AZ-400 practice questions 141–150

1. Question 141 · 540 in bank

   SIMULATION - You need to ensure that Microsoft Visual Studio 2017 can remotely attach to an Azure Function named fa-11566895. To complete this task, sign in to the Microsoft Azure portal.

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer:

   Explanation

   Enable Remote Debugging - Before we start a debugging session to our Azure Function app we need to enable the functionality. 1. Navigate in the Azure portal to your function app fa-11566895 2. Go to the ג€Application settingsג€ 3. Under ג€Debuggingג€ set Remote Debugging to On and set Remote Visual Studio version to 2017. Reference: https://www.locktar.nl/uncategorized/azure-remote-debugging-manually-in-visual-studio-2017/

   Source: Adapted from community discussion — Mithi

   References

   • Microsoft Learn

   Next question

2. Question 142 · 540 in bank

   HOTSPOT - You have an Azure subscription that contains the resources shown in the following table.

   

   You plan to create a linked service in DF1. The linked service will connect to SQL1 by using Microsoft SQL Server authentication. The password for the SQL Server login will be stored - in KV1. You need to configure DF1 to retrieve the password when the data factory connects to SQL1. The solution must use the principle of least privilege. How should you configure DF1? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Box 1: Secret - Store credential in Azure Key Vault by reference secret stored in key vault. To reference a credential stored in Azure Key Vault, you need to: 1. Retrieve data factory managed identity 2. Grant the managed identity access to your Azure Key Vault. In your key vault -> Access policies -> Add Access Policy, search this managed identity to grant Get permission in Secret permissions dropdown. It allows this designated factory to access secret in key vault. 3. Create a linked service pointing to your Azure Key Vault. 4. Create data store linked service, inside which reference the corresponding secret stored in key vault. Box 2: Access policy - Reference: https://docs.microsoft.com/en-us/azure/data-factory/store-credentials-in-key-vault

   Source: Adapted from community discussion — Tyler2023

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

3. Question 143 · 540 in bank

   DRAG DROP - Your company has a project in Azure DevOps. You plan to create a release pipeline that will deploy resources by using Azure Resource Manager templates. The templates will reference secrets stored in Azure Key Vault. You need to recommend a solution for accessing the secrets stored in the key vault during deployments. The solution must use the principle of least privilege. What should you include in the recommendation? To answer, drag the appropriate configurations to the correct targets. Each configuration may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content. NOTE: Each correct selection is worth one point. Select and Place:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Box 1: A key Vault advanced access policy Box 2: RBAC - Management plane access control uses RBAC. The management plane consists of operations that affect the key vault itself, such as: ✑ Creating or deleting a key vault. ✑ Getting a list of vaults in a subscription. ✑ Retrieving Key Vault properties (such as SKU and tags). ✑ Setting Key Vault access policies that control user and application access to keys and secrets. Reference: https://docs.microsoft.com/en-us/azure/azure-resource-manager/resource-manager-tutorial-use-key-vault

   Source: Adapted from community discussion — AzureJobsTillRetire

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

4. Question 144 · 540 in bank

   DRAG DROP - You need to configure access to Azure DevOps agent pools to meet the following requirements: ✑ Use a project agent pool when authoring build or release pipelines. ✑ View the agent pool and agents of the organization. ✑ Use the principle of least privilege. Which role memberships are required for the Azure DevOps organization and the project? To answer, drag the appropriate role memberships to the correct targets. Each role membership may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content. NOTE: Each correct selection is worth one point. Select and Place:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Box 1: Reader - Members of the Reader role can view the organization agent pool as well as agents. You typically use this to add operators that are responsible for monitoring the agents and their health. Box 2: Service account - Members of the Service account role can use the organization agent pool to create a project agent pool in a project. If you follow the guidelines above for creating new project agent pools, you typically do not have to add any members here. Incorrect Answers: In addition to all the permissions given the Reader and the Service Account role, members of the administrator role can register or unregister agents from the organization agent pool. They can also refer to the organization agent pool when creating a project agent pool in a project. Finally, they can also manage membership for all roles of the organization agent pool. The user that created the organization agent pool is automatically added to the Administrator role for that pool. Reference: https://docs.microsoft.com/en-us/azure/devops/pipelines/agents/pools-queues

   Source: Adapted from community discussion — syu31svc

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

5. Question 145 · 540 in bank

   You have a branch policy in a project in Azure DevOps. The policy requires that code always builds successfully. You need to ensure that a specific user can always merge changes to the master branch, even if the code fails to compile. The solution must use the principle of least privilege. What should you do?

   • AAdd the user to the Build Administrators group.
   • BAdd the user to the Project Administrators group.
   • CFrom the Security settings of the repository, modify the access control for the user.
   • DFrom the Security settings of the branch, modify the access control for the user.

