QUESTION: 15 Exam Topic: Implement Azure security questions

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

You are developing a website that will run as an Azure Web App. Users will authenticate by using their Azure Active Directory (Azure AD) credentials.

You plan to assign users one of the following permission levels for the website: admin, normal, and reader. A user’s Azure AD group membership must be used to determine the permission level.
You need to configure authorization.

Solution:
-Create a new Azure AD application. In the application’s manifest, set value of the groupMembershipClaims option to All.
-In the website, use the value of the groups claim from the JWT for the user to determine permissions.

Does the solution meet the goal?

Answer(s): A

Explanation:

To configure Manifest to include Group Claims in Auth Token
1. Go to Azure Active Directory to configure the Manifest. Click on Azure Active Directory, and go to App registrations to find your application:
2. Click on your application (or search for it if you have a lot of apps) and edit the Manifest by clicking on it.
3. Locate the “groupMembershipClaims” setting. Set its value to either “SecurityGroup” or “All”. To help you decide which:
-“SecurityGroup” - groups claim will contain the identifiers of all security groups of which the user is a member.
-“All” - groups claim will contain the identifiers of all security groups and all distribution lists of which the user is a member
Now your application will include group claims in your manifest and you can use this fact in your code.

Reference:

https://blogs.msdn.microsoft.com/waws/2017/03/13/azure-app-service-authentication-aad-groups/

Reveal Solution Next Question

QUESTION: 16 Exam Topic: Implement Azure security questions

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

You are developing a website that will run as an Azure Web App. Users will authenticate by using their Azure Active Directory (Azure AD) credentials.

You plan to assign users one of the following permission levels for the website: admin, normal, and reader. A user’s Azure AD group membership must be used to determine the permission level.
You need to configure authorization.

Solution:
-Create a new Azure AD application. In the application’s manifest, define application roles that match the required permission levels for the application.
-Assign the appropriate Azure AD group to each role. In the website, use the value of the roles claim from the JWT for the user to determine permissions.

Does the solution meet the goal?

Answer(s): B

Explanation:

Reference:

https://blogs.msdn.microsoft.com/waws/2017/03/13/azure-app-service-authentication-aad-groups/

Reveal Solution Next Question

QUESTION: 17 Exam Topic: Implement Azure security questions

DRAG DROP (Drag & Drop is not supported)
You are developing an application to securely transfer data between on-premises file systems and Azure Blob storage. The application stores keys, secrets, and certificates in Azure Key Vault. The application uses the Azure Key Vault APIs.

The application must allow recovery of an accidental deletion of the key vault or key vault objects. Key vault objects must be retained for 90 days after deletion.

You need to protect the key vault and key vault objects.

Which Azure Key Vault feature should you use? To answer, drag the appropriate features to the correct actions. Each feature may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.

NOTE: Each correct selection is worth one point.
Select and Place:

See Explanation section for answer.

Answer(s): A

Explanation:

Box 1: Soft delete
When soft-delete is enabled, resources marked as deleted resources are retained for a specified period (90 days by default). The service further provides a mechanism for recovering the deleted object, essentially undoing the deletion.

Box 2: Purge protection
Purge protection is an optional Key Vault behavior and is not enabled by default. Purge protection can only be enabled once soft-delete is enabled.

When purge protection is on, a vault or an object in the deleted state cannot be purged until the retention period has passed. Soft-deleted vaults and objects can still be recovered, ensuring that the retention policy will be followed.

Reference:

https://docs.microsoft.com/en-us/azure/key-vault/general/soft-delete-overview

Reveal Solution Next Question

QUESTION: 18 Exam Topic: Implement Azure security questions

You provide an Azure API Management managed web service to clients. The back-end web service implements HTTP Strict Transport Security (HSTS).

Every request to the backend service must include a valid HTTP authorization header. You need to configure the Azure API Management instance with an authentication policy. Which two policies can you use? Each correct answer presents a complete solution.
NOTE: Each correct selection is worth one point.

Basic Authentication
Digest Authentication
Certificate Authentication
OAuth Client Credential Grant

Answer(s): C,D

Reveal Solution Next Question

Free AZ-204 Exam Braindumps (page: 26)

QUESTION: 15 Exam Topic: Implement Azure security questions

Explanation:

Reference:

QUESTION: 16 Exam Topic: Implement Azure security questions

Explanation:

Reference:

QUESTION: 17 Exam Topic: Implement Azure security questions

Explanation:

Reference:

QUESTION: 18 Exam Topic: Implement Azure security questions