Implement Secure Azure Solutions AZ-204 Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Which authentication mechanism is recommended for an Azure-hosted application to access Azure Key Vault without storing credentials in code?

   • ASAS token
   • BClient secret
   • CAccess key
   • DManaged identity
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A company has an Azure Function app that uses a system-assigned managed identity to access Key Vault. The function is deployed to a staging slot and a production slot. The team wants to ensure that the staging slot cannot access production secrets. What should they do?

   • AUse a single system-assigned managed identity for the function app and grant it access to both staging and production Key Vaults.
   • BUse the function app's system-assigned identity and rely on the Key Vault firewall to block the staging slot's outbound IP.
   • CAssign a separate system-assigned managed identity to each slot and grant only the production slot access to the production Key Vault.
   • DUse a user-assigned managed identity and assign it to both slots, but use Key Vault access policies to restrict the staging slot.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   What is the recommended way to store sensitive values like API keys when using Azure App Configuration?

   • AStore them in Azure Key Vault and reference them from App Configuration
   • BStore them in App Configuration with a 'secret' label
   • CStore them in the application's source code
   • DStore them in environment variables on the application server
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   What is a managed identity in Azure?

   • AA manually created service principal that you must rotate periodically
   • BA type of firewall rule that controls network access to Azure resources
   • CAn automatically managed Azure Active Directory identity for an Azure resource
   • DA storage account key used to authenticate to Azure Storage
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A company runs an Azure Function that processes messages from a Service Bus queue and writes results to Azure Blob Storage. The function currently uses a connection string for Service Bus and a storage account key. You need to eliminate these secrets from the function's configuration. What should you do?

   • AUse a shared access signature (SAS) token generated at deployment time and store it in the function's configuration.
   • BEnable a system-assigned managed identity on the function app and assign the appropriate roles on the Service Bus and Storage account.
   • CUse Azure AD authentication with a service principal and store its credentials in the function's environment variables.
   • DStore the connection strings in Azure Key Vault and reference them from the function app's application settings.
   Reveal Solution Discussion Select an answer first