Merge pull request #53164 from JeffKoMS/module-assessment-fixes

Module assessment fixes

Author: v-ccolin

learn-pr/wwl-azure/implement-azure-app-configuration/6-knowledge-check.yml

@@ -23,10 +23,10 @@ quiz:
       explanation: "Correct. Labels in Azure App Configuration are used to create variants of a key and differentiate key-values with the same key."
     - content: "Labels are used to encrypt key-values in App Configuration."
       isCorrect: false
-      explanation: "Incorrect. Labels do not provide encryption. They are used to differentiate key-values with the same key."
+      explanation: "Incorrect. Labels don't provide encryption. They're used to differentiate key-values with the same key."
     - content: "Labels are used to limit the size of key-values in App Configuration."
       isCorrect: false
-      explanation: "Incorrect. Labels do not limit the size of key-values. They are used to differentiate key-values with the same key."
+      explanation: "Incorrect. Labels don't limit the size of key-values. They're used to differentiate key-values with the same key."
   - content: "What is the role of a feature manager in managing application features?"
     choices:
     - content: "A feature manager is a rule for evaluating the state of a feature flag."
@@ -38,14 +38,14 @@ quiz:
     - content: "A feature manager is an application package that handles the lifecycle of all the feature flags in an application."
       isCorrect: true
       explanation: "Correct. A feature manager provides extra functionality, such as caching feature flags and updating their states."
-  - content: "What is the purpose of using customer-managed keys in Azure App Configuration?"
+  - content: "In a Key Vault access policy, which key permissions must you grant to the Azure App Configuration managed identity to enable customer-managed keys?"
     choices:
-    - content: "To enable authentication with Microsoft Entra ID"
+    - content: "GET, WRAP, and UNWRAP permissions on the Key Vault key"
+      isCorrect: true
+      explanation: "Correct. App Configuration uses its managed identity to access the Key Vault key and wrap/unwrap the store’s encryption key."
+    - content: "GET and LIST permissions on Key Vault secrets"
       isCorrect: false
-      explanation: "Incorrect. While a managed identity is used for authentication, it's not the primary purpose of customer-managed keys."
-    - content: "To permanently store the unwrapped encryption key"
+      explanation: "Incorrect. Customer-managed keys use a Key Vault key (not secrets) and require wrap/unwrap operations."
+    - content: "CREATE and DELETE permissions on the Key Vault key"
       isCorrect: false
-      explanation: "Incorrect. The unwrapped encryption key is cached within App Configuration for one hour, not stored permanently."
-    - content: "To encrypt sensitive information at rest"
-      isCorrect: true
-      explanation: "Correct. Customer-managed keys are used to encrypt sensitive information in key-value pairs at rest."
+      explanation: "Incorrect. App Configuration doesn’t need to create or delete the key; it needs to wrap and unwrap with an existing key."

learn-pr/wwl-azure/implement-managed-identities/6-knowledge-check.yml

@@ -26,14 +26,14 @@ quiz:
     - content: "Can only be associated with a single Azure resource"
       isCorrect: false
       explanation: "Incorrect. The same user-assigned managed identity can be associated with more than one Azure resource."
-  - content: "A client app requests managed identities for an access token for a given resource. Which of the following options is the basis for the token?"
+  - content: "When an Azure resource uses a managed identity to request an access token for a resource, which Microsoft Entra ID identity does the token represent?"
     choices:
-    - content: "Oauth 2.0"
+    - content: "OAuth 2.0"
       isCorrect: false
-      explanation: "Incorrect. Oauth 2.0 is a protocol that can be used to acquire a token, but isn't the basis for the token."
-    - content: "Service principal"
+      explanation: "Incorrect. OAuth 2.0 is the protocol used to request tokens, not the identity represented in the token."
+    - content: "The managed identity’s service principal"
       isCorrect: true
-      explanation: "Correct. The token is based on the managed identities for Azure resources service principal."
-    - content: "Virtual machine"
+      explanation: "Correct. The access token represents the managed identity’s service principal in Microsoft Entra ID."
+    - content: "The virtual machine (or hosting resource) itself"
       isCorrect: false
-      explanation: "Incorrect. The virtual machine may be assigned a managed identity, but isn't the basis for the token."
+      explanation: "Incorrect. The resource can have a managed identity, but the token represents the identity (service principal), not the VM object."