Implement Azure Security

A developer is configuring a multi-tenant web application named AppRegister in Microsoft Entra ID. The application must allow users from any organizational tenant to authenticate. However, the application must prevent users with personal Microsoft accounts (MSA) from signing in. Which two configurations should the developer implement to meet these requirements?

An organization is deploying an ASP.NET Core web application to an Azure App Service. The application must retrieve a database password from an Azure Key Vault named `kv-finance-prod`. The Key Vault's permission model is configured to use Azure role-based access control (Azure RBAC). The App Service has a system-assigned managed identity enabled.

During testing, the application's C# code throws a `RequestFailedException` with an HTTP `403 Forbidden` error when calling `SecretClient.GetSecretAsync`.

You need to resolve this authorization issue using the principle of least privilege.

Which of the following actions should you perform?

You are deploying a Java Spring Boot application to an Azure App Service (Linux). The application loads its configuration settings from an Azure App Configuration store using the Spring Cloud Azure App Configuration library. The App Configuration store contains a key named `/application/payment-gateway-key` configured as a Key Vault reference that points to a secret in an Azure Key Vault named `kv-payment-prod`. A system-assigned managed identity is enabled on the App Service. When the application starts, it throws an authorization exception while trying to resolve the Key Vault reference.

Which of the following configurations is required to successfully resolve the secret value at runtime?

An organization is configuring a custom domain for a web application. You need to create an SSL/TLS certificate in Azure Key Vault by using a non-integrated Certificate Authority (CA). Which sequence of steps should you perform to complete this process? To answer, drag the appropriate actions from the list of actions to the answer area and arrange them in the correct sequence.

You are designing a secure backend service that provides external audit applications with temporary access to read audit logs stored in a specific Azure Blob Storage container. You decide to generate a Shared Access Signature (SAS) token.

The solution must meet the following security requirements:
- Minimize the risk of compromising the storage account's root access keys.
- Prevent the external application from listing other blobs or deleting logs.
- Enforce secure transmission protocols.
- Restrict access to a specific external IP range: 198.51.100.0/24.

Which two of the following configuration options should you implement to meet the requirements?

Your organization is migrating the permission model of an Azure Key Vault named `kv-payment-prod` to use the Azure role-based access control permission model instead of Vault access policies. An Azure App Service web application named `app-payment-prod` uses a system-assigned managed identity to retrieve database connection secrets from this Key Vault. Immediately after you change the permission model to Azure RBAC, the web application fails to retrieve secrets, returning a `403 Forbidden` error. Which action should you perform to restore the application's access to the secrets while adhering to the principle of least privilege?

You are configuring an Azure App Service web application to retrieve a third-party payment provider API key stored as a secret in Azure Key Vault. The Key Vault, named kv-payment-prod, is configured to use the Azure role-based access control (Azure RBAC) permission model. The web application uses a system-assigned managed identity for authentication. You must reference the Key Vault secret directly within the App Service application settings under a setting named PaymentApiKey. You must follow the principle of least privilege. Which action should you perform to configure the application setting and permissions?

You are configuring security for an Azure Blob Storage container named `partner-imports` that multiple external clients use to upload diagnostic data. Each client requires write-only permissions. You must ensure that you can immediately revoke access for any individual client if their credentials are leaked, without affecting other clients and without rotating the storage account access keys. Which configuration should you use?

You are authoring a Bicep template to deploy a new Azure Key Vault. The Key Vault must meet the following security requirements:

* Use Azure Role-Based Access Control (RBAC) for authorization instead of vault access policies.
* Prevent the permanent deletion of the Key Vault, its secrets, keys, and certificates by any user, including administrators.

Which two properties must you configure within the `properties` block of the Key Vault resource definition?

You are implementing a method in a C# application using the `Azure.Storage.Blobs` SDK (v12) to generate a temporary upload URI for a client. The client must be allowed to upload a single blob named `report.pdf` to a container named `documents`.

The implementation must meet the following security requirements:
- Limit permissions strictly to uploading the specified blob.
- Enforce the HTTPS protocol for the upload request.
- Sign the SAS using Microsoft Entra ID credentials rather than the storage account's shared access key.
- Prevent authentication failures due to clock skew between the client and Azure Storage.

You have the following code segment:

csharp
var credential = new DefaultAzureCredential();
var blobServiceClient = new BlobServiceClient(
new Uri("https://mystorage.blob.core.windows.net"),
credential
);

// [Block 1]

var sasBuilder = new BlobSasBuilder()
{
BlobContainerName = "documents",
BlobName = "report.pdf",
Resource = "b",
// [Block 2]
};
sasBuilder.SetPermissions(BlobSasPermissions.Write);

Which of the following code segments should you use to complete the implementation? (Select two.)

