AZ-204 practice questions 301–310

1. Question 301 · 462 in bank

   HOTSPOT - You are building an application that stores sensitive customer data in Azure Blob storage. The data must be encrypted with a key that is unique for each customer. If the encryption key has been corrupted it must not be used for encryption. You need to ensure that the blob is encrypted. How should you complete the code segment? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Box 1: CustomerProvidedKey(key) The data must be encrypted with a key that is unique for each customer. Sample code: async static Task UploadBlobWithClientKey(Uri blobUri, Stream data, byte[] key, string keySha256) { // Create a new customer-provided key. // Key must be AES-256. var cpk = new CustomerProvidedKey(key); Box 2: Encryption - CustomerProvidedKey.EncryptionKey Property Sample code continued: // Check the key's encryption hash. if (cpk.EncryptionKeyHash != keySha256) { throw new InvalidOperationException("The encryption key is corrupted."); } Box 3: CustomerProvidedKey - Sample code continued; // Specify the customer-provided key on the options for the client. BlobClientOptions options = new BlobClientOptions() { CustomerProvidedKey = cpk - }; // Create the client object with options specified. BlobClient blobClient = new BlobClient( blobUri, new DefaultAzureCredential(), options); Incorrect: * Version - Gets the BlobClientOptions.ServiceVersion of the service API used when making requests. Transport - The HttpPipelineTransport to be used for this client. Reference: https://docs.microsoft.com/en-us/azure/storage/blobs/storage-blob-customer-provided-key

   Source: Adapted from community discussion — Ciupaz

   References

   • Microsoft Learn
   • Microsoft Learn

   

   Next question

2. Question 302 · 462 in bank

   HOTSPOT - You are developing a web application that uses the Microsoft Identity platform for user and resource authentication. The web application called several REST APIs. You are implementing various authentication and authorization flows for the web application. You need to validate the claims in the authentication token. Which token type should you use? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   How to remember: 1) Identify users -> ID (ID of the user) 2) Permissions -> Access (how to access? with permissions) 3) Without interactions -> Refresh (with refresh, there is no interaction) 4) Provide XML -> SAML (similar in writing)

   Source: Adapted from community discussion — Ciupaz

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

3. Question 303 · 462 in bank

   HOTSPOT - You are developing a content management application for technical manuals. The application is deployed as an Azure Static Web app. Authenticated users can view pages under/manuals but only contributors can access the page /manuals/new.html. You need to configure the routing for the web app. How should you complete the configuration? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Correct. "Rule evaluation stops at the first match. A match occurs when the route property and a value in the methods array (if specified) match the request. Each request can match at most one rule." So the first rule must be for the /manuals/new.html page. https://learn.microsoft.com/en-us/azure/static-web-apps/configuration#routes

   Source: Adapted from community discussion — 2fa

   References

   • Microsoft Learn

   

   Next question

4. Question 304 · 462 in bank

   You are developing a web application that uses the Microsoft identity platform for user and resource authentication. The web application calls several REST APIs. A REST API call must read the user’s calendar. The web application requires permission to send an email as the user. You need to authorize the web application and the API. Which parameter should you use?

   • Atenant
   • Bcode_challenge
   • Cstate
   • Dclient_id
   • Escope

   Show answer

   Answer: E

   Explanation

   E. scope Scope is the parameter used to specify the permissions that the web application is requesting to access the user's resources, such as the calendar and the ability to send an email as the user. The scope parameter is typically included in the API call or in the authorization request sent to the Microsoft identity platform.

   Source: Adapted from community discussion — alexein74

   References

   • Microsoft Learn
   • Microsoft Learn

   Next question

5. Question 305 · 462 in bank

   HOTSPOT - You develop and deploy a web app to Azure App service. The web app allows users to authenticate by using social identity providers through the Azure B2C service. All user profile information is stored in Azure B2C. You must update the web app to display common user properties from Azure B2C to include the following information: • Email address • Job title • First name • Last name • Office location You need to implement the user properties in the web app. Which code library and API should you use? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   References

   • Microsoft Learn
   • Microsoft Learn

   

   Next question

6. Question 306 · 462 in bank

   HOTSPOT - You develop and deploy the following staticwebapp.config.json file to the app_location value specified in the workflow file of an Azure Static Web app:

   

   For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   It should be: 1. N In the example written here: https://learn.microsoft.com/en-us/azure/static-web-apps/configuration#example-configuration-file - If you go to the login page, you redirect to Github, just like in the question. - If the request got a 401 error (Unauthorized), it redirects the user to the login route (with 302 response), which then redirects to the GitHub login. But in this question, if you check what happens when the request got a 401 error (Unauthorized), it redirects to the AAD route (with 302 response), not to Github. So this part of the question and the example are different. 2. Y That part of the question seems the same as the example above. A non-existent file in the /images/ folder -> A 404 error. 3. Y That part of the question seems the same as the example above. GET requests from authenticated users in the registeredusers role are sent to the API. Authenticated users not in the registeredusers role and unauthenticated users are served a 401 error. 4. N It overrides the 401 error to the 302 and redirects the user to the AAD URL.

