You manage a data processing application that receives requests from an Azure Storage queue.You need to manage access to the queue. You have the following requirements:-Provide other applications access to the Azure queue.-Ensure that you can revoke access to the queue without having to regenerate the storage account keys.-Specify access at the queue level and not at the storage account level.Which type of shared access signature (SAS) should you use?
Answer(s): A
A service SAS is secured with the storage account key. A service SAS delegates access to a resource in only one of the Azure Storage services: Blob storage,Queue storage, Table storage, or Azure Files.Stored access policies give you the option to revoke permissions for a service SAS without having to regenerate the storage account keys.Incorrect Answers:Account SAS: Account SAS is specified at the account level. It is secured with the storage account key.User Delegation SAS: A user delegation SAS applies to Blob storage only.
https://docs.microsoft.com/en-us/azure/storage/common/storage-sas-overview
HOTSPOT (Drag and Drop is not supported) You are developing an application to store and retrieve data in Azure Blob storage. The application will be hosted in an on-premises virtual machine (VM). TheVM is connected to Azure by using a Site-to-Site VPN gateway connection. The application is secured by using Azure Active Directory (Azure AD) credentials.The application must be granted access to the Azure Blob storage account with a start time, expiry time, and read permissions. The Azure Blob storage account access must use the Azure AD credentials of the application to secure data access. Data access must be able to be revoked if the client application security is breached.You need to secure the application access to Azure Blob storage.Which security features should you use? To answer select the appropriate options in the answer area.NOTE: Each correct selection is worth one point.Hot Area:
Box 1: Shared access signature (SAS) tokenWhen your application design requires shared access signatures for access to Blob storage, use Azure AD credentials to create a user delegation SAS when possible for superior security.Box 2: Stored access policy Stored access policies give you the option to revoke permissions for a service SAS without having to regenerate the storage account keys.A shared access signature can take one of the following two forms:- Service SAS with stored access policy. A stored access policy is defined on a resource container, which can be a blob container, table, queue, or file share.The stored access policy can be used to manage constraints for one or more service shared access signatures. When you associate a service SAS with a stored access policy, the SAS inherits the constraints ג€" the start time, expiry time, and permissions ג€" defined for the stored access policy.- Ad hoc SAS.
You are building a web application that uses the Microsoft identity platform for user authentication.You are implementing user identification for the web application.You need to retrieve a claim to uniquely identify a user.Which claim type should you use?
Answer(s): C
oid -The object identifier for the user in Azure AD. This value is the immutable and non-reusable identifier of the user. Use this value, not email, as a unique identifier for users; email addresses can change. If you use the Azure AD Graph API in your app, object ID is that value used to query profile information.Incorrect:Not A: aud - Who the token was issued for. This will be the application's client ID.
https://docs.microsoft.com/en-us/azure/architecture/multitenant-identity/claims
You are developing an Azure Function that calls external APIs by providing an access token for the API. The access token is stored in a secret named token in anAzure Key Vault named mykeyvault.You need to ensure the Azure Function can access to the token. Which value should you store in the Azure Function App configuration?
Answer(s): D
Add Key Vault secrets reference in the Function App configuration.Syntax: @Microsoft.KeyVault(SecretUri={copied identifier for the username secret})
https://daniel-krzyczkowski.github.io/Integrate-Key-Vault-Secrets-With-Azure-Functions/
A company maintains multiple web and mobile applications. Each application uses custom in-house identity providers as well as social identity providers.You need to implement single sign-on (SSO) for all the applications.What should you do?
You can add Google as an identity provider for B2B guest users.Federation with SAML/WS-Fed identity providers for guest users.Make sure your organization's external collaboration settings are configured such that you're allowed to invite guests.Note 1: As a user who is assigned any of the limited administrator directory roles, you can use the Azure portal to invite B2B collaboration users. You can invite guest users to the directory, to a group, or to an application. After you invite a user through any of these methods, the invited user's account is added to AzureActive Directory (Azure AD), with a user type of Guest.Note 2: Direct federation in Azure Active Directory is now referred to as SAML/WS-Fed identity provider (IdP) federation.
https://docs.microsoft.com/en-us/azure/active-directory/external-identities/google-federation https://docs.microsoft.com/en-us/azure/active-directory/external-identities/add-users-administrator
Post your Comments and Discuss Microsoft AZ-204 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the AZ-204 content, but please register or login to continue.