AZ-204 practice questions 281–290

1. Question 281 · 462 in bank

   HOTSPOT - You have an Azure Web app that uses Cosmos DB as a data store. You create a CosmosDB container by running the following PowerShell script: $resourceGroupName = "testResourceGroup" $accountName = "testCosmosAccount" $databaseName = "testDatabase" $containerName = "testContainer" $partitionKeyPath = "/EmployeeId" $autoscaleMaxThroughput = 5000 New-AzCosmosDBSqlContainer - -ResourceGroupName $resourceGroupName -AccountName $accountName -DatabaseName $databaseName -Name $containerName -PartitionKeyKind Hash -PartitionKeyPath $partitionKeyPath -AutoscaleMaxThroughput $autoscaleMaxThroughput You create the following queries that target the container: SELECT * FROM c WHERE c.EmployeeId > '12345' SELECT * FROM c WHERE c.UserID = '12345' For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point. Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Box 1: No - You set the highest, or maximum RU/s Tmax you don't want the system to exceed. The system automatically scales the throughput T such that 0.1* Tmax <= T <= Tmax. In this example we have autoscaleMaxThroughput = 5000, so the minimum throughput for the container is 500 R/Us. Box 2: No - First query: SELECT * FROM c WHERE c.EmployeeId > '12345' Here's a query that has a range filter on the partition key and won't be scoped to a single physical partition. In order to be an in-partition query, the query must have an equality filter that includes the partition key: SELECT * FROM c WHERE c.DeviceId > 'XMS-0001' Box 3: Yes - Example of In-partition query: Consider the below query with an equality filter on DeviceId. If we run this query on a container partitioned on DeviceId, this query will filter to a single physical partition. SELECT * FROM c WHERE c.DeviceId = 'XMS-0001' Reference: https://docs.microsoft.com/en-us/azure/cosmos-db/how-to-choose-offer https://docs.microsoft.com/en-us/azure/cosmos-db/how-to-query-container

   Source: Adapted from community discussion — aradice

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

2. Question 282 · 462 in bank

   HOTSPOT - You are developing a web application that makes calls to the Microsoft Graph API. You register the application in the Azure portal and upload a valid X509 certificate. You create an appsettings.json file containing the certificate name, client identifier for the application, and the tenant identifier of the Azure Active Directory (Azure AD). You create a method named ReadCertificate to return the X509 certificate by name. You need to implement code that acquires a token by using the certificate. How should you complete the code segment? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Box 1: ConfidentialClientApplicationBuilder Here's the code to instantiate the confidential client application with a client secret: app = ConfidentialClientApplicationBuilder.Create(config.ClientId) .WithClientSecret(config.ClientSecret) .WithAuthority(new Uri(config.Authority)) .Build(); Box 2: scopes - After you've constructed a confidential client application, you can acquire a token for the app by calling AcquireTokenForClient, passing the scope, and optionally forcing a refresh of the token. Sample code: result = await app.AcquireTokenForClient(scopes) .ExecuteAsync(); Reference: https://docs.microsoft.com/en-us/azure/active-directory/develop/scenario-daemon-app-configuration https://docs.microsoft.com/en-us/azure/active-directory/develop/scenario-daemon-acquire-token

   References

   • Microsoft Learn
   • Microsoft Learn

   

   Next question

3. Question 283 · 462 in bank

   HOTSPOT - You develop a containerized application. You plan to deploy the application to a new Azure Container instance by using a third-party continuous integration and continuous delivery (CI/CD) utility. The deployment must be unattended and include all application assets. The third-party utility must only be able to push and pull images from the registry. The authentication must be managed by Azure Active Directory (Azure AD). The solution must use the principle of least privilege. You need to ensure that the third-party utility can access the registry. Which authentication options should you use? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Box 1: Service principal - Applications and container orchestrators can perform unattended, or "headless," authentication by using an Azure Active Directory (Azure AD) service principal. Incorrect Answers: ✑ Individual AD identity does not support unattended push/pull ✑ Repository-scoped access token is not integrated with AD identity ✑ Managed identity for Azure resources is used to authenticate to an Azure container registry from another Azure resource. Box 2: AcrPush - AcrPush provides pull/push permissions only and meets the principle of least privilege. Incorrect Answers: AcrPull only allows pull permissions it does not allow push permissions. ✑ Owner and Contributor allow pull/push permissions but does not meet the principle of least privilege. Reference: https://docs.microsoft.com/en-us/azure/container-registry/container-registry-authentication?tabs=azure-cli https://docs.microsoft.com/en-us/azure/container-registry/container-registry-roles?tabs=azure-cli

