Implement Azure Security

You are writing a C# helper method using the `Azure.Storage.Blobs` SDK (v12) to generate a temporary Shared Access Signature (SAS) URL for a specific blob. The SAS URL must meet the following security and technical requirements:
- The SAS token must be signed using Microsoft Entra ID credentials (not storage account access keys).
- The SAS token must remain valid for exactly 2 hours.
- Access to the blob must be restricted to HTTPS only.
- The client must have read-only access (least privilege).
- The code must execute successfully without throwing runtime exceptions from the Azure Storage service.

You write the following C# method:

csharp
public static async Task<Uri> GenerateSecureBlobSasUriAsync(
BlobClient blobClient,
BlobServiceClient blobServiceClient,
string ipAddressRange)
{
// Step 1: Request User Delegation Key
DateTimeOffset keyStart = DateTimeOffset.UtcNow.AddMinutes(-15);
DateTimeOffset keyEnd = DateTimeOffset.UtcNow.AddDays(10);

UserDelegationKey delegationKey = await blobServiceClient.GetUserDelegationKeyAsync(keyStart, keyEnd);

// Step 2: Configure SAS Builder
BlobSasBuilder sasBuilder = new BlobSasBuilder
{
BlobContainerName = blobClient.BlobContainerName,
BlobName = blobClient.Name,
Resource = "b",
StartsOn = DateTimeOffset.UtcNow.AddMinutes(-15),
ExpiresOn = DateTimeOffset.UtcNow.AddHours(2),
Protocol = SasProtocol.HttpsAndHttp
};

sasBuilder.SetPermissions(BlobSasPermissions.Read | BlobSasPermissions.Write);
sasBuilder.IPRange = SasIPRange.Parse(ipAddressRange);

// Step 3: Generate and append SAS token
BlobSasQueryParameters sasParams = sasBuilder.ToSasQueryParameters(delegationKey, blobServiceClient.AccountName);

UriBuilder uriBuilder = new UriBuilder(blobClient.Uri)
{
Query = sasParams.ToString()
};

return uriBuilder.Uri;
}

Which three modifications must you make to the code to ensure it executes successfully and complies with all requirements?

You are configuring permissions in Microsoft Entra ID for a Single Page Application (SPA) named TimeTrackerSPA. The application runs in the user's browser and must perform the following actions:

1. Retrieve the signed-in user's profile details from Microsoft Graph.
2. Read and write time entries using a custom backend Web API named TimeSheetAPI on behalf of the signed-in user.

The TimeSheetAPI application registration exposes a delegated scope named TimeSheet.Write.

Which permissions should you configure for the TimeTrackerSPA application registration?

An organization deploys a Node.js REST API inside Azure Container Apps (ACA). The container app uses a user-assigned managed identity named `id-api-prod` to authenticate.

The API loads its configuration from an Azure App Configuration instance named `config-payment-prod`. The App Configuration store contains a key named `PaymentGateway:ApiKey` which is configured as a Key Vault reference pointing to a secret named `gateway-api-key` in a Key Vault named `kv-payment-prod`.

The managed identity `id-api-prod` is assigned the App Configuration Data Reader role on the App Configuration store. However, at runtime, the API fails to start because it cannot retrieve the resolved value of the `PaymentGateway:ApiKey` setting, instead receiving an access denied authorization error.

Which of the following actions should you perform to resolve the error?

You are deploying a C# ASP.NET Core web application to Azure App Service. The application is configured to use a system-assigned managed identity. The application must retrieve a database password from an Azure Key Vault named kv-finance-prod. The Key Vault is configured with the Vault access policy permission model.

The application contains the following C# code to retrieve the secret:

csharp
using System;
using Azure.Identity;
using Azure.Security.KeyVault.Secrets;

// ...
var client = new SecretClient(new Uri("https://kv-finance-prod.vault.azure.net/"), new DefaultAzureCredential());
KeyVaultSecret secret = await client.GetSecretAsync("DbPassword");

During testing, the call to GetSecretAsync fails with a RequestFailedException showing a 403 (Forbidden) error.

