A company stores files in Azure Blob Storage. A web application allows users to upload and download their own files. The application uses Microsoft Entra ID for authentication. The application needs to generate a URL that allows a user to download a specific file for the next 15 minutes without requiring the user to authenticate again. The solution must not expose the storage account key. What should the developer do?

Generate an account-level SAS with read permission and set the expiry to 15 minutes.

Use the storage account key to generate a SAS for the specific blob with read permission and set the expiry to 15 minutes.

Generate a user delegation SAS for the specific blob with read permission and set the expiry to 15 minutes.

Generate a service-level SAS with read permission and set the expiry to 15 minutes.

A healthcare app uses Microsoft Entra ID for sign-in. The app must show a 'Patient Records' tab only to users who belong to the 'Physicians' group. The development team wants to avoid writing custom role-checking code. What should they configure in the app registration?

Enable the 'groupMembershipClaims' option to emit the group's object ID in the token, then check the claim in code.

Add an app role named 'Physicians' and assign the group to that role in the enterprise application.

Set the app's 'User assignment required' to 'No' so all signed-in users see the tab.

Use the 'pre-authorized applications' setting to grant the group access to the app.

A company is building a web app that lets employees sign in with their corporate Microsoft Entra ID accounts. The app also needs to call Microsoft Graph to read the signed-in user's profile photo. Which authentication flow should the app use?

Implicit flow with the User.Read delegated permission.

Device code flow with the User.Read delegated permission.

Authorization code flow with PKCE, requesting the User.Read delegated permission.

Client credentials flow with the User.Read application permission.

Azure Developer Associate

Domain 3Objective 1

Implement User Authentication and Authorization AZ-204 Practice Questions (Page 3)

Part of the Implement Azure security domain, which accounts for 15-20% of the AZ-204 exam. Microsoft does not publish an official question count, but from its 100-minute exam (~40–65 total, ~6–13 in this domain), expect 3–7 from this objective — we provide 35 practice questions to prepare you well beyond it. (estimate)

35questions here

7free pages

8concepts

15-20%of the exam

Questions 11–15

11application · medium
A company stores files in Azure Blob Storage. A web application allows users to upload and download their own files. The application uses Microsoft Entra ID for authentication. The application needs to generate a URL that allows a user to download a specific file for the next 15 minutes without requiring the user to authenticate again. The solution must not expose the storage account key. What should the developer do?
Select an answer first
12application · medium
A healthcare app uses Microsoft Entra ID for sign-in. The app must show a 'Patient Records' tab only to users who belong to the 'Physicians' group. The development team wants to avoid writing custom role-checking code. What should they configure in the app registration?
Select an answer first
13foundation · easy
Which permission scope is required to read a user's profile via Microsoft Graph?
Select an answer first
14application · medium
A company is building a web app that lets employees sign in with their corporate Microsoft Entra ID accounts. The app also needs to call Microsoft Graph to read the signed-in user's profile photo. Which authentication flow should the app use?
Select an answer first
15foundation · easy
Which type of token is included in the OpenID Connect authentication response and contains claims about the authenticated user?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to AZ-204

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “AZ-204” is a trademark of its owner, used for identification only.

Implement User Authentication and Authorization AZ-204 Practice Questions (Page 3)

Questions 11–15

A healthcare app uses Microsoft Entra ID for sign-in. The app must show a 'Patient Records' tab only to users who belong to the 'Physicians' group. The development team wants to avoid writing custom role-checking code. What should they configure in the app registration?

Which permission scope is required to read a user's profile via Microsoft Graph?

A company is building a web app that lets employees sign in with their corporate Microsoft Entra ID accounts. The app also needs to call Microsoft Graph to read the signed-in user's profile photo. Which authentication flow should the app use?

Which type of token is included in the OpenID Connect authentication response and contains claims about the authenticated user?

Keep studying — Implement Azure security