AZ-204 practice questions 251–260

1. Question 251 · 462 in bank

   HOTSPOT - You need to implement the bindings for the CheckUserContent function. How should you complete the code segment? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   The "content" parameter is of type "string" so it must be QueueTrigger. For example BlobTrigger uses Stream type, CosmosDBTrigger uses IReadOnlyList<> type, it seems the Table Storage has no trigger binding. https://docs.microsoft.com/en-us/azure/azure-functions/functions-triggers-bindings?tabs=csharp#supported-bindings https://docs.microsoft.com/en-us/azure/azure-functions/functions-bindings-storage-queue-trigger https://docs.microsoft.com/cs-cz/azure/azure-functions/functions-bindings-storage-blob-trigger https://docs.microsoft.com/en-us/azure/azure-functions/functions-bindings-cosmosdb-v2-trigger

   Source: Adapted from community discussion — MiraA

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

2. Question 252 · 462 in bank

   You need to configure the ContentUploadService deployment. Which two actions should you perform? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.

   • AAdd the following markup to line CS23: type: Private
   • BAdd the following markup to line CS24: osType: Windows
   • CAdd the following markup to line CS24: osType: Linux
   • DAdd the following markup to line CS23: type: Public

   Show answer

   Answer: A

   Explanation

   According to the articles mentioned by Mo_Mo_01: Exposing to internet/public is not yet supported, so must be private (A). Windows containers in a group do not support custom vnet, so must be Linux (C). Assuming private is default, I would go for C. (although Windows hardly makes sense for containers and Linux should also be the default).

   Source: Adapted from community discussion — kwaazaar

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

3. Question 253 · 462 in bank

   HOTSPOT - You need to configure the Account Kind, Replication, and Access tier options for the corporate website's Azure Storage account. How should you complete the configuration? To answer, select the appropriate options in the dialog box in the answer area. NOTE: Each correct selection is worth one point. Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Replication should be GZRS. Requirements ask "Data must be replicated to a secondary region and three availability zones". GRS option doesn't copy data in different availability zones

   Source: Adapted from community discussion — Paolo93

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

4. Question 254 · 462 in bank

   You are developing a Java application that uses Cassandra to store key and value data. You plan to use a new Azure Cosmos DB resource and the Cassandra API in the application. You create an Azure Active Directory (Azure AD) group named Cosmos DB Creators to enable provisioning of Azure Cosmos accounts, databases, and containers. The Azure AD group must not be able to access the keys that are required to access the data. You need to restrict access to the Azure AD group. Which role-based access control should you use?

   • ADocumentDB Accounts Contributor
   • BCosmos Backup Operator
   • CCosmos DB Operator
   • DCosmos DB Account Reader

   Show answer

   Answer: C

   Explanation

   Correct Answer: C DocumentDB Account Contributor: Can manage Azure Cosmos DB accounts. Cosmos Backup Operator: Can submit a restore request for Azure portal for a periodic backup enabled database or a container. Can modify the backup interval and retention on the Azure portal. Cannot access any data or use Data Explorer. Cosmos DB Operator: Can provision Azure Cosmos accounts, databases, and containers. Cannot access any data or use Data Explorer. Cosmos DB Account Reader: Can read Azure Cosmos DB account data. CosmosRestoreOperator: Can perform restore action for Azure Cosmos DB account with continuous backup mode. Reference: https://docs.microsoft.com/en-us/azure/cosmos-db/role-based-access-control

   Source: Adapted from community discussion — mlantonis

   References

   • Microsoft Learn
   • Microsoft Learn
   • azure.microsoft.com documentation

   Next question

5. Question 255 · 462 in bank

   Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You are developing a medical records document management website. The website is used to store scanned copies of patient intake forms. If the stored intake forms are downloaded from storage by a third party, the contents of the forms must not be compromised. You need to store the intake forms according to the requirements. Solution: 1. Create an Azure Key Vault key named skey. 2. Encrypt the intake forms using the public key portion of skey. 3. Store the encrypted data in Azure Blob storage. Does the solution meet the goal?

   • AYes
   • BNo

   Show answer

   Answer: A

   Explanation

   The answer is right, but not good. Because we should use symmetric key to encrypt file, instead of public key. The best practise is: encrypt file by symmetric key, and the symmetric key is protected by public key.

   Source: Adapted from community discussion — bingohah

   Next question

6. Question 256 · 462 in bank

   Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You are developing a medical records document management website. The website is used to store scanned copies of patient intake forms. If the stored intake forms are downloaded from storage by a third party, the contents of the forms must not be compromised. You need to store the intake forms according to the requirements. Solution: 1. Create an Azure Cosmos DB database with Storage Service Encryption enabled. 2. Store the intake forms in the Azure Cosmos DB database. Does the solution meet the goal?

   • AYes
   • BNo

   Show answer

   Answer: B

   Explanation

   I think the rationale is Azure Cosmos is not the best place to store blob data, like scanned patient intake forms. https://stackoverflow.com/questions/49343675/how-can-i-store-images-in-azure-cosmos-db

   Source: Adapted from community discussion — cbn

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

7. Question 257 · 462 in bank

   Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You are developing a medical records document management website. The website is used to store scanned copies of patient intake forms. If the stored intake forms are downloaded from storage by a third party, the contents of the forms must not be compromised. You need to store the intake forms according to the requirements. Solution: Store the intake forms as Azure Key Vault secrets. Does the solution meet the goal?

