Implement Azure Security
203 questions
A developer is configuring security for an Azure App Service instance. They need to understand how managed identities behave when the App Service is deleted or updated. Which of the following statements correctly describe the characteristics of a system-assigned managed identity? (Select TWO).
Select all that apply
You are developing a C# desktop application that needs to authenticate users against Microsoft Entra ID using the Microsoft Identity Platform.
Which two components from the Microsoft.Identity.Client namespace must you use to configure and represent the client application?
Select two.
Select all that apply
You are developing a command-line interface (CLI) application that will run on Linux servers without a graphical user interface or local web browser. The application must authenticate individual users against Microsoft Entra ID before executing commands. Which MSAL.NET method should you use to perform the authentication?
You are developing a secure background daemon application in C# that runs as an on-premises scheduled task. The application must periodically retrieve records from a secured downstream Azure Web API. The organization's security policy strictly prohibits the use of client secrets (passwords) for authentication. Instead, you must authenticate using a client certificate. You have already registered the daemon application in Microsoft Entra ID.
Which two of the following actions must you perform to configure the application registration and implement the authentication flow using MSAL.NET? (Select two.)
Select all that apply
An organization is implementing a multi-tier solution where a mobile client calls a secure Web API. The Web API must call Microsoft Graph to access the user's files. The security policy dictates that the Web API must execute this request using the identity of the signed-in user, rather than using the API's own application identity. The Web API must authenticate to Microsoft Entra ID using a client certificate. You are writing the MSAL.NET code within the Web API to acquire the required token.
Which two code actions must you perform to implement this authentication flow? (Select two.)
Select all that apply
An organization registry application built in Microsoft Entra ID needs to support authentication for business users from external directories. The registration must allow log-in capabilities exclusively for corporate credentials across any Microsoft Entra ID tenant, preventing personal email accounts (such as Hotmail or Outlook.com) from authenticating. To implement this restriction, which setting should be selected for the application registration's sign-in audience in the manifest?
You are developing a web application that retrieves reports from Azure Blob Storage. You need to generate a Service Shared Access Signature (SAS) token to allow an external partner to download a specific report file. To meet security guidelines, you must restrict access to a specific client IP address and enforce the use of HTTPS. Which two configurations must you define in the SAS token to meet these requirements? (Select TWO.)
Select all that apply
You are developing a multi-tenant web application that must allow users from any Microsoft Entra ID tenant to sign in using their work or school accounts. Personal Microsoft accounts (such as outlook.com or xbox.com) must be prevented from signing in. Which two configurations must you implement to meet these requirements? (Select TWO)
Select all that apply
You are developing an Azure App Service web app that needs to retrieve a database connection string stored as a secret in Azure Key Vault. You want to authenticate the web app using a system-assigned managed identity.
Which two actions should you perform to configure the required access? (Select two.)
Select all that apply
You are developing a multi-tenant web application named App1 that will be registered in Microsoft Entra ID under Tenant A. Users from other Microsoft Entra ID tenants, such as Tenant B, must be able to sign in to App1 and grant the application permissions to read their profile data.
You need to understand how the identity objects are represented in the directory structure when a user from Tenant B consents to App1.
Which of the following describes the resource creation behavior in Tenant B?
An engineer is designing a background daemon service that synchronizes directory metadata across several external corporate Microsoft Entra ID tenants using the Microsoft Graph API. The service must operate with application-only permissions (`User.Read.All`), prevent consumer accounts (such as Outlook.com) from registering, and allow external tenant administrators to grant consent and run the sync process without user interaction.
Which configuration combination must be used to meet these requirements?
You are developing a secure Web App named InventoryManager that runs on Azure App Service. The application must perform two main tasks:
1. Allow signed-in users to view their own profile details and manage their calendar events in Microsoft 365.
2. Run a scheduled background job every night to retrieve a list of all office groups in the tenant to update local access lists. This background job runs without a signed-in user.
You need to configure the app registration in Microsoft Entra ID.
