Implement Azure Security

An organization is developing an ASP.NET Core Web App named ExpenseTracker. The application allows signed-in employees to submit business expenses. To support this, ExpenseTracker must perform the following actions:
1. Retrieve the profile details of the signed-in user from Microsoft Graph.
2. Retrieve a list of departments from a custom protected Web API named DepartmentService (App ID URI: api://departmentservice) on behalf of the signed-in user.

You need to configure the permissions in Microsoft Entra ID for the ExpenseTracker application registration while adhering to the principle of least privilege. Which of the following configuration steps should you perform? (Select TWO)

You are developing a C# daemon application that runs as a background service on an on-premises Windows server. The application must connect to Azure Blob Storage to process files and authenticate to the Microsoft Identity Platform to obtain access tokens. The solution must meet the following security requirements:
- The application must authenticate without user interaction.
- Credentials must not be stored in cleartext in the application files.
- The authentication mechanism must follow the principle of least privilege.

You need to configure the authentication for the application using MSAL.NET. Which two actions should you perform?

You are developing a C# ASP.NET Core web application hosted on an Azure App Service. The App Service is already configured with a system-assigned managed identity to access an Azure SQL Database. You need to configure the App Service to access secrets in an Azure Key Vault. The Key Vault uses Azure Role-Based Access Control (Azure RBAC) for its data plane authorization. To minimize the security blast radius, you must use a user-assigned managed identity for Key Vault access. You must implement the solution using the Azure.Identity SDK and the DefaultAzureCredential class without modifying the initialization parameters of DefaultAzureCredential in your application code. Which sequence of steps should you perform to successfully retrieve the secrets?

You are developing a background daemon service named DataArchiver that runs on a schedule to back up documents from all user OneDrive libraries to an Azure Blob Storage container. The service must authenticate silently without any user interaction.

You register DataArchiver in Microsoft Entra ID. You need to configure the permissions for Microsoft Graph to allow the service to read the files.

Which configuration should you apply to the application registration to meet the requirements while adhering to the principle of least privilege?

You are developing a web application named DocPortal. The application must perform the following security actions:
1. Allow users to sign in and view files stored in their personal OneDrive folders.
2. Allow a scheduled background service within the application to read group memberships across the tenant without a signed-in user.

You need to configure the Microsoft Graph permissions for the application registration. The solution must adhere to the principle of least privilege.

Which two permissions should you configure? (Select two.)

You are developing a web application named ComplianceHub and a backend Web API named AuditAPI. Both applications are registered in Microsoft Entra ID. The applications must meet the following security requirements:

1. ComplianceHub must allow signed-in users to read their own audit reports from AuditAPI.
2. A background archiving service must run nightly to read all audit logs from AuditAPI without user interaction.

You need to configure the permissions and scopes for the application registrations. Which two configurations should you perform? (Select two.)

You are developing a Single Page Application (SPA) using React and MSAL.js to authenticate users and obtain tokens for a downstream Web API. During the application registration in Microsoft Entra ID, you configured the redirect URI as http://localhost:3000/callback. When testing the authentication flow, the user can successfully sign in and the application receives an authorization code. However, when MSAL.js attempts to exchange the authorization code for an access token by sending a POST request to the token endpoint, the browser blocks the request with a Cross-Origin Resource Sharing (CORS) error. Which of the following describes the cause of this issue and the correct action to resolve it?

You are developing a secure C# web application that runs on-premises. The application must sign in users and then call a downstream Web API on their behalf using the Microsoft Identity Platform.

The application is configured as a confidential client. You have already obtained the authorization code from the initial user login redirect.

You write the following code to initialize the application:

csharp
IConfidentialClientApplication app = ConfidentialClientApplicationBuilder.Create(clientId)
.WithClientSecret(clientSecret)
.WithRedirectUri(redirectUri)
.Build();

You need to complete the code to exchange the authorization code for an access token. Which code segment should you use?

You are developing a daemon application that runs on an on-premises physical server. The application must authenticate programmatically to Azure Key Vault to retrieve secrets. You need to configure the identity for this application. Which identity configuration should you use?

