Microsoft AZ-204 Practice Test - Questions Answers, Page 12

Box 1: user_impersonation

Box 2: delegated

Example:

1. Select the API permissions section

2. Click the Add a permission button and then:

Ensure that the My APIs tab is selected

3. In the list of APIs, select the API TodoListService-aspnetcore.

4. In the Delegated permissions section, ensure that the right permissions are checked: user_impersonation.

5. Select the Add permissions button.

Box 3: delegated

Example

1. Select the API permissions section

2. Click the Add a permission button and then,

Ensure that the Microsoft APIs tab is selected

3. In the Commonly used Microsoft APIs section, click on Microsoft Graph

4. In the Delegated permissions section, ensure that the right permissions are checked: User.Read. Use the search box if necessary.

5. Select the Add permissions button

Reference:

https://docs.microsoft.com/en-us/samples/azure-samples/active-directory-dotnet-webapp-webapi-openidconnect-aspnetcore/calling-a-web-api-in-an-aspnet-core-web-application-using-azure-ad/

Box 1: UseAuthentication

Need to validate users before users are allowed access to secure resources.

UseAuthentication adds the AuthenticationMiddleware to the specified IApplicationBuilder, which enables authentication capabilities.

Box 2: UseAuthorization

Need to permit users to access secure resources.

UseAuthorization adds the AuthorizationMiddleware to the specified IApplicationBuilder, which enables authorization capabilities.

Box 3: UseStaticFiles

Need to use the Export feature in the app without requiring a restart of the app.

UseStaticFiles enables static file serving for the current request path

Reference:

https://docs.microsoft.com/en-us/dotnet/api/microsoft.aspnetcore.builder.iapplicationbuilder?view=aspnetcore-5.0

Instead use an Azure Key vault and public key encryption. Store the encrypted from in Azure Storage Blob storage.

Instead use an Azure Key vault and public key encryption. Store the encrypted from in Azure Storage Blob storage.

Box 1: keyvault

Create an Azure Key Vault with az keyvault create and enable the Key Vault for use with disk encryption. Specify a unique Key Vault name for keyvault_name as follows:

keyvault_name=myvaultname$RANDOM

az keyvault create \

--name $keyvault_name \

--resource-group $resourcegroup \

--location eastus \

--enabled-for-disk-encryption True

Box 2: keyvault key

The Azure platform needs to be granted access to request the cryptographic keys when the VM boots to decrypt the virtual disks. Create a cryptographic key in your Key Vault with az keyvault key create. The following example creates a key named myKey:

az keyvault key create \

--vault-name $keyvault_name \

--name myKey \

--protection software

Box 3: vm

Create a VM with az vm create. Only certain marketplace images support disk encryption. The following example creates a VM named myVM using an Ubuntu 16.04 LTS image:

az vm create \

--resource-group $resourcegroup \

--name myVM \

--image Canonical:UbuntuServer:16.04-LTS:latest \

--admin-username azureuser \

--generate-ssh-keys \

Box 4: vm encryption

Encrypt your VM with az vm encryption enable:

az vm encryption enable \

--resource-group $resourcegroup \

--name myVM \

--disk-encryption-keyvault $keyvault_name \

--key-encryption-key myKey \

--volume-type all

Note: seems to an error in the question. Should have enable instead of create.

Box 5: all

Encrypt both data and operating system.

Reference:

https://docs.microsoft.com/en-us/azure/virtual-machines/linux/disk-encryption-cli-quickstart

Azure Active Directory Managed Service Identity (MSI) gives your code an automatically managed identity for authenticating to Azure services, so that you can keep credentials out of your code.

Note: Use the authentication-managed-identity policy to authenticate with a backend service using the managed identity. This policy essentially uses the managed identity to obtain an access token from Azure Active Directory for accessing the specified resource. After successfully obtaining the token, the policy will set the value of the token in the Authorization header using the Bearer scheme.

Incorrect Answers:

A: Use the authentication-basic policy to authenticate with a backend service using Basic authentication. This policy effectively sets the HTTP Authorization header to the value corresponding to the credentials provided in the policy.

B: Anonymous is no authentication at all.

D: Your code needs credentials to authenticate to cloud services, but you want to limit the visibility of those credentials as much as possible. Ideally, they never appear on a developer's workstation or get checked-in to source control. Azure Key Vault can store credentials securely so they aren't in your code, but to retrieve them you need to authenticate to Azure Key Vault. To authenticate to Key Vault, you need a credential! A classic bootstrap problem.

Reference:

https://azure.microsoft.com/en-us/blog/keep-credentials-out-of-code-introducing-azure-ad-managed-service-identity/

https://docs.microsoft.com/en-us/azure/api-management/api-management-authentication-policies

Box 1: iOS

Azure AD Conditional Access supports the following device platforms:

Android

iOS

Windows Phone

Windows

macOS

Box 2: DeliveryRuleIsDeviceConditionParameters

The DeliveryRuleIsDeviceCondition defines the IsDevice condition for the delivery rule. parameters defines the parameters for the condition.

Box 3: HTTP_USER_AGENT

Incorrect Answers:

The Pragma HTTP/1.0 general header is an implementation-specific header that may have various effects along the request-response chain. It is used for backwards compatibility with HTTP/1.0 caches.

"X-Powered-By" is a common non-standard HTTP response header (most headers prefixed with an 'X-' are non-standard).

Box 4: DeliveryRuleRequestHeaderConditionParameters

DeliveryRuleRequestHeaderCondition defines the RequestHeader condition for the delivery rule. parameters defines the parameters for the condition.

Box 5: iOS

The Require approved client app requirement only supports the iOS and Android for device platform condition.

Reference:

https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/concept-conditional-access-conditions

https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/concept-conditional-access-grant