   • AYes
   • BNo

   Show answer

   Answer: B

   Explanation

   Correct Answer: B - No You'd definitely not want to store "data" in Azure Key Vault. Instead use an Azure Key vault and public key encryption. Store the encrypted from in Azure Storage Blob storage.

   Source: Adapted from community discussion — mlantonis

   Next question

8. Question 258 · 462 in bank

   HOTSPOT - You plan to deploy a new application to a Linux virtual machine (VM) that is hosted in Azure. The entire VM must be secured at rest by using industry-standard encryption technology to address organizational security and compliance requirements. You need to configure Azure Disk Encryption for the VM. How should you complete the Azure CLI commands? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Box 1: keyvault - Create an Azure Key Vault with az keyvault create and enable the Key Vault for use with disk encryption. Specify a unique Key Vault name for keyvault_name as follows: keyvault_name=myvaultname$RANDOM az keyvault create \ --name $keyvault_name \ --resource-group $resourcegroup \ --location eastus \ --enabled-for-disk-encryption True Box 2: keyvault key - The Azure platform needs to be granted access to request the cryptographic keys when the VM boots to decrypt the virtual disks. Create a cryptographic key in your Key Vault with az keyvault key create. The following example creates a key named myKey: az keyvault key create \ --vault-name $keyvault_name \ --name myKey \ --protection software Box 3: vm - Create a VM with az vm create. Only certain marketplace images support disk encryption. The following example creates a VM named myVM using an Ubuntu 16.04 LTS image: az vm create \ --resource-group $resourcegroup \ --name myVM \ --image Canonical:UbuntuServer:16.04-LTS:latest \ --admin-username azureuser \ --generate-ssh-keys \ Box 4: vm encryption - Encrypt your VM with az vm encryption enable: az vm encryption enable \ --resource-group $resourcegroup \ --name myVM \ --disk-encryption-keyvault $keyvault_name \ --key-encryption-key myKey \ --volume-type all Note: seems to an error in the question. Should have enable instead of create. Box 5: all - Encrypt both data and operating system. Reference: https://docs.microsoft.com/en-us/azure/virtual-machines/linux/disk-encryption-cli-quickstart

   Source: Adapted from community discussion — Tom87

   References

   • Microsoft Learn

   

   Next question

9. Question 259 · 462 in bank

   Your company is developing an Azure API hosted in Azure. You need to implement authentication for the Azure API to access other Azure resources. You have the following requirements: ✑ All API calls must be authenticated. ✑ Callers to the API must not send credentials to the API. Which authentication mechanism should you use?

   • ABasic
   • BAnonymous
   • CManaged identity
   • DClient certificate

   Show answer

   Answer: C

   Explanation

   Another pointless requirement made up with some answer in mind and it is impossible to guess what the Microsoft guy had in his mind at that point in time (of course nobody reviews relevance of the questions once created). The requirement that the credentials are not sent is weird. It depends on whether a client certificate is seen as a credential. That gets in conflict with whether the API is called from a client that does not have a managed identity. For example, from postman or curl or a Single Page Application. You cannot use Managed identity in that case. So, depending on how much an unfortunate question taker knows there is 50% chance (excuse my probability knowledge) that he can make a mistake or not. Microsoft guy wins

   Source: Adapted from community discussion — gmishra88

   References

   • Microsoft Learn

   Next question

10. Question 260 · 462 in bank

    DRAG DROP - You are developing an application. You have an Azure user account that has access to two subscriptions. You need to retrieve a storage account key secret from Azure Key Vault. In which order should you arrange the PowerShell commands to develop the solution? To answer, move all commands from the list of commands to the answer area and arrange them in the correct order. Select and Place:

    

    This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

    Show the answer figure

    Answer: See figure below

    Explanation

    Step 1: Get-AzSubscription - If you have multiple subscriptions, you might have to specify the one that was used to create your key vault. Enter the following to see the subscriptions for your account: Get-AzSubscription - Step 2: Set-AzContext -SubscriptionId To specify the subscription that's associated with the key vault you'll be logging, enter: Set-AzContext -SubscriptionId <subscriptionID> Step 3: Get-AzStorageAccountKey - You must get that storage account key. Step 4: $secretvalue = ConvertTo-SecureString <storageAccountKey> -AsPlainText -Force Set-AzKeyVaultSecret -VaultName <vaultName> -Name <secretName> -SecretValue $secretvalue After retrieving your secret (in this case, your storage account key), you must convert that key to a secure string, and then create a secret with that value in your key vault. Step 5: Get-AzKeyVaultSecret - Next, get the URI for the secret you created. You'll need this URI in a later step to call the key vault and retrieve your secret. Run the following PowerShell command and make note of the ID value, which is the secret's URI: Get-AzKeyVaultSecret ג€"VaultName <vaultName> Reference: https://docs.microsoft.com/bs-latn-ba/Azure/key-vault/key-vault-key-rotation-log-monitoring

    Source: Adapted from community discussion — Frakandel

    References

    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn

    

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

AZ-204 practice, question 251. 462 questions available.