nerdexam
Microsoft

AZ-204 · Question #40

Drag and Drop Question You are developing a .NET Core model-view controller (MVC) application hosted on Azure for a health care system that allows providers access to their information. You develop…

The correct answer is [Authorize(Roles = "ProviderAdmin, SysAdmin")]; [Authorize(Policy = "ProviderEditor", Roles = "SysAdmin")]. The Partner controller requires access for both ProviderAdmin AND SysAdmin roles, so [Authorize(Roles = "ProviderAdmin, SysAdmin")] is correct at the controller level - a comma-separated list in a single Authorize attribute means OR (either role is sufficient). For the Manage…

Submitted by lars.no· Mar 30, 2026Implement secure cloud solutions - specifically configuring authorization policies and role-based access control in Azure-hosted ASP.NET Core MVC applications (AZ-204: Develop for Azure / Implement Azure Security)

Question

Drag and Drop Question You are developing a .NET Core model-view controller (MVC) application hosted on Azure for a health care system that allows providers access to their information. You develop the following code: You define a role named SysAdmin. You need to ensure that the application meets the following authorization requirements: - Allow the ProviderAdmin and SysAdmin roles access to the Partner controller regardless of whether the user holds an editor claim of partner. - Limit access to the Manage action of the controller to users with an editor claim of partner who are also members of the SysAdmin role. How should you complete the code? To answer, drag the appropriate code segments to the correct locations. Each code segment may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content. NOTE: Each correct selection is worth one point. Answer:

Exhibit

AZ-204 question #40 exhibit

Answer Area

Drag items

[Authorize(Policy = "ProviderEditor")][Authorize(Roles = "ProviderAdmin")][Authorize(Roles = "SysAdmin")][Authorize(Roles = "ProviderAdmin, SysAdmin")][Authorize(Policy = "ProviderEditor", Roles = "SysAdmin")]

Correct arrangement

  • [Authorize(Roles = "ProviderAdmin, SysAdmin")]
  • [Authorize(Policy = "ProviderEditor", Roles = "SysAdmin")]

Explanation

The Partner controller requires access for both ProviderAdmin AND SysAdmin roles, so [Authorize(Roles = "ProviderAdmin, SysAdmin")] is correct at the controller level - a comma-separated list in a single Authorize attribute means OR (either role is sufficient). For the Manage action, the requirement is that a user must BOTH hold an editor claim of 'partner' (ProviderEditor policy) AND be in the SysAdmin role, so [Authorize(Policy = "ProviderEditor", Roles = "SysAdmin")] combines both conditions in a single attribute where both must be satisfied simultaneously.

Topics

#ASP.NET Core Authorization#Role-Based Access Control#Policy-Based Authorization#Azure MVC Security

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full AZ-204 Practice