Service principals for applications in Azure - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

What is the primary purpose of a service principal in Azure?

Choose the best description of what a service principal does in Azure.

A It acts as a security identity for applications to access Azure resources.

B It is a user account for administrators to manage Azure subscriptions.

C It is a storage account used to save application secrets securely.

D It is a virtual machine that runs application code in Azure.

💡 Hint

Think about how applications authenticate to Azure services without user interaction.

A service principal is like a user identity for an application. It allows the app to access Azure resources securely without needing a real user.

❓ Architecture

intermediate

Which Azure component must be created first to generate a service principal?

To create a service principal, which Azure resource is required to exist first?

A An Azure Resource Group

B An Azure Storage Account

C An Azure Virtual Network

D An Azure Active Directory application registration

💡 Hint

Service principals are linked to identities registered in Azure AD.

A service principal is created from an Azure AD application registration. The app registration defines the identity, and the service principal is the instance used for access.

❓ security

advanced

What is the safest way to assign permissions to a service principal?

Choose the best practice for assigning permissions to a service principal to minimize security risks.

A Assign only the minimum required role permissions using Azure RBAC.

B Assign the Owner role at the subscription level for full access.

C Assign Contributor role to all resource groups to avoid permission issues.

D Assign permissions directly to the user who created the service principal.

💡 Hint

Think about the principle of least privilege.

Assigning only the minimum required permissions reduces the risk if the service principal is compromised. Avoid broad roles like Owner unless absolutely necessary.

❓ service_behavior

advanced

What happens if a service principal's secret expires?

What is the expected behavior when the secret (password or certificate) of a service principal expires?

A Azure automatically renews the secret without any action needed.

B The application using the service principal will fail to authenticate until the secret is renewed.

C The service principal is deleted automatically by Azure.

D The application continues to authenticate using cached tokens indefinitely.

💡 Hint

Consider what happens when credentials are no longer valid.

When a service principal's secret expires, authentication requests using that secret will fail. The secret must be renewed or replaced to restore access.

❓ Configuration

expert

What is the output of this Azure CLI command sequence?

Given the commands below, what will be the output of the final command?

Azure

az ad sp create-for-rbac --name myAppSP --skip-assignment
az role assignment list --assignee <appId_of_myAppSP> --query [].roleDefinitionName

A ["Reader"]

B ["Owner"]

C []

D ["Contributor"]

💡 Hint

Consider what the --skip-assignment flag does when creating the service principal.

The --skip-assignment flag creates the service principal without any role assignments. Therefore, listing roles for the SP returns an empty list.