Implement Secure Azure Solutions AZ-204 Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A company uses Azure App Configuration to manage settings for multiple applications. Some settings are non-sensitive, but some are secrets stored in Key Vault. They want to ensure that if a secret is rotated in Key Vault, the applications automatically get the new value without redeployment. They also want to minimize the number of calls to Key Vault. What should they do?

   • AStore the secret in App Configuration with a label and use a deployment pipeline to update it.
   • BUse the Key Vault SDK in each application to fetch the secret on every request.
   • CUse Key Vault references in App Configuration and configure the applications to refresh the configuration periodically.
   • DStore the secret value directly in App Configuration and update it manually when the secret changes.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A company runs a containerized application in Azure Container Instances (ACI). The application needs to access a secret in Key Vault. The team wants to use a managed identity. What should they do?

   • AMount the Key Vault as a volume in the container group.
   • BUse the host's managed identity by running the container with --privileged and accessing the host's IMDS endpoint.
   • CEnable a system-assigned managed identity on the container group and grant it access to Key Vault using RBAC.
   • DStore the Key Vault URL and a service principal secret in environment variables and use them in the container.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   What is the primary purpose of Azure App Configuration?

   • ATo provide a fully managed relational database service
   • BTo host and run containerized applications in a managed environment
   • CTo securely store secrets, keys, and certificates for applications
   • DTo store and manage application settings and feature flags centrally
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A company has multiple Azure Functions in the same region that need to access the same Key Vault. The security team requires that each function have its own identity for auditing purposes, but the development team wants to minimize the number of role assignments to manage. What should they do?

   • AUse the Key Vault access policy to grant access to the resource group containing the functions.
   • BAssign a system-assigned managed identity to each function and grant each identity the Key Vault Secrets User role.
   • CUse a service principal with a client secret and share it across all functions.
   • DCreate a user-assigned managed identity and assign it to all functions, granting that identity access to Key Vault.
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A company has a web app that runs on Azure App Service and uses a system-assigned managed identity to access Key Vault. The app is deployed to multiple regions for disaster recovery. The Key Vault is in a single region. The team wants to ensure the app can still access secrets if the primary region fails. What should they do?

   • AUse a Key Vault with a failover cluster and automatic replication.
   • BStore the secrets in App Configuration with a managed identity and use its geo-replication.
   • CUse a single Key Vault with geo-replication enabled.
   • DCreate a second Key Vault in the secondary region and replicate secrets manually or with Azure Automation.
   Reveal Solution Discussion Select an answer first