Which action should you perform to resolve the authorization issue using the minimum level of privileges?

A company is deploying an automated synchronization service named DeptSync that runs as a daily background task on an Azure virtual machine. The service must connect to Microsoft Graph to update the department and job title properties of all user accounts in Microsoft Entra ID. The service runs without any user interaction.

You need to configure the Microsoft Entra ID application registration for DeptSync to allow the service to authenticate and perform these updates securely using the principle of least privilege.

Which two actions should you perform? (Choose two.)

You are deploying a web application to Azure App Service. The application must retrieve database credentials from an Azure Key Vault. To follow organizational security policies, you decide to use a user-assigned managed identity to authenticate the application.

Which of the following actions are required to configure this security solution? (Select TWO.)

You are developing a C# desktop application using MSAL.NET that will run on Windows 11 client machines. The application must authenticate users against Microsoft Entra ID and support Single Sign-On (SSO) using the native Windows Web Account Manager (WAM) broker. You need to configure the Microsoft Entra ID application registration and the C# initialization code. Which two configuration steps should you perform? Select two.

You are developing a secure web application that runs on an Azure Virtual Machine. The application must generate a temporary URI to allow external clients to download PDF reports from a private Azure Blob Storage container named reports. To meet security requirements, you must not use storage account keys. Instead, you configure a User-Assigned Managed Identity for the Virtual Machine. In the application code, you successfully request a User Delegation Key and build a Shared Access Signature (SAS) token using the Azure.Storage.Blobs SDK. The SAS token is configured with read permissions and a lifetime of $1$ hour. However, when external clients attempt to download a report using the generated SAS URI, they receive an HTTP $403$ (Forbidden) error. You verify that the Virtual Machine's managed identity has been assigned the Storage Blob Delegator role at the storage account level. Which action should you perform to resolve the HTTP $403$ error?

You are deploying an ASP.NET Core web application to an Azure App Service. The application must retrieve secrets from an Azure Key Vault using a user-assigned managed identity. The application code uses DefaultAzureCredential from the Azure.Identity SDK to authenticate. Which sequence of steps should you perform to configure the environment and enable secure access?

You are deploying a web application to multiple Azure App Services in different regions. The applications need to retrieve a database connection string stored in an Azure Key Vault named `kv-checkout-prod`.

The Azure Key Vault is configured to use the Azure role-based access control (Azure RBAC) permission model for authorization. To simplify permission management across all regions and avoid recreating role assignments when App Services are redeployed, you decide to use a single user-assigned managed identity named `id-checkout-prod`.

You need to configure the App Services to retrieve the secret value using this identity while adhering to the principle of least privilege.

Which configuration should you apply?

An organization has a web application deployed to Azure App Service named app-payment-prod. The application needs to retrieve a database connection string stored as a secret in an Azure Key Vault named kv-payment-prod. The Key Vault is configured to use the Azure Role-Based Access Control (Azure RBAC) authorization model. You must implement access using the principle of least privilege. Which set of configuration steps should you perform to grant the web application access to the Key Vault secret?

You are configuring a Java web application hosted on Azure App Service to load configuration settings from an Azure App Configuration store. The application needs to retrieve a database password stored in an Azure Key Vault named kv-prod.

In the Azure App Configuration store, you create a key-value pair where the key is DbPassword and the value is set to {"uri":"https://kv-prod.vault.azure.net/secrets/db-pass"}. During application startup, the App Configuration provider library retrieves the DbPassword configuration, but logs show the value is received as the raw JSON string {"uri":"https://kv-prod.vault.azure.net/secrets/db-pass"} instead of the resolved secret. The App Service is configured with a system-assigned managed identity that has the 'Key Vault Secrets User' role on kv-prod.

