pem, etc.), which is more secure for production daemon applications or scripts.

Step-by-Step Solution

1
Identify the authentication requirements for the on-premises automation script using a Microsoft Entra ID application registration.
The script requires credentials to authenticate as a service principal.
On-premises resources cannot use Azure-managed identities directly and must use standard credentials associated with the app registration.
2
Evaluate the valid credential options available under the application registration settings in Microsoft Entra ID.
Microsoft Entra ID allows configuring either client secrets (symmetric keys) or uploading public certificates (asymmetric keys).
These are the two primary mechanisms to authenticate an application registration's service principal.
3
Select the correct options based on the evaluation.
Client secrets and public certificates are the correct choices.
Managed identities and Shared Access Signatures are distinct Azure features that do not serve as direct credentials on an application registration.

Key Concept

Microsoft Entra application registrations support two primary types of credentials for service principal authentication: client secrets and certificates.
Rate this question

Topics

App Registrations and Service Principals

More questions from this topic