You are developing a C# command-line interface (CLI) tool that will be executed by system administrators on headless Linux servers. The tool must authenticate the administrators using their individual Microsoft Entra ID credentials to access a secure downstream Web API. The administrators' accounts have multi-factor authentication (MFA) enabled. Which MSAL.NET method should you use to acquire the token?

You are developing a C# console application that will run on multiple Azure Virtual Machines. The application must authenticate to the Microsoft Identity Platform and access Microsoft Graph using a managed identity. Because the application runs on multiple virtual machines, they must all share the same managed identity. You use MSAL.NET to implement the authentication code. You write the following code:

csharp
string clientId = "00000000-0000-0000-0000-000000000000";
string resource = "https://graph.microsoft.com";

// Initialize the managed identity application
IManagedIdentityApplication app = [Snippet 1]
.Build();

// Acquire the token
AuthenticationResult result = await app.[Snippet 2]
.ExecuteAsync();

Which two code segments should you use to complete the implementation? (Select two.)

Your company requires all storage accounts containing sensitive client data to comply with a security policy that limits the maximum validity period of Shared Access Signatures (SAS) signed with account keys to 4 hours. You have configured a SAS lifetime policy on the storage account named clientdata.

A developer generates an ad-hoc Service SAS token for a blob in this storage account with a validity period of 12 hours.

What is the result when a client attempts to read the blob using this Service SAS token 1 hour after it was generated?

You are developing an Azure Function App in C# that needs to retrieve a third-party API key stored as a secret in an Azure Key Vault. The Function App must authenticate to Key Vault securely using a system-assigned managed identity, adhering to the principle of least privilege.

Which five actions should you perform in sequence to configure the resources and write the code? To answer, arrange all the actions from the list of actions to the correct order.

A C# daemon application runs as a Windows Service on an on-premises server. The application must authenticate to the Microsoft Identity Platform without user interaction and query directory metadata from Microsoft Graph. You configure the application registration in Microsoft Entra ID with the Directory.Read.All Application permission, and an administrator grants tenant-wide consent. In your code, you instantiate an IConfidentialClientApplication instance. Which string array should you pass as the scopes argument to the AcquireTokenForClient method to successfully retrieve the access token?

An internal audit team requires temporary, read-only access to log files stored in a private blob container named `applogs`. You are writing the C# backend code to generate a Shared Access Signature (SAS) token for their client software.

The security policy dictates the following constraints:
- The token must be signed using Microsoft Entra ID credentials, avoiding the use of storage account keys.
- Connections must be restricted to HTTPS.
- Access must be limited specifically to the client software's outbound IP address of `203.0.113.88`.

Which of the following configurations or code steps are required to generate this SAS token? (Select TWO).

You are developing a secure backend service in C# using the Azure.Storage.Blobs SDK (v12) to grant temporary access for clients to upload diagnostic files to a private Azure Blob Storage container.

Your company enforces the following security requirements:
- Storage account access keys must not be used or loaded by the application; access must be authenticated via Microsoft Entra ID.
- Clients must only be permitted to write new files; they must not be allowed to read, list, or delete existing files.
- All client connections must be encrypted using HTTPS.
- The SAS token must be valid immediately upon generation, accounting for potential clock synchronization differences between the server and clients.

You write the following code segment:

csharp
// blobServiceClient is an authenticated BlobServiceClient using DefaultAzureCredential
var userDelegationKey = await blobServiceClient.GetUserDelegationKeyAsync(
DateTimeOffset.UtcNow.AddMinutes(-15),
DateTimeOffset.UtcNow.AddHours(2)
);

var sasBuilder = new BlobSasBuilder
{
BlobContainerName = "diagnostics",
BlobName = "log.txt",
Resource = "b"
};

Which code segment should you use to complete the SAS configuration and token generation?

You are developing a C# desktop application that will run on local client workstations. The application must authenticate users using the Microsoft Identity Platform and call a secured downstream Web API. You need to write the MSAL.NET code to initialize the application and acquire the access token. Which two code segments should you use? (Select two.)

An Azure App Configuration store needs to retrieve a database password stored in an Azure Key Vault named kv-app-prod at runtime. The Key Vault uses the Azure Role-Based Access Control (RBAC) permission model. The App Configuration store has a system-assigned managed identity enabled. Which of the following actions should you perform to configure the App Configuration store to reference the Key Vault secret? (Select TWO.)

You are developing a secure C# application using the `Azure.Storage.Blobs` SDK (v12) to generate a Shared Access Signature (SAS) token. The token will grant temporary access to an external partner to download a specific PDF report from a private Azure Blob Storage container.

The solution must comply with the following security constraints:
- Grant read-only access to the specific blob.
- Restrict communication to HTTPS requests only.
- Limit access to the partner's public IP address, which is `198.51.100.45`.
- Set the start time to 15 minutes before the current time to account for clock skew.
- Set the expiry time to 2 hours from the current time.

Which two of the following code segments should you use to configure the `BlobSasBuilder` instance named `sasBuilder`? (Choose two.)