Which of the following actions should you take to ensure the secret is correctly resolved by the application?

Your team is configuring a distributed C# application hosted on an Azure Virtual Machine Scale Set (VMSS) to access an Azure Storage account. Multiple VMSS instances will be scaled out and in dynamically. The identity used for accessing the storage account must persist independently of the VMSS lifecycle.

Which two configurations are required to ensure the application can successfully authenticate and read blobs from the storage account using the Azure.Identity library? (Select two.)

You are developing an ASP.NET Core Web API named InventoryAPI that exposes operations to manage warehouse inventory. You register InventoryAPI in Microsoft Entra ID. You need to configure permissions and scopes to support the following client applications:

1. InventorySPA: A Single Page Application where warehouse employees sign in and manage stock. The application must perform operations on behalf of the signed-in user.
2. InventoryDaemon: A background console application that syncs stock levels from an external system overnight. The daemon runs without user interaction.

Which two configurations should you perform to support these applications using the principle of least privilege?

You are developing a backend service in C# using MSAL.NET that runs on an Azure App Service. The App Service has a user-assigned managed identity configured with the Client ID `d29d3368-8f83-4a25-97a1-872f23cf9e3c`. The service must securely access an Azure Key Vault without storing any secrets or certificates in the application configuration. Which two configuration steps should you implement in the C# code? (Select two.)

An organization has a web application that provides temporary write access to an Azure Blob Storage container named `uploads` for external clients. You must meet the following requirements:
- Enable the security team to revoke access tokens immediately without impacting other clients or rotating the storage account keys.
- Limit the lifetime of individual client tokens to a maximum of 30 minutes.
- Enforce the use of secure connections only.

Which two actions should you perform to meet these requirements?

You are developing a C# web application that runs on an Azure App Service. The application must retrieve database connection secrets from an Azure Key Vault. You have already enabled a system-assigned managed identity for the App Service.

You write the following code to access the Key Vault:

csharp
using Azure.Identity;
using Azure.Security.KeyVault.Secrets;

// ...
var client = new SecretClient(new Uri("https://myvault.vault.azure.net/"), new DefaultAzureCredential());
var secret = await client.GetSecretAsync("DbConnectionString");

When you deploy and run the application in Azure, it fails to retrieve the secret and throws an exception indicating that access is forbidden.

Which of the following actions should you perform to resolve this error?

You are developing a Single Page Application (SPA) named SalesPortal and a backend Web API named SalesAPI. You register both applications in Microsoft Entra ID. SalesPortal runs in the user's web browser and must call SalesAPI to retrieve the signed-in user's sales data. You need to configure the applications to ensure SalesPortal can access SalesAPI on behalf of the signed-in user while adhering to the principle of least privilege. Which action should you perform to configure the required permissions?

You are developing a Single Page Application (SPA) using React and MSAL.js $2.\text{x}$. The application must authenticate users using the Microsoft Identity Platform and call a downstream secured Microsoft Graph API. You register the application in the Microsoft Entra admin center. Under the Authentication blade, you add a redirect URI of `http://localhost:3000` but configure the platform type as Web instead of Single-page application. During testing, users can successfully sign in and the application receives an authorization code. However, when the application attempts to exchange the authorization code for an access token, the token endpoint returns an error. You need to resolve the error and ensure that the application can successfully acquire access tokens. Which of the following actions should you perform?

You are developing a secure application in C# that interacts with an Azure Storage account. The application must generate a Shared Access Signature (SAS) token to grant an external service temporary read and write permissions to a private blob container named invoices. The solution must meet the following security requirements:

- Access must be limited to HTTPS only.
- The storage account access keys must not be exposed or used to sign the SAS.
- The SAS must be valid for exactly two hours, starting immediately, while accounting for potential clock synchronization differences between clients and Azure.

Which two actions should you perform to create the SAS token? (Select two.)