Which of the following configurations must you apply to meet these requirements while adhering to the principle of least privilege? (Select TWO)
Select all that apply
You are deploying a web application to Azure App Service. The application must retrieve a database connection string stored in Azure Key Vault named keyvault1. You need to configure an application setting named ConnectionString using a Key Vault reference that points to a secret named dbsecret. Which of the following represents the correct format to use as the value of the application setting?
You are developing a C# ASP.NET Core web application that will be hosted on an Azure App Service. The application must securely query data from an Azure SQL Database. You decide to use a user-assigned managed identity to authenticate the App Service to the database to ensure that database credentials are not hardcoded. Which sequence of steps should you perform to provision the identity, associate it with the App Service, and configure the database access permissions?
Drag items to arrange them in the correct order
You are developing a background utility service that runs on an on-premises Windows server. The service must periodically retrieve diagnostic data from a secure custom web API protected by Microsoft Entra ID. You register the utility as an application in your Microsoft Entra ID tenant. The service must authenticate programmatically without user interaction using a certificate. Which two configuration steps should you perform? (Choose two.)
Select all that apply
You need to use the Azure CLI to create a new Azure Key Vault, store a database connection string as a secret, and then retrieve that secret. What is the correct sequence of Azure CLI commands to achieve this?
Drag items to arrange them in the correct order
You are configuring permissions and consent in Microsoft Entra ID for an enterprise scheduling solution consisting of two applications:
1. SyncDaemon: A background service (daemon) that runs continuously without user interaction to synchronize user profile information from Microsoft Graph.
2. PlannerSPA: A client-side Single Page Application (SPA) that allows authenticated users to access a custom backend Web API named `TaskAPI` to manage their tasks. The backend API is registered with the App ID URI `api://taskapi.contoso.com`.
Which two of the following configuration actions must you perform to implement the correct permissions and consent flows? (Select two.)
Select all that apply
You are deploying an Azure App Service web app that must retrieve a database connection string from an Azure Key Vault using a user-assigned managed identity for compliance reasons. The Key Vault uses Azure Role-Based Access Control (RBAC) for authorization.
The user-assigned managed identity has been assigned the 'Key Vault Secrets User' role on the Key Vault. You use the following Bicep template snippet to deploy the web app:
bicep
resource webApp 'Microsoft.Web/sites@2022-03-01' = {
name: webAppName
location: location
identity: {
type: 'UserAssigned'
userAssignedIdentities: {
'${userAssignedIdentityId}': {}
}
}
properties: {
siteConfig: {
appSettings: [
{
name: 'ConnectionStrings__Default'
value: '@Microsoft.KeyVault(SecretUri=https://kv-prod-01.vault.azure.net/secrets/DbConn)'
}
]
}
}
}
During deployment validation, the application fails to start, and the logs indicate that the application setting `ConnectionStrings__Default` cannot resolve the Key Vault reference.
Which configuration change must you apply to the Bicep template to ensure the web app can resolve the connection string?
You are authoring a Bicep template to deploy an Azure App Service web app that requires access to a shared Azure Key Vault. The web app must use a user-assigned managed identity named `app-identity` that is defined in the same template.
You declare the user-assigned managed identity resource as follows:
bicep
resource appIdentity 'Microsoft.ManagedIdentity/userAssignedIdentities@2023-01-31' = {
name: 'app-identity'
location: location
}
You need to define the `identity` property of the App Service web app resource to assign this managed identity.
Which Bicep block should you include in the App Service resource definition?
type: 'UserAssigned'
userAssignedIdentities: [
appIdentity.id
]
}
type: 'UserAssigned'
name: 'app-identity'
}
type: 'UserAssigned'
userAssignedIdentities: {
'${appIdentity.id}': {}
}
}
type: 'UserAssigned'
identityId: appIdentity.id
}
An Azure App Service web app uses a system-assigned managed identity to load configuration from an Azure App Configuration store. The App Configuration store contains a Key Vault reference that points to a secret stored in Azure Key Vault. While the web app successfully retrieves standard key-value settings, it fails to resolve the Key Vault reference at runtime. Which configuration change is required to allow the web app to resolve the Key Vault reference?