Examkin

Implement Azure Security

203 questions

All types203Multiple choice102Multiple select71Ordering30
Question 201Question →

An organization is developing a multi-tenant software solution named VendorPortal. The solution must allow users from any organizational Microsoft Entra ID tenant to sign in. The solution must explicitly block authentication requests from personal Microsoft accounts, such as those registered with Outlook.com or Xbox Live. Which configuration parameters should you apply to the application manifest and the identity provider authority URL?

Show answer & explanation

Answer: Manifest signInAudience set to AzureADMultipleOrgs and authority URL set to https://login.microsoftonline.com/organizations

Answer

Manifest signInAudience set to AzureADMultipleOrgs and authority URL set to https://login.microsoftonline.com/organizations
To configure a multi-tenant application that supports only organizational directories and blocks personal Microsoft accounts, the developer must set the signInAudience in the application manifest to AzureADMultipleOrgs. Additionally, the authority URL must point to the organizations endpoint. Using the organizations endpoint ensures that personal accounts are blocked at the identity provider sign-in page before they can input credentials.

Step-by-Step Solution

1
Determine the required user audience scope for the application.
The application must support users from any organization (multi-tenant) but exclude personal Microsoft accounts.
This establishes the target audience profile for the manifest configuration.
2
Select the appropriate signInAudience value in the Microsoft Entra ID application manifest.
Identify that AzureADMultipleOrgs is the correct setting for multi-tenant organizations without personal accounts.
AzureADMultipleOrgs enables multi-tenant support while excluding personal accounts (which would require AzureADandPersonalMicrosoftAccount).
3
Configure the authority endpoint to match the tenant restriction requirements.
Select the /organizations endpoint (https://login.microsoftonline.com/organizations) instead of /common.
The /organizations endpoint restricts sign-in attempts to organizational directories, preventing personal accounts from proceeding at the protocol level.

Key Concept

Configuring multi-tenant authorization endpoints and application manifest audiences in Microsoft Entra ID.
Estimated Time:1m 30s
Question 202Question →

You are deploying a .NET web application to an Azure App Service. The application is configured to retrieve its configuration settings from an Azure App Configuration store named appconf-prod. Some settings, such as database credentials, are stored as Key Vault references pointing to secrets in an Azure Key Vault named kv-prod. The App Service has a system-assigned managed identity enabled. At runtime, the application loads configuration values from appconf-prod but receives the raw JSON metadata of the Key Vault references instead of the actual secret values. Which of the following actions must you perform to resolve this issue and successfully retrieve the secret values? (Select THREE correct actions.)

Select all that apply

Show answer & explanation

Answer: Grant the App Service's system-assigned managed identity the App Configuration Data Reader role on the appconf-prod store.; Grant the App Service's system-assigned managed identity the Key Vault Secrets User role on the kv-prod Key Vault.; Configure the application's configuration builder to call ConfigureKeyVault and pass a token credential such as DefaultAzureCredential.

Answer

To resolve the raw JSON metadata issue and retrieve the actual secret values, you must grant the App Service's managed identity the App Configuration Data Reader role on the configuration store, grant the same managed identity the Key Vault Secrets User role on the Key Vault, and configure the application code using ConfigureKeyVault with an appropriate credential like DefaultAzureCredential.
The system-assigned managed identity of the App Service must have read permissions for both the App Configuration store (App Configuration Data Reader) and the Key Vault (Key Vault Secrets User). In addition, the application's startup code must be updated to call ConfigureKeyVault on the configuration builder, passing a credential like DefaultAzureCredential so the SDK can resolve the references at startup.

Step-by-Step Solution

1
Configure application code to resolve Key Vault references.
The App Configuration provider client is instructed to detect and fetch Key Vault references using the provided credentials.
By default, the SDK only reads key-value metadata. Enabling ConfigureKeyVault with DefaultAzureCredential enables client-side resolution of Key Vault references.
2
Assign the App Configuration Data Reader role to the App Service managed identity on the App Configuration store.
The application can successfully authenticate and read the configurations (including Key Vault reference metadata) from the store.
The managed identity requires read permissions on the App Configuration store to fetch configuration keys and values.
3
Assign the Key Vault Secrets User role to the App Service managed identity on the Key Vault.
The application can fetch the actual secret values from Key Vault when resolving the references.
Since Key Vault references are resolved client-side by the application, the application's managed identity must have secret read access on the target Key Vault.

Key Concept

Key Vault references in Azure App Configuration are resolved client-side by the application's SDK. This requires that the application's identity has read permissions to both the App Configuration store and the target Key Vault, and that the SDK is configured to resolve the references.
Question 203Question →

You are deploying a web application to Azure App Service. The application must retrieve a database connection string from an Azure Key Vault named kv-billing. You configure a system-assigned managed identity for the App Service and assign the Key Vault Secrets User role to the identity on kv-billing. You need to configure an application setting in the App Service named DbConnectionString that references the secret named DbPassword in the Key Vault without pinning it to a specific version. Which of the following values represents the correct syntax to define the Key Vault reference?

Show answer & explanation

Answer: @Microsoft.KeyVault(SecretUri=https://kv-billing.vault.azure.net/secrets/DbPassword)

Answer

@Microsoft.KeyVault(SecretUri=https://kv-billing.vault.azure.net/secrets/DbPassword)
The correct answer uses the valid syntax format '@Microsoft.KeyVault(SecretUri=https://kv-billing.vault.azure.net/secrets/DbPassword)'. This tells the Azure App Service runtime to fetch the secret named 'DbPassword' from the Key Vault named 'kv-billing' using the system-assigned managed identity.

Step-by-Step Solution

1
Identify the required prefix for Key Vault references in Azure App Service application settings.
The prefix must be @Microsoft.KeyVault.
Azure App Service recognizes this prefix to intercept and resolve the reference from Key Vault before exposing the configuration value to the application code.
2
Identify the correct parameter name for referencing a secret by its URI.
The parameter name is SecretUri.
Using other parameter names like Uri will cause the reference to be treated as invalid syntax and it will not resolve.
3
Format the URI for the secret without pinning a version.
The URI is https://kv-billing.vault.azure.net/secrets/DbPassword.
Leaving out the version GUID at the end of the secret path ensures that the reference always resolves to the latest version of the secret.

Key Concept

Key Vault references allow an Azure App Service application to read secrets from Key Vault using configuration settings without modifying application code, requiring a system-assigned or user-assigned managed identity with appropriate access permissions.
PreviousPage 11 / 11
Implement Azure Security Practice Questions — Microsoft Azure Developer (AZ-204) — Page 11 | Examkin