Implement User Authentication and Authorization AZ-204 Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A web app signs in users with Microsoft Entra ID. After sign-in, the app needs to retrieve the user's job title from Microsoft Graph. The app has been granted the User.Read delegated permission. What should the app do to get the job title?

   • AExchange the ID token for a Graph access token using the on-behalf-of flow.
   • BUse the ID token to call GET /users/{id}?$select=jobTitle.
   • CUse the access token received during sign-in to call GET /me?$select=jobTitle.
   • DCall GET /users/{id}?$select=jobTitle using the client credentials flow.
   Reveal Solution Discussion Select an answer first
2. 32expert · hard

   A company has a background service that uses Microsoft Graph to read all users' profiles. The service uses the client credentials flow with the User.Read.All application permission. The service is failing with a 403 Forbidden error. What is the most likely cause?

   • AThe service's client secret has expired.
   • BThe application permission has not been granted admin consent in the tenant.
   • CThe service is using the wrong tenant ID.
   • DThe service is using the /me endpoint.
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A company has a daemon application that runs as a background service. The daemon needs to call Microsoft Graph to read all users in the organization. The daemon does not have a user context. Which authentication flow should the developer implement?

   • AAuthorization code flow with a client secret and a redirect URI.
   • BDevice code flow with a client secret.
   • COn-behalf-of flow with a client secret.
   • DClient credentials flow with a client secret.
   Reveal Solution Discussion Select an answer first
5. 34expert · hard

   A company stores files in Azure Blob Storage. They need to allow a partner application to upload files to a specific container for 7 days. The partner app does not support Microsoft Entra ID. The company wants to be able to revoke access immediately if needed. What should they do?

   • AGenerate a service SAS with an expiry of 7 days and no stored access policy.
   • BCreate a stored access policy on the container and generate a service SAS that references the policy, with an expiry of 7 days.
   • CUse a user delegation SAS with an expiry of 7 days.
   • DGenerate an account SAS with write permission for the entire storage account.
   Reveal Solution Discussion Select an answer first
6. 35foundation · easy

   What is the primary purpose of Microsoft Graph?

   • ATo provide a unified API endpoint for accessing Microsoft 365, Entra ID, and other Microsoft cloud services data
   • BTo provide a data visualization tool for Power BI
   • CTo provide a machine learning service for natural language processing
   • DTo provide a graphical interface for managing Azure resources
   Reveal Solution Discussion Select an answer first