Implement Secure Azure Solutions AZ-204 Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A company has an Azure App Service that uses a system-assigned managed identity. The app needs to access a secret in Azure Key Vault. The developer has written code using DefaultAzureCredential. However, when running locally, the code fails to authenticate. What is the most likely cause?

   • AThe app's managed identity does not have permission to read the secret.
   • BThe Key Vault firewall is blocking the local machine's IP address.
   • CThe managed identity is not assigned to the local machine.
   • DThe local development environment does not have a managed identity, so DefaultAzureCredential cannot use it.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A company runs a .NET 8 web app on Azure App Service. The app must read a connection string from Azure Key Vault at startup. The team wants to avoid storing any credentials in the app's configuration files. You need to implement the retrieval with the least administrative overhead. What should you do?

   • AEnable the app's system-assigned managed identity and grant it the Key Vault Secrets User role, then use DefaultAzureCredential in code to fetch the secret.
   • BCreate a service principal, store its client secret in App Service application settings, and use ClientSecretCredential in code.
   • CStore the Key Vault URI in app settings and use the Key Vault SDK with a certificate uploaded to the app's certificate store.
   • DUse the Key Vault REST API with an access token obtained from Azure AD using the app's client ID and client secret from the app settings.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   What types of items can be stored in Azure Key Vault?

   • AConfiguration strings and feature flags
   • BVirtual machines and storage accounts
   • CSecrets, keys, and certificates
   • DDatabase tables and rows
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   What must be configured in Azure Key Vault to allow a managed identity to read secrets?

   • AA network security group rule allowing the managed identity's IP address
   • BA connection string in the Key Vault
   • CA shared access policy on the Key Vault
   • DAn access policy granting the 'Get' permission for secrets to the managed identity
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A company is designing a solution that stores application settings in Azure App Configuration. Some settings are sensitive and must be stored in Azure Key Vault. The application is a .NET Core service that uses the built-in configuration provider. What is the recommended way to load these settings?

   • AUse the Key Vault configuration provider directly and manually map each secret to a configuration key.
   • BStore all settings in App Configuration and use the Key Vault API to encrypt the sensitive values before storing them.
   • CUse the App Configuration provider with Key Vault references enabled, and configure the provider with a managed identity.
   • DUse the Key Vault provider for all settings, including non-sensitive ones, to keep everything in one place.
   Reveal Solution Discussion Select an answer first