QUESTION: 55 Exam Topic: Implement Azure security questions

You are developing a web application that uses the Microsoft identity platform for user and resource authentication. The web application calls several REST APIs.

A REST API call must read the user’s calendar. The web application requires permission to send an email as the user.

You need to authorize the web application and the API.
Which parameter should you use?

tenant
code_challenge
state
client_id
scope

Answer(s): E

Explanation:

Microsoft identity platform and OAuth 2.0 authorization code flow, Request an authorization code
https://login.microsoftonline.com/{tenant}/oauth2/v2.0/authorize?

The authorization code flow begins with the client directing the user to the /authorize endpoint. In this request, the client requests the openid, offline_access, and https://graph.microsoft.com/mail.read permissions from the user.

Parameters include:
* scope required
A space-separated list of scopes that you want the user to consent to. For the /authorize leg of the request, this parameter can cover multiple resources. This value allows your app to get consent for multiple web APIs you want to call.

Incorrect:
* tenant required
The {tenant} value in the path of the request can be used to control who can sign into the application. Valid values are common, organizations, consumers, and tenant identifiers. For guest scenarios where you sign a user from one tenant into another tenant, you must provide the tenant identifier to sign them into the resource tenant.

* code_challenge recommended / required
Used to secure authorization code grants by using Proof Key for Code Exchange (PKCE). Required if code_challenge_method is included. This parameter is now recommended for all application types, both public and confidential clients, and required by the Microsoft identity platform for single page apps using the authorization code flow.

* client_id
The Application (client) ID that the Azure portal – App registrations experience assigned to your app.

Reference:

https://learn.microsoft.com/en-us/azure/active-directory/develop/v2-oauth2-auth-code-flow

Reveal Solution Next Question

QUESTION: 56 Exam Topic: Implement Azure security questions

HOTSPOT (Drag & Drop is not supported)
You develop and deploy a web app to Azure App service. The web app allows users to authenticate by using social identity providers through the Azure B2C service. All user profile information is stored in Azure B2C.

You must update the web app to display common user properties from Azure B2C to include the following information:

-Email address
-Job title
-First name
-Last name
-Office location

You need to implement the user properties in the web app.
Which code library and API should you use? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

See Explanation section for answer.

Answer(s): A

Explanation:

Box 1: Microsoft Graph
Microsoft Graph allows you to manage resources in your Azure AD B2C directory. Microsoft Graph API operations are supported for the management of Azure AD B2C resources, including users, identity providers, user flows, custom policies, and policy keys

Box 2: Microsoft Authentication Library (MSAL)
MSAL.js supports authentication with social (Microsoft, Google, Facebook etc.), enterprise (ADFS, Salesforce etc.) and local (stored in the Azure AD B2C directory) identities using Azure AD B2C (B2C for short).

Reference:

https://learn.microsoft.com/en-us/azure/active-directory-b2c/microsoft-graph-operations
https://github.com/AzureAD/microsoft-authentication-library-for-js/blob/dev/lib/msal-browser/docs/working-with-b2c.md

Reveal Solution Next Question

QUESTION: 57 Exam Topic: Implement Azure security questions

HOTSPOT (Drag & Drop is not supported)
You develop and deploy the following staticwebapp.config.json file to the app_location value specified in the workflow file of an Azure Static Web app:

For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.

See Explanation section for answer.

Answer(s): A

Explanation:

Box 1: No
Unauthenticated users are challenged to authenticate with Azure Active Directory.

Note:
401
Unauthorized
Request to restricted pages while unauthenticated.

Note: Restricting access to entire application
It's common to require authentication for every route in an application. To enable this, add a rule that matches all routes and include the built-in authenticated role in the allowedRoles array.

The following example configuration blocks anonymous access and redirects all unauthenticated users to the Azure Active Directory login page.

{
"routes": [
{
"route": "/*",
"allowedRoles": ["authenticated"]
}
],
"responseOverrides": {
"401": {
"statusCode": 302,
"redirect": "/.auth/login/aad"
}
}
}

Box 2: No
It depends on the file extension of the file. 404 response codes is only generated for png, jpg and gif files.

Note: Fallback routes
Single Page Applications often rely on client-side routing. These client-side routing rules update the browser's window location without making requests back to the server. If you refresh the page, or navigate directly to URLs generated by client-side routing rules, a server-side fallback route is required to serve the appropriate HTML page (which is generally the index.html for your client-side app).

You can define a fallback rule by adding a navigationFallback section. The following example returns /index.html for all static file requests that do not match a deployed file.

{
"navigationFallback": {
"rewrite": "/index.html"
}
}
You can control which requests return the fallback file by defining a filter. In the following example, requests for certain routes in the /images folder and all files in the /css folder are excluded from returning the fallback file.

{
"navigationFallback": {
"rewrite": "/index.html",
"exclude": ["/images/*.{png,jpg,gif}", "/css/*"]
}
}
The example file structure below, the following outcomes are possible with this rule.

Requests to...
/images/unknown.png
Return File not found error
With status: 404

/images/icon.svg
Returns the /index.html file - since the svg file extension is not listed in the /images/*.{png,jpg,gif} filter
With status: 200

Box 3: Yes
Only the route and methods (if specified) properties are used to determine whether a rule matches a request.

Routes are secured by adding one or more role names into a rule's allowedRoles array.
For instance, to restrict a route to only authenticated users, add the built-in authenticated role to the allowedRoles array.

{
"route": "/profile*",
"allowedRoles": ["authenticated"]
}

Box 4: No
Unauthenticated users are challanged to authenticate with Azure Active Directory.
See box 1 above.

Reference:

https://learn.microsoft.com/en-us/azure/static-web-apps/configuration

Reveal Solution Next Question

QUESTION: 58 Exam Topic: Implement Azure security questions

You develop and deploy an Azure App Service web app named App1. You create a new Azure Key Vault named Vault1. You import several API keys, passwords, certificates, and cryptographic keys into Vault1.

You need to grant App1 access to Vault1 and automatically rotate credentials. Credentials must not be stored in code.

What should you do?

Enable App Service authentication for Appl. Assign a custom RBAC role to Vault1.
Add a TLS/SSL binding to App1.
Upload a self-signed client certificate to Vault1. Update App1 to use the client certificate.
Assign a managed identity to App1.

Answer(s): D

Explanation:

An Azure Function can be used with managed identity to rotate service principal keys. Then an app can use service principal keys to authenticate to Key Vault to check for new versions of the app secret. As long as it does so before the old secret expires it can successfully update its cache with the new secret allowing a smooth transition to the new version.

Reference:

https://abschmidt.medium.com/rotating-service-principal-secrets-automatically-in-azure-key-vault-c4f04a84c9af

Reveal Solution Next Question

Free AZ-204 Exam Braindumps (page: 36)

QUESTION: 55 Exam Topic: Implement Azure security questions

Explanation:

Reference:

QUESTION: 56 Exam Topic: Implement Azure security questions

Explanation:

Reference:

QUESTION: 57 Exam Topic: Implement Azure security questions

Explanation:

Reference:

QUESTION: 58 Exam Topic: Implement Azure security questions

Explanation:

Reference: