Examkin

Implement Azure Security

203 soru

Tüm türler203Çoktan seçmeli102Çoklu seçim71Sıralama30
Soru 201Soru →

An organization is developing a multi-tenant software solution named VendorPortal. The solution must allow users from any organizational Microsoft Entra ID tenant to sign in. The solution must explicitly block authentication requests from personal Microsoft accounts, such as those registered with Outlook.com or Xbox Live. Which configuration parameters should you apply to the application manifest and the identity provider authority URL?

Cevabı ve açıklamayı göster

Cevap: Manifest signInAudience set to AzureADMultipleOrgs and authority URL set to https://login.microsoftonline.com/organizations

Cevap

Manifest signInAudience set to AzureADMultipleOrgs and authority URL set to https://login.microsoftonline.com/organizations
To configure a multi-tenant application that supports only organizational directories and blocks personal Microsoft accounts, the developer must set the signInAudience in the application manifest to AzureADMultipleOrgs. Additionally, the authority URL must point to the organizations endpoint. Using the organizations endpoint ensures that personal accounts are blocked at the identity provider sign-in page before they can input credentials.

Adım Adım Çözüm

1
Determine the required user audience scope for the application.
The application must support users from any organization (multi-tenant) but exclude personal Microsoft accounts.
This establishes the target audience profile for the manifest configuration.
2
Select the appropriate signInAudience value in the Microsoft Entra ID application manifest.
Identify that AzureADMultipleOrgs is the correct setting for multi-tenant organizations without personal accounts.
AzureADMultipleOrgs enables multi-tenant support while excluding personal accounts (which would require AzureADandPersonalMicrosoftAccount).
3
Configure the authority endpoint to match the tenant restriction requirements.
Select the /organizations endpoint (https://login.microsoftonline.com/organizations) instead of /common.
The /organizations endpoint restricts sign-in attempts to organizational directories, preventing personal accounts from proceeding at the protocol level.

Anahtar Kavram

Configuring multi-tenant authorization endpoints and application manifest audiences in Microsoft Entra ID.
Tahmini Süre:1m 30s
Soru 202Soru →

You are deploying a .NET web application to an Azure App Service. The application is configured to retrieve its configuration settings from an Azure App Configuration store named appconf-prod. Some settings, such as database credentials, are stored as Key Vault references pointing to secrets in an Azure Key Vault named kv-prod. The App Service has a system-assigned managed identity enabled. At runtime, the application loads configuration values from appconf-prod but receives the raw JSON metadata of the Key Vault references instead of the actual secret values. Which of the following actions must you perform to resolve this issue and successfully retrieve the secret values? (Select THREE correct actions.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Grant the App Service's system-assigned managed identity the App Configuration Data Reader role on the appconf-prod store.; Grant the App Service's system-assigned managed identity the Key Vault Secrets User role on the kv-prod Key Vault.; Configure the application's configuration builder to call ConfigureKeyVault and pass a token credential such as DefaultAzureCredential.

Cevap

To resolve the raw JSON metadata issue and retrieve the actual secret values, you must grant the App Service's managed identity the App Configuration Data Reader role on the configuration store, grant the same managed identity the Key Vault Secrets User role on the Key Vault, and configure the application code using ConfigureKeyVault with an appropriate credential like DefaultAzureCredential.
The system-assigned managed identity of the App Service must have read permissions for both the App Configuration store (App Configuration Data Reader) and the Key Vault (Key Vault Secrets User). In addition, the application's startup code must be updated to call ConfigureKeyVault on the configuration builder, passing a credential like DefaultAzureCredential so the SDK can resolve the references at startup.

Adım Adım Çözüm

1
Configure application code to resolve Key Vault references.
The App Configuration provider client is instructed to detect and fetch Key Vault references using the provided credentials.
By default, the SDK only reads key-value metadata. Enabling ConfigureKeyVault with DefaultAzureCredential enables client-side resolution of Key Vault references.
2
Assign the App Configuration Data Reader role to the App Service managed identity on the App Configuration store.
The application can successfully authenticate and read the configurations (including Key Vault reference metadata) from the store.
The managed identity requires read permissions on the App Configuration store to fetch configuration keys and values.
3
Assign the Key Vault Secrets User role to the App Service managed identity on the Key Vault.
The application can fetch the actual secret values from Key Vault when resolving the references.
Since Key Vault references are resolved client-side by the application, the application's managed identity must have secret read access on the target Key Vault.

Anahtar Kavram

Key Vault references in Azure App Configuration are resolved client-side by the application's SDK. This requires that the application's identity has read permissions to both the App Configuration store and the target Key Vault, and that the SDK is configured to resolve the references.
Soru 203Soru →

You are deploying a web application to Azure App Service. The application must retrieve a database connection string from an Azure Key Vault named kv-billing. You configure a system-assigned managed identity for the App Service and assign the Key Vault Secrets User role to the identity on kv-billing. You need to configure an application setting in the App Service named DbConnectionString that references the secret named DbPassword in the Key Vault without pinning it to a specific version. Which of the following values represents the correct syntax to define the Key Vault reference?

Cevabı ve açıklamayı göster

Cevap: @Microsoft.KeyVault(SecretUri=https://kv-billing.vault.azure.net/secrets/DbPassword)

Cevap

@Microsoft.KeyVault(SecretUri=https://kv-billing.vault.azure.net/secrets/DbPassword)
The correct answer uses the valid syntax format '@Microsoft.KeyVault(SecretUri=https://kv-billing.vault.azure.net/secrets/DbPassword)'. This tells the Azure App Service runtime to fetch the secret named 'DbPassword' from the Key Vault named 'kv-billing' using the system-assigned managed identity.

Adım Adım Çözüm

1
Identify the required prefix for Key Vault references in Azure App Service application settings.
The prefix must be @Microsoft.KeyVault.
Azure App Service recognizes this prefix to intercept and resolve the reference from Key Vault before exposing the configuration value to the application code.
2
Identify the correct parameter name for referencing a secret by its URI.
The parameter name is SecretUri.
Using other parameter names like Uri will cause the reference to be treated as invalid syntax and it will not resolve.
3
Format the URI for the secret without pinning a version.
The URI is https://kv-billing.vault.azure.net/secrets/DbPassword.
Leaving out the version GUID at the end of the secret path ensures that the reference always resolves to the latest version of the secret.

Anahtar Kavram

Key Vault references allow an Azure App Service application to read secrets from Key Vault using configuration settings without modifying application code, requiring a system-assigned or user-assigned managed identity with appropriate access permissions.
ÖncekiSayfa 11 / 11
Implement Azure Security Alıştırma Soruları — Microsoft Azure Developer (AZ-204) — Sayfa 11 | Examkin