You need to use the Azure CLI to create a new application registration in Microsoft Entra ID, instantiate its service principal, and grant the service principal Contributor access to a resource group.

Which sequence of commands should you perform? To answer, move all the actions from the list of actions to the answer area and arrange them in the correct order.

An organization is developing a multi-tenant web application. You register the application in your home Microsoft Entra ID tenant. Which resource is automatically created in a customer's tenant when their administrator consents to allow your application to access their resources?

You are developing a multi-tenant web application that will be hosted in Azure. The application must access Microsoft Graph API on behalf of signed-in users from various external Microsoft Entra ID tenants. When a customer's tenant administrator consents to the application, a local representation of your application must be created in their tenant to define permissions and access controls. Which object is created in the customer's tenant to represent this local instance of the application?

You are developing a multi-tenant web application that will be used by other organizations. The application requires delegated access to Microsoft Graph. You need to configure the application registration and ensure that a customer's tenant administrator can consent to the application and assign users to it.

Which sequence of actions should you perform? To answer, move all actions from the list of actions to the active area and arrange them in the correct order.

You are designing the security architecture for a suite of internally developed Azure microservices. One of the backend services, OrderProcessor, is registered as a Web API in Microsoft Entra ID. You must enforce a policy where other client microservices (which authenticate daemon-to-daemon using the client credentials flow) cannot acquire an access token for OrderProcessor unless they have been explicitly assigned permission by an administrator. If an unassigned client service attempts to request a token for OrderProcessor, Microsoft Entra ID must deny the token request at the token endpoint. Which configuration step must you perform to enforce this behavior?

An organization is developing an automated data synchronization tool that runs on an on-premises physical server. The tool must run as a background service without user interaction and read files from an Azure Blob Storage container. You register an application named DataSyncApp in your Microsoft Entra ID tenant. You need to configure the required identity and credentials to allow the synchronization tool to authenticate and access the storage container. What should you do?

A developer is configuring a background service running on an on-premises server that must retrieve data from a custom Web API secured by Microsoft Entra ID. The background service runs autonomously without any user interaction and authenticates using its client secret.

The developer manually updates the Microsoft Entra ID application manifest of the background service to request access to the Web API. In the requiredResourceAccess section of the manifest, the developer adds the correct resource app ID and includes the permission ID in the resourceAccess array, setting the type property of the permission to Scope.

After the developer grants administrator consent, the background service successfully obtains an access token using the OAuth 2.0 client credentials grant flow. However, when the service presents the token to the Web API, the API rejects the request with an HTTP 403 Forbidden error.

What is the cause of this authentication issue?

You register a new application in Microsoft Entra ID to integrate authentication into a custom web app. Which object is created in your home tenant to serve as the global configuration and blueprint for the application across all tenants?

You are developing a web application that will be hosted on an Azure App Service. The application must securely retrieve database connection strings from an Azure Key Vault. You decide to use a managed identity to authenticate to the Key Vault. The identity must be dedicated to this specific App Service instance, and its lifecycle must be tied directly to the App Service so that deleting the App Service automatically deletes the identity. Which identity type should you implement?

You are designing a deployment architecture for a set of five independent Azure App Service web apps. Each web app must access a shared Azure Key Vault to retrieve common application settings. Each web app is managed and scaled independently, and some may be deleted or recreated during routine updates. You need to configure a managed identity solution that minimizes administrative overhead for granting Key Vault permissions and ensures that the identity credentials persist even if individual web apps are deleted.

Which managed identity configuration should you implement to meet these requirements?

An enterprise is migrating a legacy batch processing system to Azure. The system consists of an on-premises scheduler service that must securely upload transaction logs to an Azure Blob Storage container. Corporate security policies strictly prohibit storing passwords, client secrets, or access keys in the service configuration. You must establish authentication using a Microsoft Entra ID service principal configured with a client certificate.

You need to configure the required Microsoft Entra ID and Azure resources to establish this secure communication flow.

Which five actions should you perform in sequence? To answer, arrange the actions from the list of actions in the correct order.