   Show answer

   Answer: D

   Explanation

   https://docs.microsoft.com/en-us/azure/devops/repos/git/branch-permissions?view=azure-devops "Users with this permission are exempt from the branch policy set for the branch when completing pull requests and can opt-in to override the policies by checking Override branch policies and enable merge when completing a PR." Answer is D

   Source: Adapted from community discussion — syu31svc

   References

   • Microsoft Learn
   • Microsoft Learn

   Next question

6. Question 146 · 540 in bank

   You have an Azure Resource Manager template that deploys a multi-tier application. You need to prevent the user who performs the deployment from viewing the account credentials and connection strings used by the application. What should you use?

   • AAzure Key Vault
   • Ba Web.config file
   • Can Appsettings.json file
   • Dan Azure Storage table
   • Ean Azure Resource Manager parameter file

   Show answer

   Answer: A

   Explanation

   A is the answer. https://learn.microsoft.com/en-us/azure/azure-resource-manager/templates/key-vault-parameter?tabs=azure-cli Instead of putting a secure value (like a password) directly in your template or parameter file, you can retrieve the value from an Azure Key Vault during a deployment. You retrieve the value by referencing the key vault and secret in your parameter file. The value is never exposed because you only reference its key vault ID.

   Source: Adapted from community discussion — zellck

   References

   • Microsoft Learn

   Next question

7. Question 147 · 540 in bank

   SIMULATION - Your company plans to implement a new compliance strategy that will require all Azure web apps to be backed up every five hours. You need to back up an Azure web app named az400-123456789-main every five hours to an Azure Storage account in your resource group. To complete this task, sign in to the Microsoft Azure portal.

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   With the storage account ready, you can configure backs up in the web app or App Service. 1. Open the App Service az400-123456789-main, which you want to protect, in the Azure Portal and browse to Settings > Backups. Click Configure and a Backup Configuration blade should appear. 2. Select the storage account. 3. Click + to create a private container. You could name this container after the web app or App Service. 4. Select the container. 5. If you want to schedule backups, then set Scheduled Backup to On and configure a schedule: every five hours 6. Select your retention. Note that 0 means never delete backups. 7. Decide if at least one backup should always be retained. 8. Choose if any connected databases should be included in the web app backup. 9. Click Save to finalize the backup configuration. Reference: https://petri.com/backing-azure-app-service

   Source: Adapted from community discussion — Tyler2023

   References

   • Microsoft Learn

   

   Next question

8. Question 148 · 540 in bank

   SIMULATION - You need to configure a virtual machine named VM1 to securely access stored secrets in an Azure Key Vault named az400-123456789-kv. To complete this task, sign in to the Microsoft Azure portal.

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   You can use a system-assigned managed identity for a Windows virtual machine (VM) to access Azure Key Vault. 1. Sign in to Azure portal 2. Locate virtual machine VM1. 3. Select Identity 4. Enable the system-assigned identity for VM1 by setting the Status to On. Note: Enabling a system-assigned managed identity is a one-click experience. You can either enable it during the creation of a VM or in the properties of an existing VM. Reference: https://docs.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/tutorial-windows-vm-access-nonaad

   Source: Adapted from community discussion — Rams_84zO6n

   

   Next question

9. Question 149 · 540 in bank

   DRAG DROP - Your company has an Azure subscription named Subscription1. Subscription1 is associated to an Azure Active Directory tenant named contoso.com. You need to provision an Azure Kubernetes Services (AKS) cluster in Subscription1 and set the permissions for the cluster by using RBAC roles that reference the identities in contoso.com. Which three objects should you create in sequence? To answer, move the appropriate objects from the list of objects to the answer area and arrange them in the correct order. Select and Place:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Step 1: Create an AKS cluster - Step 2: a system-assigned managed identity To create an RBAC binding, you first need to get the Azure AD Object ID. 1. Sign in to the Azure portal. 2. In the search field at the top of the page, enter Azure Active Directory. 3. Click Enter. 4. In the Manage menu, select Users. 5. In the name field, search for your account. 6. In the Name column, select the link to your account. 7. In the Identity section, copy the Object ID. Step 3: a RBAC binding - Reference: https://docs.microsoft.com/en-us/azure/developer/ansible/aks-configure-rbac

   Source: Adapted from community discussion — ahaz

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

10. Question 150 · 540 in bank

    HOTSPOT - You manage build and release pipelines by using Azure DevOps. Your entire managed environment resides in Azure. You need to configure a service endpoint for accessing Azure Key Vault secrets. The solution must meet the following requirements: ✑ Ensure that the secrets are retrieved by Azure DevOps. ✑ Avoid persisting credentials and tokens in Azure DevOps. How should you configure the service endpoint? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Hot Area:

    

    This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

    Show the answer figure

    Answer: See figure below

    Explanation

    Box 1: Azure Pipelines service connection Box 2: Managed Service Identity Authentication The managed identities for Azure resources feature in Azure Active Directory (Azure AD) provides Azure services with an automatically managed identity in Azure AD. You can use the identity to authenticate to any service that supports Azure AD authentication, including Key Vault, without any credentials in your code. Reference: https://docs.microsoft.com/en-us/azure/devops/pipelines/tasks/deploy/azure-key-vault https://docs.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/overview

    Source: Adapted from community discussion — Lyonel

    References

    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn

    

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

AZ-400 practice, question 141. 540 questions available.