AZ-204 practice questions 271–280

1. Question 271 · 462 in bank

   You are a developer for a SaaS company that offers many web services. All web services for the company must meet the following requirements: ✑ Use API Management to access the services ✑ Use OpenID Connect for authentication ✑ Prevent anonymous usage A recent security audit found that several web services can be called without any authentication. Which API Management policy should you implement?

   • Ajsonp
   • Bauthentication-certificate
   • Ccheck-header
   • Dvalidate-jwt

   Show answer

   Answer: D

   Explanation

   The correct answer is D. validate-jwt. The validate-jwt policy in Azure API Management allows you to enforce validation of JSON Web Tokens (JWT) from the client as part of the API call. This can be used to ensure that the caller has authenticated with OpenID Connect, as OpenID Connect uses JWTs for its identity tokens. Option A, jsonp, is used for wrapping JSON responses in a JSONP callback function, and does not provide any authentication. Option B, authentication-certificate, is used for client certificate authentication, not OpenID Connect. Option C, check-header, is used for checking the existence of certain headers, and while it could be used to check for the existence of an Authorization header, it would not validate the JWT itself.

   Source: Adapted from community discussion — Vichu_1607

   References

   • Microsoft Learn
   • Microsoft Learn

   Next question

2. Question 272 · 462 in bank

   DRAG DROP - Contoso, Ltd. provides an API to customers by using Azure API Management (APIM). The API authorizes users with a JWT token. You must implement response caching for the APIM gateway. The caching mechanism must detect the user ID of the client that accesses data for a given location and cache the response for that user ID. You need to add the following policies to the policies file: ✑ a set-variable policy to store the detected user identity ✑ a cache-lookup-value policy ✑ a cache-store-value policy ✑ a find-and-replace policy to update the response body with the user profile information To which policy section should you add the policies? To answer, drag the appropriate sections to the correct policies. Each section may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content. NOTE: Each correct selection is worth one point. Select and Place:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Box 1: Inbound. A set-variable policy to store the detected user identity. Example: <policies> <inbound> <!-- How you determine user identity is application dependent --> <set-variable name="enduserid" value="@(context.Request.Headers.GetValueOrDefault("Authorization","").Split(' ')[1].AsJwt()?.Subject)" /> Box 2: Inbound - A cache-lookup-value policy - Example: <inbound> <base /> <cache-lookup vary-by-developer="true | false" vary-by-developer-groups="true | false" downstream-caching-type="none | private | public" must- revalidate="true | false"> <vary-by-query-parameter>parameter name</vary-by-query-parameter> <!-- optional, can repeated several times --> </cache-lookup> </inbound> Box 3: Outbound - A cache-store-value policy. Example: <outbound> <base /> <cache-store duration="3600" /> </outbound> Box 4: Outbound - A find-and-replace policy to update the response body with the user profile information. Example: <outbound> <!-- Update response body with user profile--> <find-and-replace from='"$userprofile$"' to="@((string)context.Variables["userprofile"])" /> <base /> </outbound> Reference: https://docs.microsoft.com/en-us/azure/api-management/api-management-caching-policies https://docs.microsoft.com/en-us/azure/api-management/api-management-sample-cache-by-key

   Source: Adapted from community discussion — mlantonis

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

3. Question 273 · 462 in bank

   DRAG DROP - You are developing an Azure solution. You need to develop code to access a secret stored in Azure Key Vault. How should you complete the code segment? To answer, drag the appropriate code segments to the correct location. Each code segment may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content. NOTE: Each correct selection is worth one point. Select and Place:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Box 1: SecretClient - Box 2: DefaultAzureCredential - In below example, the name of your key vault is expanded to the key vault URI, in the format "https://<your-key-vault-name>.vault.azure.net". This example is using 'DefaultAzureCredential()' class from Azure Identity Library, which allows to use the same code across different environments with different options to provide identity. string keyVaultName = Environment.GetEnvironmentVariable("KEY_VAULT_NAME"); var kvUri = "https://" + keyVaultName + ".vault.azure.net"; var client = new SecretClient(new Uri(kvUri), new DefaultAzureCredential()); Reference: https://docs.microsoft.com/en-us/azure/key-vault/secrets/quick-create-net

   Source: Adapted from community discussion — mlantonis

   References

   • Microsoft Learn

   

   Next question

4. Question 274 · 462 in bank

   Select 2

   You are developing an Azure App Service REST API. The API must be called by an Azure App Service web app. The API must retrieve and update user profile information stored in Azure Active Directory (Azure AD). You need to configure the API to make the updates. Which two tools should you use? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.

   • AMicrosoft Graph API
   • BMicrosoft Authentication Library (MSAL)
   • CAzure API Management
   • DMicrosoft Azure Security Center
   • EMicrosoft Azure Key Vault SDK

   Show answer

   Answer: AB

   Explanation

   Answer is correct. A: Microsoft Graph to retrieve and update user profile info from Azure AD. C: API Management (APIM) Reference: https://docs.microsoft.com/en-us/graph/azuread-identity-access-management-concept-overview https://docs.microsoft.com/en-us/graph/overview https://docs.microsoft.com/en-us/azure/api-management/api-management-key-concepts

   Source: Adapted from community discussion — mlantonis

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

5. Question 275 · 462 in bank

   Select 2

   You develop a REST API. You implement a user delegation SAS token to communicate with Azure Blob storage. The token is compromised. You need to revoke the token. What are two possible ways to achieve this goal? Each correct answer presents a complete solution. NOTE: Each correct selection is worth one point.

   • ARevoke the delegation key.
   • BDelete the stored access policy.
   • CRegenerate the account key.
   • DRemove the role assignment for the security principle.

   Show answer

   Answer: AD

   Explanation

   Answer seems correct. A: Use az storage account revoke-delegation-keys command. B: To revoke a stored access policy, you can either delete it, or rename it by changing the signed identifier. Reference: https://github.com/MicrosoftDocs/azure-docs/blob/master/articles/storage/blobs/storage-blob-user-delegation-sas-create-cli.md https://docs.microsoft.com/en-us/rest/api/storageservices/define-stored-access-policy#modifying-or-revoking-a-stored-access-policy https://docs.microsoft.com/en-us/cli/azure/storage/account?view=azure-cli-latest#az_storage_account_revoke_delegation_keys

   Source: Adapted from community discussion — mlantonis

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

6. Question 276 · 462 in bank

   Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You are developing a website that will run as an Azure Web App. Users will authenticate by using their Azure Active Directory (Azure AD) credentials. You plan to assign users one of the following permission levels for the website: admin, normal, and reader. A user's Azure AD group membership must be used to determine the permission level. You need to configure authorization. Solution: ✑ Create a new Azure AD application. In the application's manifest, set value of the groupMembershipClaims option to All. ✑ In the website, use the value of the groups claim from the JWT for the user to determine permissions. Does the solution meet the goal?

   • AYes
   • BNo

   Show answer

   Answer: A

   Explanation

   Answer – Yes, this is the correct approach. The Application manifest has a setting for groupMembershipClaims. By setting this to all, the Azure AD groups that the user belongs to will be returned as part of the claims in the JWT token.

