A company has a web API that uses Microsoft Entra ID. The API needs to authorize users based on their department. The department is stored in the user's profile in Microsoft Entra ID. The API should not have to call Microsoft Graph for every request. What should the company do?

Include the department as a claim in the token by using a custom claims policy.

Use the 'roles' claim to encode the department.

Use the 'scp' claim to encode the department.

Have the API call Microsoft Graph to get the user's department on every request.

A company uses Microsoft Entra ID for internal users. They want to allow external partners to sign in to their partner portal using the partners' own Microsoft Entra ID or Microsoft accounts. Which Entra ID feature should they configure?

External Identities with B2B collaboration.

Hybrid identity with federation.

Conditional Access with guest access policies.

A company stores monthly reports in an Azure Blob Storage container. External auditors need read-only access to a specific blob for 30 days. The auditors do not have Microsoft Entra ID accounts. What is the most secure way to grant access?

Generate an account SAS URI with read permission and an expiry of 30 days, and share it with the auditors.

Generate a service SAS URI with read permission and an expiry of 30 days, and share it with the auditors.

Create a shared access policy on the container and set the blob's ACL to allow the auditors.

Make the blob public and share the blob URL.

A company has a web API that uses Microsoft Entra ID. The API must allow only users from a specific partner tenant to access it. The API is registered in the company's tenant. What should the company configure to restrict access to the partner tenant?

Use the 'signInAudience' setting to limit the API to a single tenant.

Set the API's 'User assignment required' to 'Yes' and assign the partner tenant's users as users.

Configure the API to validate the 'tid' claim and allow only the partner tenant's tenant ID.

Add a Conditional Access policy that requires the 'Partner tenant' as a condition and assign it to the API's enterprise application.

A company has a web API that uses Microsoft Entra ID. The API is called by a client app that uses the authorization code flow. The API needs to know which permissions the user has consented to. What should the API check in the access token?

The 'aud' claim, which contains the API's app ID.

The 'iss' claim, which contains the token issuer.

The 'scp' claim, which contains the delegated permissions.

The 'roles' claim, which contains the application permissions.

Azure Developer Associate

Domain 3Objective 1

Implement User Authentication and Authorization AZ-204 Practice Questions (Page 5)

Part of the Implement Azure security domain, which accounts for 15-20% of the AZ-204 exam. Microsoft does not publish an official question count, but from its 100-minute exam (~40–65 total, ~6–13 in this domain), expect 3–7 from this objective — we provide 35 practice questions to prepare you well beyond it. (estimate)

35questions here

7free pages

8concepts

15-20%of the exam

Questions 21–25

21expert · hard
A company has a web API that uses Microsoft Entra ID. The API needs to authorize users based on their department. The department is stored in the user's profile in Microsoft Entra ID. The API should not have to call Microsoft Graph for every request. What should the company do?
Select an answer first
22application · medium
A company uses Microsoft Entra ID for internal users. They want to allow external partners to sign in to their partner portal using the partners' own Microsoft Entra ID or Microsoft accounts. Which Entra ID feature should they configure?
Select an answer first
23application · medium
A company stores monthly reports in an Azure Blob Storage container. External auditors need read-only access to a specific blob for 30 days. The auditors do not have Microsoft Entra ID accounts. What is the most secure way to grant access?
Select an answer first
24expert · hard
A company has a web API that uses Microsoft Entra ID. The API must allow only users from a specific partner tenant to access it. The API is registered in the company's tenant. What should the company configure to restrict access to the partner tenant?
Select an answer first
25expert · hard
A company has a web API that uses Microsoft Entra ID. The API is called by a client app that uses the authorization code flow. The API needs to know which permissions the user has consented to. What should the API check in the access token?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to AZ-204

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “AZ-204” is a trademark of its owner, used for identification only.