Implement Azure Security

When implementing authentication and authorization in Microsoft Entra ID, developers must understand the relationships between different identity objects. Which two of the following statements correctly describe the characteristics or roles of application objects and service principals?

You are developing a custom script that runs on an on-premises server to automate resource provisioning in Azure. The script must authenticate programmatically with Microsoft Entra ID using a dedicated service principal associated with an application registration. Which of the following credential types can be configured directly on the application registration to enable this authentication? (Select TWO)

You are developing an ASP.NET Core web application that will authenticate users using the Microsoft Identity Platform and then call a downstream web API. You need to configure Microsoft Entra ID and the application to enable this confidential client authentication scenario. Which two configuration steps are required? (Select two.)

An organization is deploying a C# background service that runs on an on-premises Windows server. The service must periodically query Microsoft Graph using its own credentials, authenticated by a client certificate. Which MSAL.NET builder class must you use to instantiate the client application?

A developer is configuring a C# console application that will run on a user's workstation. The application must authenticate the user using the Microsoft Identity Platform to retrieve their profile from Microsoft Graph. Which two components must be configured to support this authentication flow? (Select two)

You are developing a client-side React single-page application (SPA) that will run in users' web browsers. The application must authenticate users against Microsoft Entra ID and access a secure downstream web API. You need to configure the authentication and identity settings for the React application. Which configuration should you implement in Microsoft Entra ID?

You are developing a background daemon service named ConfigSync that runs as a containerized application in Azure Container Instances. The service must periodically query Microsoft Graph to read tenant group memberships to synchronize configurations. No user is signed in when the service runs.

You register the application in Microsoft Entra ID. You need to configure the API permissions for the application registration while adhering to the principle of least privilege.

Which configuration should you implement?

You are configuring a daemon application (App1) to call a custom Web API (API1) programmatically. Both applications are registered in Microsoft Entra ID. You need to configure API1 to expose an application permission, assign that permission to App1, and ensure App1 can successfully request an access token. Which four actions should you perform in sequence?

You are deploying an Azure App Service web application that must retrieve a database connection string from an Azure Key Vault without modifying the application code. You plan to configure an application setting in App Service to reference the Key Vault secret directly. The secret is located at the URI: https://contosovault.vault.azure.net/secrets/dbconn/f3b890. Which syntax format must you use for the App Service application setting value to reference this secret?

You are developing a secure C# .NET console application that uses the `Azure.Security.KeyVault.Certificates` SDK. The application must provision a new SSL/TLS certificate inside Azure Key Vault. Your organization requires that the certificate be signed by an internal corporate Certificate Authority (CA) that is not integrated with Azure Key Vault. You need to complete the process of generating the certificate while keeping the private key secure within the key vault. Arrange the steps in the correct order to configure, sign, and complete the certificate creation process.

An organization is transitioning its Azure resources to use Azure Role-Based Access Control (RBAC) instead of Key Vault access policies. A developer needs to ensure that an Azure Web App can retrieve secrets from a Key Vault named kv-prod using its system-assigned managed identity.

Which configuration change must be performed to allow the Web App to retrieve the secrets?

You are developing a secure client-side Single Page Application (SPA) named OrderClient and a backend Web API named OrderProcessor. The OrderClient application must make HTTP requests to OrderProcessor to retrieve order history on behalf of the currently signed-in user. You need to configure the Microsoft Entra ID app registrations for both applications to secure the API calls using OAuth 2.0. Which of the following configurations should you implement?

You need to configure an Azure App Service web app to retrieve configuration settings from an Azure App Configuration store. The solution must use a user-assigned managed identity.

Which sequence of actions should you perform? Arrange the actions in the correct order from first to last.

You are developing a web application that will be hosted on an on-premises web server. The application must programmatically retrieve database connection strings stored as secrets in an Azure Key Vault.

You need to configure the security and authentication requirements to allow the application to access the secrets.

Which of the following actions should you perform?

You are developing a C# application that runs on an Azure Virtual Machine (VM). The application uses the Azure.Identity library to authenticate to an Azure Key Vault using DefaultAzureCredential. Both a system-assigned managed identity and a user-assigned managed identity are enabled on the VM. The user-assigned managed identity is granted the Key Vault Secrets User role on the Key Vault, but the system-assigned managed identity has no permissions. When the application runs, it fails to retrieve secrets because DefaultAzureCredential attempts to authenticate using the system-assigned managed identity. You need to configure the environment so that DefaultAzureCredential uses the user-assigned managed identity without modifying the code that instantiates DefaultAzureCredential. Which of the following actions should you perform?

You are hosting an ASP.NET Core web application in an Azure App Service. The application requires a database connection string stored as a secret named db-conn in an Azure Key Vault named prod-kv. You create a user-assigned managed identity named app-identity and associate it with the App Service. In prod-kv, you grant the Key Vault Secrets User role to app-identity using Azure RBAC. In the App Service configuration, you add an application setting named ConnectionStrings__DefaultConnection with the value @Microsoft.KeyVault(SecretUri=https://prod-kv.vault.azure.net/secrets/db-conn/). However, the App Service fails to resolve the Key Vault reference at runtime and the application cannot retrieve the database connection string. Which of the following actions should you take to resolve this issue?

You are transitioning a .NET web application hosted on an Azure App Service named `web-prod` from using a system-assigned managed identity to a new user-assigned managed identity named `id-prod`. The application retrieves secrets from an Azure Key Vault named `kv-prod` using the `DefaultAzureCredential` class. The system-assigned identity must remain temporarily enabled during the migration to prevent configuration issues, but the application must immediately begin using the new user-assigned identity to authenticate. You need to configure the resource association and access permissions using the Azure CLI, and update the application configuration. Arrange the steps in the correct order to achieve this transition while preventing application authorization errors during the configuration process.

You are designing the security architecture for an enterprise Azure Function app that processes financial transactions. The app requires access to an Azure SQL Database and retrieves cryptographic keys from an Azure Key Vault. Due to strict CI/CD and compliance policies, the Function app is frequently torn down and recreated in different resource groups using automated Terraform scripts. You need to choose a managed identity configuration that ensures the application can authenticate to Azure SQL and Key Vault with the least administrative effort during deployment cycles, specifically avoiding the need to recreate database users or update Key Vault access policies after each deployment.

Which configuration should you implement?

You are developing a background worker service in C# that runs as a containerized application within Azure Container Apps. The service must run on a schedule without user interaction and authenticate to the Microsoft Identity Platform to read files from Microsoft Graph.

To comply with security policies, you must use Azure Managed Identities for authentication. The credentials must persist independently of the containerized app's lifecycle, allowing the container instances to be deleted, recreated, or scaled across different resource groups without requiring permissions to be reconfigured in Microsoft Entra ID.

Which approach should you use to implement this authentication?

You are configuring a Python FastAPI web application hosted on Azure App Service to load its settings from an Azure App Configuration store. One of the keys in the App Configuration store, DbConnectionString, is configured as a Key Vault reference pointing to a secret in Azure Key Vault. The App Service is configured to use a system-assigned managed identity. At runtime, the application successfully retrieves standard key-values from the App Configuration store but fails with an authorization error when attempting to resolve the value of the DbConnectionString key. How should you resolve this issue?