   Source: Adapted from community discussion — kondapaturi

   References

   • Microsoft Learn

   Next question

7. Question 277 · 462 in bank

   DRAG DROP - You are developing an Azure-hosted application that must use an on-premises hardware security module (HSM) key. The key must be transferred to your existing Azure Key Vault by using the Bring Your Own Key (BYOK) process. You need to securely transfer the key to Azure Key Vault. Which four actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order. Select and Place:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   To perform a key transfer, a user performs following steps: ✑ Generate KEK. ✑ Retrieve the public key of the KEK. ✑ Using HSM vendor provided BYOK tool - Import the KEK into the target HSM and exports the Target Key protected by the KEK. ✑ Import the protected Target Key to Azure Key Vault. Step 1: Generate a Key Exchange Key (KEK). Step 2: Retrieve the Key Exchange Key (KEK) public key. Step 3: Generate a key transfer blob file by using the HSM vendor-provided tool. Generate key transfer blob using HSM vendor provided BYOK tool Step 4: Run the az keyvault key import command Upload key transfer blob to import HSM-key. Customer will transfer the Key Transfer Blob (".byok" file) to an online workstation and then run a az keyvault key import command to import this blob as a new HSM-backed key into Key Vault. To import an RSA key use this command: az keyvault key import Reference: https://docs.microsoft.com/en-us/azure/key-vault/keys/byok-specification

   Source: Adapted from community discussion — mcbc

   References

   • Microsoft Learn

   

   Next question

8. Question 278 · 462 in bank

   You develop and deploy an Azure Logic app that calls an Azure Function app. The Azure Function app includes an OpenAPI (Swagger) definition and uses an Azure Blob storage account. All resources are secured by using Azure Active Directory (Azure AD). The Azure Logic app must securely access the Azure Blob storage account. Azure AD resources must remain if the Azure Logic app is deleted. You need to secure the Azure Logic app. What should you do?

   • ACreate a user-assigned managed identity and assign role-based access controls.
   • BCreate an Azure AD custom role and assign the role to the Azure Blob storage account.
   • CCreate an Azure Key Vault and issue a client certificate.
   • DCreate a system-assigned managed identity and issue a client certificate.
   • ECreate an Azure AD custom role and assign role-based access controls.

   Show answer

   Answer: A

   Explanation

   User-assigned keys are individual components. Even if the logic apps are deleted, the keys remain. But in case of system-assigned keys, those are auto generated and are deleted when the Azure resources themselves are deleted.

   Source: Adapted from community discussion — debanjan10

   References

   • Microsoft Learn

   Next question

9. Question 279 · 462 in bank

   HOTSPOT - You are developing an application that uses a premium block blob storage account. You are optimizing costs by automating Azure Blob Storage access tiers. You apply the following policy rules to the storage account. You must determine the implications of applying the rules to the data. (Line numbers are included for reference only.)

   

   For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point. Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Agree, 4 should be no. Instead of "All block blobs older than 730 days will be deleted", it should be: "all block blobs 730 days after last modified". All info can be found at: https://docs.microsoft.com/en-us/azure/storage/blobs/lifecycle-management-overview?tabs=azure-portal#move-aging-data-to-a-cooler-tier

   Source: Adapted from community discussion — windflower555

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

10. Question 280 · 462 in bank

    Select 2

    You are developing a solution that will use a multi-partitioned Azure Cosmos DB database. You plan to use the latest Azure Cosmos DB SDK for development. The solution must meet the following requirements: ✑ Send insert and update operations to an Azure Blob storage account. ✑ Process changes to all partitions immediately. ✑ Allow parallelization of change processing. You need to process the Azure Cosmos DB operations. What are two possible ways to achieve this goal? Each correct answer presents a complete solution. NOTE: Each correct selection is worth one point.

    • ACreate an Azure App Service API and implement the change feed estimator of the SDK. Scale the API by using multiple Azure App Service instances.
    • BCreate a background job in an Azure Kubernetes Service and implement the change feed feature of the SDK.
    • CCreate an Azure Function to use a trigger for Azure Cosmos DB. Configure the trigger to connect to the container.
    • DCreate an Azure Function that uses a FeedIterator object that processes the change feed by using the pull model on the container. Use a FeedRange object to parallelize the processing of the change feed across multiple functions.

    Show answer

    Answer: CD

    Explanation

    The purpose of the "change feed estimator" is "to monitor the progress of your change feed processor instances as they read the change feed". Just to know if your "change feed processor is lagging behind or not". So C & D.

    Source: Adapted from community discussion — MiraA

    References

    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

AZ-204 practice, question 271. 462 questions available.