   Source: Adapted from community discussion — dtctx

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

4. Question 284 · 462 in bank

   You deploy an Azure App Service web app. You create an app registration for the app in Azure Active Directory (Azure AD) and Twitter. The app must authenticate users and must use SSL for all communications. The app must use Twitter as the identity provider. You need to validate the Azure AD request in the app code. What should you validate?

   • AID token header
   • BID token signature
   • CHTTP response code
   • DTenant ID

   Show answer

   Answer: B

   Explanation

   To validate the Azure AD request in the app code when using Twitter as the identity provider, you should validate the ID token signature (option B). The ID token is a JSON Web Token (JWT) that contains claims about the user. It is signed by Azure AD using a private key, and the signature can be verified using the corresponding public key. Validating the ID token signature ensures that the token was issued by a trusted source and that it has not been tampered with in transit. Option A, validating the ID token header, is not sufficient for validating the entire ID token. The header only contains metadata about the token, such as the algorithm used for signing. Option C, validating the HTTP response code, is unrelated to validating the ID token. Option D, validating the tenant ID, is important for ensuring that the app is only accepting tokens from a trusted Azure AD tenant, but it does not ensure the integrity of the token itself.

   Source: Adapted from community discussion — RaghavMGupta

   References

   • Microsoft Learn

   Next question

5. Question 285 · 462 in bank

   A development team is creating a new REST API. The API will store data in Azure Blob storage. You plan to deploy the API to Azure App Service. Developers must access the Azure Blob storage account to develop the API for the next two months. The Azure Blob storage account must not be accessible by the developers after the two-month time period. You need to grant developers access to the Azure Blob storage account. What should you do?

   • AGenerate a shared access signature (SAS) for the Azure Blob storage account and provide the SAS to all developers.
   • BCreate and apply a new lifecycle management policy to include a last accessed date value. Apply the policy to the Azure Blob storage account.
   • CProvide all developers with the access key for the Azure Blob storage account. Update the API to include the Coordinated Universal Time (UTC) timestamp for the request header.
   • DGrant all developers access to the Azure Blob storage account by assigning role-based access control (RBAC) roles.

   Show answer

   Answer: A

   Explanation

   A. Generate a shared access signature (SAS) for the Azure Blob storage account and provide the SAS to all developers. A shared access signature (SAS) is a secure token that can be used to grant temporary and revocable access to a blob container or individual blobs. You can specify an expiration time for the SAS, so it will automatically expire after the two-month time period, making the blob storage account no longer accessible to the developers. This approach allows you to grant the developers the necessary access to the Azure Blob storage account while still maintaining control over the access, and it also allows you to revoke access easily after the two-month time period.

   Source: Adapted from community discussion — alexein74

   References

   • Microsoft Learn
   • Microsoft Learn
   • azure.microsoft.com documentation

   Next question

6. Question 286 · 462 in bank

   DRAG DROP - You develop a web application. You need to register the application with an active Azure Active Directory (Azure AD) tenant. Which three actions should you perform in sequence? To answer, move all actions from the list of actions to the answer area and arrange them in the correct order. Select and Place:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   1 Azure AD instance 2 In App Registration, select new registration 3 Create a new application and provide the name Disscussion: https://www.examtopics.com/discussions/microsoft/view/22224-exam-az-204-topic-3-question-3-discussion/

   Source: Adapted from community discussion — Komat

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

7. Question 287 · 462 in bank

   Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You are developing a website that will run as an Azure Web App. Users will authenticate by using their Azure Active Directory (Azure AD) credentials. You plan to assign users one of the following permission levels for the website: admin, normal, and reader. A user's Azure AD group membership must be used to determine the permission level. You need to configure authorization. Solution: ✑ Create a new Azure AD application. In the application's manifest, define application roles that match the required permission levels for the application. ✑ Assign the appropriate Azure AD group to each role. In the website, use the value of the roles claim from the JWT for the user to determine permissions. Does the solution meet the goal?

