AZ204(Implement Security + Monitor and troubleshoot AZsolutions)

You are developing a web application hosted on Azure App Service. It must scale out automatically based on CPU usage.

Solution: Configure autoscale settings in Azure App Service.

Does the solution meet the goal?

• Yes

• No

Answer explanation

Azure App Service supports autoscaling based on metrics like CPU usage. This is the correct approach.

Which of the following is the correct way to securely store and retrieve secrets in an Azure Function app?

• A. Store secrets in application settings

• B. Use Azure Key Vault with Managed Identity

• C. Store secrets in a local JSON file

• D. Use environment variables

Answer explanation

Azure Key Vault combined with Managed Identity is the most secure and recommended way to store and access secrets.

You are building a backend service that needs to access Azure Blob Storage. You decide to use a connection string stored in code.

Solution: Store the connection string in the source code and deploy it with the application.

Does the solution meet the goal?

• Yes

• No

Answer explanation

Storing secrets in code is insecure. Use Azure Key Vault or App Configuration instead.

Which Azure service allows you to manage feature flags and app settings centrally?

• A. Azure Monitor

• B. Azure App Configuration

• C. Azure Key Vault

• D. Azure Policy

Answer explanation

Azure App Configuration is designed for managing app settings and feature flags.

You are developing an Azure Function that needs to access a secret stored in Azure Key Vault. You configure a system-assigned managed identity for the function and grant it access to the Key Vault.

Solution: Use the Azure SDK to authenticate with the managed identity and retrieve the secret.

Does the solution meet the goal?

• Yes

• No

Answer explanation

This is the correct and secure way to access secrets from Azure Key Vault using managed identity.

What is the purpose of a Shared Access Signature (SAS) in Azure Storage?

• A. To encrypt data at rest

• B. To provide time-limited access to storage resources

• C. To monitor storage usage

• D. To manage storage account keys

Answer explanation

SAS tokens allow fine-grained, time-limited access to storage resources without exposing account keys.

You are developing a web app that needs to access Azure Blob Storage. You decide to use a user-assigned managed identity and assign it to the app. However, you forget to grant the identity access to the storage account.

Solution: The app will still be able to access the storage account using the managed identity.

Does the solution meet the goal?

• Yes

• No

Answer explanation

The managed identity must be granted the appropriate role (e.g., Storage Blob Data Reader) to access the storage account.

Which Microsoft service allows you to programmatically access user data in Microsoft 365, such as emails and calendars?

• A. Azure Monitor

• B. Microsoft Graph

• C. Azure AD B2C

• D. Azure Logic Apps

Answer explanation

Microsoft Graph is the unified API endpoint for accessing Microsoft 365 services.

You are developing a service that needs to authenticate users using Microsoft Entra ID. You register the app in Entra ID and configure OAuth 2.0 authentication.

Solution: Use the Microsoft Authentication Library (MSAL) to acquire tokens.

Does the solution meet the goal?

• Yes

• No

Answer explanation

Microsoft Authentication Library (MSAL) is the recommended library for acquiring tokens from Microsoft Entra ID.

Which of the following is NOT a valid use case for Azure Managed Identities?

• A. Accessing Azure Key Vault

• B. Authenticating users in a web app

• C. Accessing Azure SQL Database

• D. Accessing Azure Storage

Answer explanation

Managed identities are for app-to-Azure-resource authentication, not for user authentication.