Implement Azure security

AZ-204 · 57 questions

• A gannet-cliff camera site has sign-in code ready but no directory application object yet. What Microsoft identity platform step must the developer complete before MSAL can sign users in?
• A peat-smoke kiln API works in the home tenant after app registration, then fails in a customer tenant that has no enterprise application for that API. Which identity distinction should the developer apply?
• An alder-charcoal shop begins hand-building OAuth authorize URLs inside a web controller for interactive sign-in. Which approach should the developer take instead on the Microsoft identity platform?
• A samphire-harvest SPA and a confidential server web app both need interactive user sign-in to Microsoft Entra ID. Which OAuth flow should the developer select for modern interactive users?
• A municipal mackerel-auction night worker runs with no signed-in user and must call a protected city API. Which OAuth 2.0 flow should the developer use?
• A county fir-cone catalog web app puts an ID token in the Authorization header when calling a downstream inventory API and receives HTTP 401. What should the developer send to the API?
• A dune-grass nursery portal reads the signed-in grower’s profile with User.Read, while a nightly job must read every grower as the app itself with User.Read.All. How should the developer map those permission types on the identity platform?
• An icehouse inventory app requests a high-privilege Microsoft Graph permission, and ordinary growers cannot complete consent. What should the developer arrange?
• A kelp-ash glaze studio’s sign-in fails with a redirect URI mismatch after a teammate changed the web app’s public URL. What should the developer update?
• A puffin-burrow census site still hashes passwords in Cosmos DB for municipal staff sign-in. What should the developer do instead for user authentication?
• A slate-roof guild API is reachable with no Authorization header. What should the developer implement so unauthenticated calls fail?
• A bog-cotton weaver API must allow Dispatcher apps to POST jobs and forbid Viewer apps. How should the developer enforce that authorization?
• A brine-shrimp tank portal must accept only accounts from the hatchery’s Microsoft Entra tenant, not any Entra user on the internet. What should the developer configure?
• A rowan-berry press API currently accepts any well-formed JWT. Which validation must the developer require for Microsoft Entra access tokens?
• A cormorant-roost daemon still ships a client secret in source control to authenticate to Microsoft Entra ID. What credential approach should the developer prefer?
• A drift-ice buoy dashboard API must call a second protected API while preserving the signed-in ranger’s identity. Which flow should the middle-tier API use?
• A fennel-seed mill user’s sign-in to a municipal app succeeds at Entra but access is still blocked by a Conditional Access grant. How should the developer interpret this?
• A grouse-moor booking tool needs time-boxed browser access to a blob. Which set names the official Azure Storage shared access signature types the developer should choose among?
• A hail-net vineyard web app must mint a SAS for browser uploads without placing the storage account key on the app. What should the developer create?
• An ivy-walled archive function still uses the storage account key and must grant access to one blob container only. Which SAS should the developer mint?
• A juniper-smoke house tool needs blob and queue data-plane operations authorized with a single shared access signature. Which SAS type fits?
• A knapweed survey hands out service SAS URIs whose expiry is baked into each URI, and the team cannot revoke one class of tokens without chasing every link. What should the developer do?
• A loch-side hostel QR code only needs to display one photo for fifteen minutes. How should the developer configure the SAS?
• A mulch-yard kiosk pastes a SAS into an http:// link on a chalkboard web page. What distribution practice must the developer follow?
• A nimbus-radar hut leaks a service SAS that referenced stored access policy field. How should the developer revoke access without breaking every other client?
• An ochre-pit sample app needs the signed-in geologist’s Microsoft 365 profile and photo. Which API should the developer call?
• A perch-pond hatchery page completes MSAL sign-in but still receives HTTP 401 from Microsoft Graph. What step is missing?
• A quahog-lease daemon uses client credentials and calls Microsoft Graph /me, which fails. What should the developer do?
• A rill-garden sensor portal only displays the signed-in ranger’s own profile, but a teammate requested User.Read.All. Which Graph permission should the developer keep?
• A siskin-feed station web app can call Microsoft Graph with the Graph SDK client or with an HTTP GET to https://graph.microsoft.com/v1.0/.... Which statement is accurate for the developer?
• A tarn-depth logger already obtained user consent for User.Read. A new OneDrive export feature needs Files.Read. How should the app obtain the additional Graph permission?
• An umber-dye vat overnight worker lists every shop user at 02:00 with no human signed in. Which Microsoft Graph approach fits?
• A vetch-seed bank teammate files Microsoft Graph under “third-party services” next to Service Bus and Event Grid. Where does Graph belong on the January 14, 2026 AZ-204 outline?
• A wrack-line cleanup API stuffed connection strings, feature flags, and the storage account key into one checked-in JSON file. How should the developer split those values?
• A yarrow-field trial must flip the useNewSampler flag without redeploying the App Service. Where should that feature flag live?
• A zinc-roof workshop wants one configuration client in the app, but DbPassword must remain a vault secret. What App Configuration pattern meets that goal?
• An aspen-grove inventory setting changes in Azure App Configuration, but running App Service instances keep the old value until recycle. What should the developer enable?
• A bluff-erosion pin API uses the same App Configuration key ApiUrl for test and production. How should environments stay separated without overwriting each other?
• A clover-honey frame site still pastes the Key Vault secret’s plaintext value into an App Service application setting. What should the developer do instead?
• A dew-pond gauge team proposes Azure Cache for Redis “because we need configuration.” Which service selection matches AZ-204 for app configuration and secrets?
• An elm-bark archive must hold a signing key and a TLS certificate the app loads at runtime. Which store is appropriate?
• A fen-boardwalk ticket API needs StripeLikeKey from Key Vault at startup. Which SDK approach should the developer use?
• A gorse-fire watch must encrypt a payload with a vault-managed key and must never download the raw key material. Which client pattern is correct?
• A hazel-coppice API must load a client certificate each night for a partner call. What should replace a checked-in PFX on disk?
• An inlet-tide gate rotates BusConnection in Key Vault while a still-warming instance may need the previous version. What should the developer understand about secret addressing?
• A jetty-plank inventory app receives https://<vault>.vault.azure.net/ and a managed identity. How should code address Key Vault secrets?
• A kelp-forest diver deletes OldSmtp in Key Vault and can still recover it during the retention window. What developer-facing behavior explains that?
• A larch-resin pot Function has Key Vault references configured but still receives 403 when resolving secrets. What is the likely missing piece?
• A meadowlark-count teammate begins designing private-endpoint hub-and-spoke plus Managed HSM pools for a simple app secret read. What scope matches AZ-204 Domain 3 for Key Vault?
• A nene-goose collar API still copies a client secret into App Service settings to call Key Vault and Blob Storage. Why enable a managed identity instead?
• An oxbow-lake sampler Azure Function should have an identity that appears and disappears with the Function app itself. Which identity type fits?
• A polder-pump log solution has two App Service apps and one ACI group that all need the same Key Vault role. Which managed identity approach fits best?
• A quaking-bog path API uses the Azure SDK on a developer laptop (interactive login) and in Azure (managed identity) without #if AZURE secret forks. Which credential pattern supports that?
• A river-otter holt web app has a managed identity enabled but still cannot list blobs in a container. What else is required?
• A shingle-bank marker runs on App Service, a sibling worker is a Function, and a third host is Container Apps. Where does the developer enable managed identity for those workloads?
• A tamarack inventory daemon on App Service keeps failing when its Entra app-registration client secret expires. How should the developer remove that secret-rotation hop?
• An urchin-barren plot site must let a visitor’s browser upload one photo to Blob Storage. A teammate tries enabling managed identity on the user’s laptop. What is the correct approach?