A company's web API is registered in Microsoft Entra ID. The API exposes a custom scope named 'Reports.Read'. A client app needs to call this API on behalf of a signed-in user. What must be configured in the client app registration?

Expose the 'Reports.Read' scope in the client app registration.

Add a client secret and use the client credentials flow.

Add the 'Reports.Read' scope as an API permission for the web API.

Set the 'knownClientApplications' property to include the web API.

A company has a multi-tenant web app that signs in users from any Microsoft Entra ID tenant. The app needs to access the signed-in user's profile from Microsoft Graph. The app has been granted the User.Read delegated permission. What must the app do to ensure it can read profiles for users from other tenants?

Use the implicit flow with the User.Read permission.

Use the client credentials flow with the User.Read.All application permission.

Use the authorization code flow and request a token for the Microsoft Graph resource with the User.Read permission.

Use the on-behalf-of flow to exchange the ID token for a Graph token.

Azure Developer Associate

Domain 3Objective 1

Implement User Authentication and Authorization AZ-204 Practice Questions (Page 4)

Part of the Implement Azure security domain, which accounts for 15-20% of the AZ-204 exam. Microsoft does not publish an official question count, but from its 100-minute exam (~40–65 total, ~6–13 in this domain), expect 3–7 from this objective — we provide 35 practice questions to prepare you well beyond it. (estimate)

35questions here

7free pages

8concepts

15-20%of the exam

Questions 16–20

16application · medium
A company's web API is registered in Microsoft Entra ID. The API exposes a custom scope named 'Reports.Read'. A client app needs to call this API on behalf of a signed-in user. What must be configured in the client app registration?
Select an answer first
17foundation · easy
In ASP.NET Core, which attribute is used to restrict an action or controller to authenticated users?
Select an answer first
18foundation · easy
Which HTTP method is used in Microsoft Graph to retrieve a user's profile information?
Select an answer first
19foundation · easy
Which component of a shared access signature (SAS) token is used to specify the permissions granted, such as read or write?
Select an answer first
20expert · hard
A company has a multi-tenant web app that signs in users from any Microsoft Entra ID tenant. The app needs to access the signed-in user's profile from Microsoft Graph. The app has been granted the User.Read delegated permission. What must the app do to ensure it can read profiles for users from other tenants?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to AZ-204

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “AZ-204” is a trademark of its owner, used for identification only.

Implement User Authentication and Authorization AZ-204 Practice Questions (Page 4)

Questions 16–20

A company's web API is registered in Microsoft Entra ID. The API exposes a custom scope named 'Reports.Read'. A client app needs to call this API on behalf of a signed-in user. What must be configured in the client app registration?

In ASP.NET Core, which attribute is used to restrict an action or controller to authenticated users?

Which HTTP method is used in Microsoft Graph to retrieve a user's profile information?

Which component of a shared access signature (SAS) token is used to specify the permissions granted, such as read or write?

Keep studying — Implement Azure security