   • AYes
   • BNo

   Show answer

   Answer: A

   Explanation

   I agree that this solution should work as well. The roles get assigned by AD groups, so the requirement "A user's Azure AD group membership must be used to determine the permission level" is met. This solution should be answered with "yes". This scenario has 2 solutions provided as the approach using the "groupMembershipClaims" is possible as well. That's OK as it says "Some question sets might have more than one correct solution, while others might not have a correct solution."

   Source: Adapted from community discussion — [Removed]

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

8. Question 288 · 462 in bank

   Select 2

   You have a new Azure subscription. You are developing an internal website for employees to view sensitive data. The website uses Azure Active Directory (Azure AD) for authentication. You need to implement multifactor authentication for the website. Which two actions should you perform? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.

   • AConfigure the website to use Azure AD B2C.
   • BIn Azure AD, create a new conditional access policy.
   • CUpgrade to Azure AD Premium.
   • DIn Azure AD, enable application proxy.
   • EIn Azure AD conditional access, enable the baseline policy.

   Show answer

   Answer: BC

   Explanation

   Correct Answer: B and C Azure AD Multi-Factor Authentication and Conditional Access policies give the flexibility to enable MFA for users during specific sign-in events. The recommended way to enable and use Azure AD Multi-Factor Authentication is with Conditional Access policies. You need a working Azure AD tenant with at least an Azure AD Premium P1. Reference: https://docs.microsoft.com/en-us/azure/active-directory/authentication/howto-mfa-getstarted https://docs.microsoft.com/en-us/azure/active-directory/authentication/tutorial-enable-azure-mfa https://azure.microsoft.com/en-us/pricing/details/active-directory

   Source: Adapted from community discussion — mlantonis

   References

   • Microsoft Learn
   • Microsoft Learn
   • azure.microsoft.com documentation
   • Microsoft Learn
   • Microsoft Learn

   Next question

9. Question 289 · 462 in bank

   DRAG DROP - An organization plans to deploy Azure storage services. You need to configure shared access signature (SAS) for granting access to Azure Storage. Which SAS types should you use? To answer, drag the appropriate SAS types to the correct requirements. Each SAS type may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content. NOTE: Each correct selection is worth one point. Select and Place:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Reference: https://docs.microsoft.com/en-us/azure/storage/common/storage-sas-overview

   Source: Adapted from community discussion — kvtborad

   

   Next question

10. Question 290 · 462 in bank

    HOTSPOT - You are developing an ASP.NET Core app that includes feature flags which are managed by Azure App Configuration. You create an Azure App Configuration store named AppFeatureflagStore as shown in the exhibit:

    

    You must be able to use the feature in the app by using the following markup:

    

    You need to update the app to use the feature flag. Which values should you use? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Hot Area:

    

    This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

    Show the answer figure

    Answer: See figure below

    Explanation

    Box 1: FeatureGate - You can use the FeatureGate attribute to control whether a whole controller class or a specific action is enabled. Box 2: AddAzureAppConfiguration - The extension method AddAzureAppConfiguration is used to add the Azure App Configuration Provider. Box 3: https://appfeatureflagstore.azconfig.io You need to request the access token with resource=https://<yourstorename>.azconfig.io Reference: https://docs.microsoft.com/en-us/azure/azure-app-configuration/use-feature-flags-dotnet-core https://csharp.christiannagel.com/2020/05/19/azureappconfiguration/ https://stackoverflow.com/questions/61899063/how-to-use-azure-app-configuration-rest-api

    References

    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn

    

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

AZ-204 practice, question 281. 462 questions available.