QUESTION: 51 Exam Topic: Implement Azure security questions

HOTSPOT (Drag & Drop is not supported)
You are a developer building a web site using a web app. The web site stores configuration data in Azure App Configuration.

Access to Azure App Configuration has been configured to use the identity of the web app for authentication. Security requirements specify that no other authentication systems must be used.

You need to load configuration data from Azure App Configuration.
How should you complete the code? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.

See Explanation section for answer.

Answer(s): A

Explanation:

Box 1: AddAzureAppConfiguration
Load data from App Configuration, code example:

public static IHostBuilder CreateHostBuilder(string[] args) =>
Host.CreateDefaultBuilder(args)
.ConfigureWebHostDefaults(webBuilder =>
webBuilder.ConfigureAppConfiguration((hostingContext, config) =>
{
var settings = config.Build();
config.AddAzureAppConfiguration(options =>
{
Etc.

Box 2: ManagedIdentityCredential
Use managed identities to access App Configuration
If you want to use a user-assigned managed identity, be sure to specify the clientId when creating the ManagedIdentityCredential.

config.AddAzureAppConfiguration(options =>
{
options.Connect(new Uri(settings["AppConfig:Endpoint"]), new ManagedIdentityCredential("<your_clientId>"))
});

Full code sample:
public static IHostBuilder CreateHostBuilder(string[] args) =>
Host.CreateDefaultBuilder(args)
.ConfigureWebHostDefaults(webBuilder =>
webBuilder.ConfigureAppConfiguration((hostingContext, config) =>
{
var settings = config.Build();
config.AddAzureAppConfiguration(options =>
options.Connect(new Uri(settings["AppConfig:Endpoint"]), new ManagedIdentityCredential()));
})
.UseStartup<Startup>());

Reference:

https://docs.microsoft.com/en-us/azure/azure-app-configuration/howto-integrate-azure-managed-service-identity?tabs=core5x&pivots=framework-dotnet

Reveal Solution Next Question

QUESTION: 52 Exam Topic: Implement Azure security questions

HOTSPOT (Drag & Drop is not supported)
You are building an application that stores sensitive customer data in Azure Blob storage. The data must be encrypted with a key that is unique for each customer.

If the encryption key has been corrupted it must not be used for encryption.
You need to ensure that the blob is encrypted.

How should you complete the code segment? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

See Explanation section for answer.

Answer(s): A

Explanation:

Box 1: CustomerProvidedKey(key)
The data must be encrypted with a key that is unique for each customer.

Sample code:
async static Task UploadBlobWithClientKey(Uri blobUri,
Stream data,
byte[] key,
string keySha256)
{
// Create a new customer-provided key.
// Key must be AES-256.
var cpk = new CustomerProvidedKey(key);

Box 2: Encryption
CustomerProvidedKey.EncryptionKey Property

Sample code continued:
// Check the key's encryption hash.
if (cpk.EncryptionKeyHash != keySha256)
{
throw new InvalidOperationException("The encryption key is corrupted.");
}

Box 3: CustomerProvidedKey
Sample code continued;
// Specify the customer-provided key on the options for the client.
BlobClientOptions options = new BlobClientOptions()
{
CustomerProvidedKey = cpk
};

// Create the client object with options specified.
BlobClient blobClient = new BlobClient(
blobUri,
new DefaultAzureCredential(),
options);

Incorrect:
* Version - Gets the BlobClientOptions.ServiceVersion of the service API used when making requests.
Transport - The HttpPipelineTransport to be used for this client.

Reference:

https://docs.microsoft.com/en-us/azure/storage/blobs/storage-blob-customer-provided-key

Reveal Solution Next Question

QUESTION: 53 Exam Topic: Implement Azure security questions

HOTSPOT (Drag & Drop is not supported)
You are developing a web application that uses the Microsoft Identity platform for user and resource authentication. The web application called several REST APIs.

You are implementing various authentication and authorization flows for the web application.
You need to validate the claims in the authentication token.

Which token type should you use? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.

See Explanation section for answer.

Answer(s): A

Explanation:

Box 1: ID
The ID token is the core extension that OpenID Connect makes to OAuth 2.0. ID tokens are issued by the authorization server and contain claims that carry information about the user. They can be sent alongside or instead of an access token. Information in ID Tokens allows the client to verify that a user is who they claim to be. ID tokens are intended to be understood by third-party applications. ID tokens should not be used for authorization purposes.

Box 2: Access
An access token contains claims that you can use in Azure Active Directory B2C (Azure AD B2C) to identify the granted permissions to your APIs. When calling a resource server, an access token must be present in the HTTP request. An access token is denoted as access_token in the responses from Azure AD B2C.

Box 3: Refresh
Refresh token - Refresh tokens are used to acquire new ID tokens and access tokens in an OAuth 2.0 flow. They provide your application with long-term access to resources on behalf of users without requiring interaction with those users.

Box 4: SAML

Reference:

https://learn.microsoft.com/en-us/azure/active-directory-b2c/tokens-overview
https://learn.microsoft.com/en-us/samples/azure-samples/active-directory-dotnet-webapp-wsfederation/active-directory-dotnet-webapp-wsfederation/

Reveal Solution Next Question

QUESTION: 54 Exam Topic: Implement Azure security questions

HOTSPOT (Drag & Drop is not supported)
You are developing a content management application for technical manuals. The application is deployed as an Azure Static Web app.

Authenticated users can view pages under/manuals but only contributors can access the page /manuals/new.html.

You need to configure the routing for the web app.
How should you complete the configuration? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

See Explanation section for answer.

Answer(s): A

Explanation:

Box 1: /manuals/new.html

Note:
Rules are evaluated in the order as they appear in the routes array.
Rule evaluation stops at the first match. A match occurs when the route property and a value in the methods array (if specified) match the request. Each request can match at most one rule.

Box 2: contributors
Only contributors have access to /manuals/new.html

Box 3: /manuals*
Box 4: authenticated
All authenticated users have access to the manuals.

Reference:

https://learn.microsoft.com/en-us/azure/static-web-apps/configuration

Reveal Solution Next Question

Free AZ-204 Exam Braindumps (page: 35)

QUESTION: 51 Exam Topic: Implement Azure security questions

Explanation:

Reference:

QUESTION: 52 Exam Topic: Implement Azure security questions

Explanation:

Reference:

QUESTION: 53 Exam Topic: Implement Azure security questions

Explanation:

Reference:

QUESTION: 54 Exam Topic: Implement Azure security questions

Explanation:

Reference: