exam questions

Exam AZ-204 All Questions

View all questions & answers for the AZ-204 exam

Exam AZ-204 topic 28 question 2 discussion

Actual exam question from Microsoft's AZ-204
Question #: 2
Topic #: 28
[All AZ-204 Questions]

You need to access data from the user claim object in the e-commerce web app.
What should you do first?

  • A. Write custom code to make a Microsoft Graph API call from the e-commerce web app.
  • B. Assign the Contributor RBAC role to the e-commerce web app by using the Resource Manager create role assignment API.
  • C. Update the e-commerce web app to read the HTTP request header values.
  • D. Using the Azure CLI, enable Cross-origin resource sharing (CORS) from the e-commerce checkout API to the e-commerce web app.
Show Suggested Answer Hide Answer
Suggested Answer: C 🗳️

Comments

Chosen Answer:
This is a voting comment (?). It is better to Upvote an existing comment if you don't have anything to add.
Switch to a voting comment New
j888
Highly Voted 3 years, 2 months ago
https://docs.microsoft.com/en-us/azure/app-service/configure-authentication-user-identities The answer C
upvoted 28 times
Jonas_86
3 years, 1 month ago
your link is intersting but I think the answer you provide is FALSE. As I understood from the link, if you want to access user claims from Azure Function then the C answer is OK but if you want to get it from webapp then the A answer is the good one. Please, recheck the link above
upvoted 5 times
phvogel
3 years ago
To quote the link provided: "For all language frameworks, App Service makes the claims in the incoming token (whether from an authenticated end user or a client application) available to your code by injecting them into the request headers. External requests aren't allowed to set these headers, so they are present only if set by App Service...." So the first thing that happens in the the Web App is to read the information from the request headers that was inserted by the App Service as part of authenticating the user in order to provide the user's claims.
upvoted 6 times
troy89
2 years, 8 months ago
I would say this is correct because the JWT is sent in the header and it contains the claims. No need to access the GraphAPI
upvoted 1 times
hubekpeter
1 year, 11 months ago
Exactly.
upvoted 1 times
...
...
...
wsellmair
2 years, 8 months ago
in Function you can access the user clams from headers, ClaimsPrincipal For Azure Functions, ClaimsPrincipal.Current is not populated for .NET code, but you can still find the user claims in the request headers, or get the ClaimsPrincipal object from the request context or even through a binding parameter. See working with client identities in Azure Functions for more information. https://docs.microsoft.com/en-us/azure/app-service/configure-authentication-user-identities
upvoted 1 times
...
...
...
MiraA
Highly Voted 3 years ago
Answer is A. Check this tutorial related to a web app accessing Microsoft Graph to get signed user's display name and his/her photo from Azure AD. It seems it corresponds to "access data from the user claim object" requirement. https://docs.microsoft.com/en-us/azure/app-service/scenario-secure-app-access-microsoft-graph-as-user Note: Reading HTTP headers (the answer C) could give basic information only - but the user claim contains more detailed data. https://docs.microsoft.com/en-us/azure/app-service/configure-authentication-user-identities
upvoted 6 times
gmishra88
2 years ago
The question does not ask anything but claims and does not say read profile (which has detailed information), in which case you might want to access the graphs API if given access.
upvoted 1 times
...
troy89
2 years, 8 months ago
Yeah, but to access the GraphAPI you need the information from the token which is sent in the header, so in both ways, the first step is to read the header values.
upvoted 1 times
...
...
paddy23
Most Recent 9 months, 1 week ago
The answer C
upvoted 1 times
...
katrang
1 year, 1 month ago
Selected Answer: C
App Service makes the claims in the incoming token (whether from an authenticated end user or a client application) available to your code by injecting them into the request headers. So from this point, you just need to read them in your code
upvoted 2 times
...
JH81
1 year, 4 months ago
Selected Answer: C
"E-commerce application sign-ins must be secured by using Azure App Service authentication and Azure Active Directory (AAD)." so using Microsoft Graph API call is probably what you want to do but the tricky part is the question asks what should you do first. Read the header to get the info you need to make the Graph API call would be my vote.
upvoted 1 times
...
OPT_001122
1 year, 11 months ago
Selected Answer: C
The answer C
upvoted 1 times
...
wsellmair
2 years, 8 months ago
Selected Answer: C
https://docs.microsoft.com/en-us/azure/app-service/configure-authentication-user-identities
upvoted 1 times
...
wsellmair
2 years, 8 months ago
in Function you can access the user clams from headers, ClaimsPrincipal For Azure Functions, ClaimsPrincipal.Current is not populated for .NET code, but you can still find the user claims in the request headers, or get the ClaimsPrincipal object from the request context or even through a binding parameter. See working with client identities in Azure Functions for more information. https://docs.microsoft.com/en-us/azure/app-service/configure-authentication-user-identities
upvoted 2 times
surprise0011
1 year, 6 months ago
Great finding! New link from learn.microsoft: https://learn.microsoft.com/en-us/azure/app-service/configure-authentication-user-identities
upvoted 1 times
...
...
justyoung17
3 years, 1 month ago
I think it's (A) though because it's a e-commerce 'web app' which is not an 'Azure function'.
upvoted 6 times
ensa
3 years ago
But Azure function will get data from web app and App Service passes user claims to the app by using special request headers. External requests aren’t allowed to set these headers, so they are present only if set by the App Service. then [FunctionName("ClaimsDemo")] public static IActionResult Run ([HttpTrigger(AuthorizationLevel.Anonymous, "get", "post", Route = null)] HttpRequest req, ILogger log) { //Extract User ID and Claims from the request headers var principal_name = req.Headers["X-MS-CLIENT-PRINCIPAL-NAME"].FirstOrDefault(); var principal_Id = req.Headers["X-MS-CLIENT-PRINCIPAL-ID"].FirstOrDefault(); So CCCCCCCCCCCCCCCCCCCCC
upvoted 3 times
...
...
ning
3 years, 2 months ago
I do not know if C is correct, the thing you need is https://docs.microsoft.com/en-us/azure/active-directory/develop/msal-net-migration, you cannot read the http header directly, you need MS library, best thing I can see if graph from A ... But it is not really, the name of the library ...
upvoted 3 times
...
Community vote distribution
A (35%)
C (25%)
B (20%)
Other
Most Voted
A voting comment increases the vote count for the chosen answer by one.

Upvoting a comment with a selected answer will also increase the vote count towards that answer by one. So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.

SaveCancel
Loading ...
exam
Someone Bought Contributor Access for:
SY0-701
London, 1 minute ago