Your company is developing an Azure API hosted in Azure.You need to implement authentication for the Azure API to access other Azure resources. You have the following requirements:-All API calls must be authenticated.-Callers to the API must not send credentials to the API.Which authentication mechanism should you use?
Answer(s): C
Azure Active Directory Managed Service Identity (MSI) gives your code an automatically managed identity for authenticating to Azure services, so that you can keep credentials out of your code.Note: Use the authentication-managed-identity policy to authenticate with a backend service using the managed identity. This policy essentially uses the managed identity to obtain an access token from Azure Active Directory for accessing the specified resource. After successfully obtaining the token, the policy will set the value of the token in the Authorization header using the Bearer scheme.Incorrect Answers:A: Use the authentication-basic policy to authenticate with a backend service using Basic authentication. This policy effectively sets the HTTP Authorization header to the value corresponding to the credentials provided in the policy.B: Anonymous is no authentication at all.D: Your code needs credentials to authenticate to cloud services, but you want to limit the visibility of those credentials as much as possible. Ideally, they never appear on a developer's workstation or get checked-in to source control. Azure Key Vault can store credentials securely so they aren't in your code, but to retrieve them you need to authenticate to Azure Key Vault. To authenticate to Key Vault, you need a credential! A classic bootstrap problem.
https://azure.microsoft.com/en-us/blog/keep-credentials-out-of-code-introducing-azure-ad-managed-service-identity/ https://docs.microsoft.com/en-us/azure/api-management/api-management-authentication-policies
DRAG DROP (Drag and Drop is not supported) You are developing an application. You have an Azure user account that has access to two subscriptions.You need to retrieve a storage account key secret from Azure Key Vault.In which order should you arrange the PowerShell commands to develop the solution? To answer, move all commands from the list of commands to the answer area and arrange them in the correct order.Select and Place:
Answer(s): A
Step 1: Get-AzSubscription If you have multiple subscriptions, you might have to specify the one that was used to create your key vault. Enter the following to see the subscriptions for your account:Get-AzSubscription Step 2: Set-AzContext -SubscriptionIdTo specify the subscription that's associated with the key vault you'll be logging, enter:Set-AzContext -SubscriptionId <subscriptionID>Step 3: Get-AzStorageAccountKey You must get that storage account key.Step 4: $secretvalue = ConvertTo-SecureString <storageAccountKey> -AsPlainText -ForceSet-AzKeyVaultSecret -VaultName <vaultName> -Name <secretName> -SecretValue $secretvalueAfter retrieving your secret (in this case, your storage account key), you must convert that key to a secure string, and then create a secret with that value in your key vault.Step 5: Get-AzKeyVaultSecret Next, get the URI for the secret you created. You'll need this URI in a later step to call the key vault and retrieve your secret. Run the following PowerShell command and make note of the ID value, which is the secret's URI:Get-AzKeyVaultSecret ג€"VaultName <vaultName>
https://docs.microsoft.com/bs-latn-ba/Azure/key-vault/key-vault-key-rotation-log-monitoring
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.You develop Azure solutions.You must grant a virtual machine (VM) access to specific resource groups in Azure Resource Manager.You need to obtain an Azure Resource Manager access token.Solution: Use an X.509 certificate to authenticate the VM with Azure Resource Manager.Does the solution meet the goal?
Answer(s): B
Instead run the Invoke-RestMethod cmdlet to make a request to the local managed identity for Azure resources endpoint.
https://docs.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/tutorial-windows-vm-access-arm
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.You develop Azure solutions.You must grant a virtual machine (VM) access to specific resource groups in Azure Resource Manager.You need to obtain an Azure Resource Manager access token.Solution: Use the Reader role-based access control (RBAC) role to authenticate the VM with Azure Resource Manager.Does the solution meet the goal?
HOTSPOT (Drag and Drop is not supported) You are building a website that is used to review restaurants. The website will use an Azure CDN to improve performance and add functionality to requests.You build and deploy a mobile app for Apple iPhones. Whenever a user accesses the website from an iPhone, the user must be redirected to the app store.You need to implement an Azure CDN rule that ensures that iPhone users are redirected to the app store.How should you complete the Azure Resource Manager template? To answer, select the appropriate options in the answer area.NOTE: Each correct selection is worth one point.Hot Area:
Box 1: iOS Azure AD Conditional Access supports the following device platforms:- Android- iOS- Windows Phone- WindowsmacOSBox 2: DeliveryRuleIsDeviceConditionParametersThe DeliveryRuleIsDeviceCondition defines the IsDevice condition for the delivery rule. parameters defines the parameters for the condition.Box 3: HTTP_USER_AGENT Incorrect Answers:- The Pragma HTTP/1.0 general header is an implementation-specific header that may have various effects along the request-response chain. It is used for backwards compatibility with HTTP/1.0 caches.- "X-Powered-By" is a common non-standard HTTP response header (most headers prefixed with an 'X-' are non-standard).Box 4: DeliveryRuleRequestHeaderConditionParametersDeliveryRuleRequestHeaderCondition defines the RequestHeader condition for the delivery rule. parameters defines the parameters for the condition.Box 5: iOS The Require approved client app requirement only supports the iOS and Android for device platform condition.
https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/concept-conditional-access-conditions https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/concept-conditional-access-grant
Post your Comments and Discuss Microsoft AZ-204 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the AZ-204 content, but please register or login to continue.