A company is building a mobile application that needs to authenticate users with Microsoft Entra ID. The application needs to call a custom web API on behalf of the user. The application will be used by employees of the company only. Which authentication flow should the developer implement?

Resource owner password credentials (ROPC) flow.

Authorization code flow with PKCE.

A company wants to build a custom app that reads and writes calendar events for all users in the organization. The app will run as a background service. The company wants to minimize the permissions granted to the app. Which Microsoft Graph permission should the app request?

Calendars.ReadWrite.All as an application permission.

User.ReadWrite.All as an application permission.

Calendars.Read.All as an application permission.

Calendars.ReadWrite as a delegated permission.

A company has a web app that signs in users with Microsoft Entra ID. The app calls a downstream API. The API is protected by a Conditional Access policy that requires multi-factor authentication (MFA). The web app uses the on-behalf-of flow to get a token for the API. The user has already completed MFA during sign-in. Why might the API call fail?

The on-behalf-of flow does not include the MFA claim in the token for the downstream API.

The web app's client secret is expired.

The user's session has timed out.

The API's app registration does not have the required API permission.

Azure Developer Associate

Domain 3Objective 1

Implement User Authentication and Authorization AZ-204 Practice Questions (Page 1)

Part of the Implement Azure security domain, which accounts for 15-20% of the AZ-204 exam. Microsoft does not publish an official question count, but from its 100-minute exam (~40–65 total, ~6–13 in this domain), expect 3–7 from this objective — we provide 35 practice questions to prepare you well beyond it. (estimate)

35questions here

7free pages

8concepts

15-20%of the exam

Questions 1–5

1application · medium
A company is building a mobile application that needs to authenticate users with Microsoft Entra ID. The application needs to call a custom web API on behalf of the user. The application will be used by employees of the company only. Which authentication flow should the developer implement?
Select an answer first
2foundation · easy
Which claim in an access token is commonly used to determine whether a user belongs to a specific role for authorization decisions?
Select an answer first
3expert · hard
A company wants to build a custom app that reads and writes calendar events for all users in the organization. The app will run as a background service. The company wants to minimize the permissions granted to the app. Which Microsoft Graph permission should the app request?
Select an answer first
4expert · hard
A company has a web app that signs in users with Microsoft Entra ID. The app calls a downstream API. The API is protected by a Conditional Access policy that requires multi-factor authentication (MFA). The web app uses the on-behalf-of flow to get a token for the API. The user has already completed MFA during sign-in. Why might the API call fail?
Select an answer first
5foundation · easy
Which protocol is the primary OAuth 2.0-based protocol used by the Microsoft Identity platform for authentication and authorization?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to AZ-204

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “AZ-204” is a trademark of its owner, used for identification only.

Implement User Authentication and Authorization AZ-204 Practice Questions (Page 1)

Questions 1–5

A company is building a mobile application that needs to authenticate users with Microsoft Entra ID. The application needs to call a custom web API on behalf of the user. The application will be used by employees of the company only. Which authentication flow should the developer implement?

Which claim in an access token is commonly used to determine whether a user belongs to a specific role for authorization decisions?

A company wants to build a custom app that reads and writes calendar events for all users in the organization. The app will run as a background service. The company wants to minimize the permissions granted to the app. Which Microsoft Graph permission should the app request?

Which protocol is the primary OAuth 2.0-based protocol used by the Microsoft Identity platform for authentication and authorization?

Keep studying — Implement Azure security