Implement Azure security
Free Microsoft Certified: Azure Developer Associate practice — 6 questions on Implement Azure security, with explanations. No sign-up. Full 12-question mixed test →
A web API validates an incoming JWT bearer token from a signed-in user, then needs to call Microsoft Graph as that same user to read their calendar. Which OAuth 2.0 flow should the web API use to obtain a token for Microsoft Graph?
OBO flow lets the web API exchange the incoming user's access token for a new token to call a downstream API (Microsoft Graph) while preserving the user's identity and delegated permissions.
A background daemon application running on an on-premises Linux server (not hosted in Azure) needs to call Microsoft Graph with application permissions, without any user sign-in. Company policy prohibits storing client secrets in configuration. Which authentication approach should you implement using MSAL?
Certificate-based authentication with ConfidentialClientApplicationBuilder satisfies the app-only (client credentials) flow requirement while avoiding storage of a plaintext client secret, since the certificate is protected in the local certificate store.
You enable a system-assigned managed identity on an Azure App Service and use DefaultAzureCredential in the app code to access Azure Key Vault. After deployment, calls to Key Vault fail with a 403 Forbidden error. What should you do to resolve this?
A 403 Forbidden from Key Vault when using a managed identity means authentication succeeded but authorization failed — the identity has no RBAC role assignment granting data-plane access; assigning a role like Key Vault Secrets User resolves it.
An application generates ad hoc SAS tokens for a blob container that grant read access to external partners, with expiration set 30 days in the future. Security review requires the ability to revoke all previously issued SAS tokens immediately if a partner's system is compromised, without waiting for expiration. What should you implement?
A stored access policy defines SAS permissions/expiry server-side and associates multiple SAS tokens with it; revoking access for all tokens tied to that policy is done instantly by deleting or modifying the policy, without affecting unrelated SAS tokens.
A development team needs to grant an Azure Function app permission to read secrets from Key Vault, following the principle of least privilege, using the Azure RBAC permission model (not vault access policies). Which built-in role should be assigned to the function's managed identity?
Key Vault Secrets User is a built-in RBAC role that grants data-plane permission to read secret contents (get/list) — the minimum privilege needed to read secrets.
A company runs an application on an Azure Virtual Machine Scale Set with dynamically scaling instance count. All instances must authenticate to Azure SQL Database using the same identity so that the database's Microsoft Entra login and firewall configuration doesn't need to change as instances scale in or out, and the identity's lifecycle must be independent of any single VM instance. Which authentication approach should you implement?
A user-assigned managed identity is a standalone Azure resource with its own lifecycle, independent of any VM. It can be assigned to all instances in a scale set, including new instances created during scale-out, so the SQL Database Microsoft Entra login is configured once and remains valid as instances scale in and out.
Ready for the real thing?
The full course has two full-length practice tests, video lessons for every exam domain, hands-on labs and detailed answer explanations.
Start my full course on Udemy →