A developer is writing a Python script that runs on an Azure VM with a system-assigned managed identity. The script needs to retrieve a secret from Azure Key Vault. Which code snippet should the developer use to authenticate?

Use AzureCliCredential to authenticate using the Azure CLI.

Use DefaultAzureCredential from the Azure SDK, which will automatically use the VM's managed identity.

Use InteractiveBrowserCredential to sign in interactively.

Use ClientSecretCredential with a service principal client ID and secret.

A developer is troubleshooting an application that uses DefaultAzureCredential to access Key Vault. The application runs on an Azure VM with a system-assigned managed identity. The developer has granted the VM's identity the Key Vault Secrets User role. However, the application still gets an AccessDenied error. What is the most likely cause?

The managed identity is not enabled on the VM.

The role assignment has not propagated yet.

The Key Vault firewall is blocking the VM's outbound traffic.

The application is using the wrong Key Vault URI.

A company is using Azure App Configuration to store feature flags and application settings. They want to ensure that only authorized applications can read the configuration. They also want to audit who accesses the configuration. What should they do?

Use access keys and rotate them monthly, and enable Azure Monitor alerts for failed access.

Store the configuration in Key Vault instead of App Configuration to get built-in auditing.

Use a private endpoint for App Configuration and restrict access to a specific VNet.

Use Azure AD authentication with managed identities and enable diagnostic settings to send audit logs to a Log Analytics workspace.

A development team is building a microservices application and wants to use Azure App Configuration to manage feature flags. They also need to secure the connection to App Configuration. Which authentication method should they use for the application to connect to App Configuration?

Use a managed identity for the microservices and grant it the App Configuration Data Reader role.

Use the App Configuration endpoint with no authentication because the data is not sensitive.

Use a connection string with a read-only access key and store it in the application's configuration file.

Use a shared access signature (SAS) token generated for the App Configuration store.

Azure Developer Associate

Domain 3Objective 2

Implement Secure Azure Solutions AZ-204 Practice Questions (Page 7)

Part of the Implement Azure security domain, which accounts for 15-20% of the AZ-204 exam. Microsoft does not publish an official question count, but from its 100-minute exam (~40–65 total, ~6–13 in this domain), expect 3–7 from this objective — we provide 35 practice questions to prepare you well beyond it. (estimate)

35questions here

7free pages

8concepts

15-20%of the exam

Questions 31–35

31foundation · easy
Which Azure resource can have a system-assigned managed identity enabled?
Select an answer first
32application · medium
A developer is writing a Python script that runs on an Azure VM with a system-assigned managed identity. The script needs to retrieve a secret from Azure Key Vault. Which code snippet should the developer use to authenticate?
Select an answer first
33expert · hard
A developer is troubleshooting an application that uses DefaultAzureCredential to access Key Vault. The application runs on an Azure VM with a system-assigned managed identity. The developer has granted the VM's identity the Key Vault Secrets User role. However, the application still gets an AccessDenied error. What is the most likely cause?
Select an answer first
34application · medium
A company is using Azure App Configuration to store feature flags and application settings. They want to ensure that only authorized applications can read the configuration. They also want to audit who accesses the configuration. What should they do?
Select an answer first
35application · medium
A development team is building a microservices application and wants to use Azure App Configuration to manage feature flags. They also need to secure the connection to App Configuration. Which authentication method should they use for the application to connect to App Configuration?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to AZ-204

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “AZ-204” is a trademark of its owner, used for identification only.

Implement Secure Azure Solutions AZ-204 Practice Questions (Page 7)

Questions 31–35

Which Azure resource can have a system-assigned managed identity enabled?

A developer is writing a Python script that runs on an Azure VM with a system-assigned managed identity. The script needs to retrieve a secret from Azure Key Vault. Which code snippet should the developer use to authenticate?

A company is using Azure App Configuration to store feature flags and application settings. They want to ensure that only authorized applications can read the configuration. They also want to audit who accesses the configuration. What should they do?

A development team is building a microservices application and wants to use Azure App Configuration to manage feature flags. They also need to secure the connection to App Configuration. Which authentication method should they use for the application to connect to App Configuration?

Keep studying — Implement Azure security