   Source: Adapted from community discussion — drkpnsh

   References

   • Microsoft Learn

   

   Next question

7. Question 307 · 462 in bank

   You develop and deploy an Azure App Service web app named App1. You create a new Azure Key Vault named Vault1. You import several API keys, passwords, certificates, and cryptographic keys into Vault1. You need to grant App1 access to Vault1 and automatically rotate credentials. Credentials must not be stored in code. What should you do?

   • AEnable App Service authentication for Appl. Assign a custom RBAC role to Vault1.
   • BAdd a TLS/SSL binding to App1.
   • CUpload a self-signed client certificate to Vault1. Update App1 to use the client certificate.
   • DAssign a managed identity to App1.

   Show answer

   Answer: D

   Explanation

   D. Assign a managed identity to App1. To grant App1 access to Vault1 and automatically rotate credentials without storing them in code, you should assign a managed identity to App1. Managed identities for Azure resources enable Azure services to authenticate to other Azure resources without needing to manage the authentication details. After you enable a managed identity for App1, you can grant the identity access to Vault1 and use Azure Key Vault's built-in rotation feature to automatically rotate the credentials. Additionally, you can use Azure Key Vault's built-in rotation feature to automatically rotate the credentials.

   Source: Adapted from community discussion — alexein74

   References

   • Microsoft Learn

   Next question

8. Question 308 · 462 in bank

   You are developing a Java application to be deployed in Azure. The application stores sensitive data in Azure Cosmos DB. You need to configure Always Encrypted to encrypt the sensitive data inside the application. What should you do first?

   • ACreate a new container to include an encryption policy with the JSON properties to be encrypted.
   • BCreate a customer-managed key (CMK) and store the key in a new Azure Key Vault instance.
   • CCreate a data encryption key (DEK) by using the Azure Cosmos DB SDK and store the key in Azure Cosmos DB.
   • DCreate an Azure AD managed identity and assign the identity to a new Azure Key Vault instance.

   Show answer

   Answer: B

   Explanation

   B. Create a customer-managed key (CMK) and store the key in a new Azure Key Vault instance. In order to configure Always Encrypted for the Java application, you need to first create a customer-managed key (CMK) using Azure Key Vault. This key will be used to encrypt and decrypt the sensitive data stored in Cosmos DB. After creating the key, you should store it in a new Azure Key Vault instance, which will be used to manage and secure the key. Once you have the key stored in Key vault, you can use Azure Cosmos DB SDK to encrypt the sensitive data and store it in Cosmos DB. It's important to note that Always Encrypted in Azure Cosmos DB is a client-side encryption feature that encrypts and decrypts sensitive data inside the application and not in the Azure Cosmos DB service.

   Source: Adapted from community discussion — alexein74

   References

   • Microsoft Learn
   • Microsoft Learn

   Next question

9. Question 309 · 462 in bank

   Select 2

   You provide an Azure API Management managed web service to clients. The back-end web service implements HTTP Strict Transport Security (HSTS). Every request to the backend service must include a valid HTTP authorization header. You need to configure the Azure API Management instance with an authentication policy. Which two policies can you use? Each correct answer presents a complete solution. NOTE: Each correct selection is worth one point.

   • ABasic Authentication
   • BDigest Authentication
   • CCertificate Authentication
   • DOAuth Client Credential Grant

   Show answer

   Answer: AC

   Explanation

   A, D The question states that the solution MUST use the HTTP authorization header. The only two options that do are Basic Authentication (where the header would be "Authorization: Basic or "Bearer ).

   Source: Adapted from community discussion — hobob

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

10. Question 310 · 462 in bank

    HOTSPOT - You develop a web app that interacts with Azure Active Directory (Azure AD) groups by using Microsoft Graph. You build a web page that shows all Azure AD groups that are not of the type 'Unified'. You need to build the Microsoft Graph query for the page. How should you complete the query? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

    

    This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

    Show the answer figure

    Answer: See figure below

    Explanation

    Not sure since then but now it supports the ne parameter too: "As Microsoft Entra ID continues to deliver more capabilities and improvements in stability, availability, and performance, Microsoft Graph also continues to evolve and scale to efficiently access the data. One way is through Microsoft Graph's increasing support for advanced query capabilities on various Microsoft Entra ID objects, also called directory objects, and their properties. For example, the addition of not (not), not equals (ne), and ends with (endsWith) operators on the $filter query parameter." https://learn.microsoft.com/en-us/graph/aad-advanced-queries?tabs=http#count-of-a-collection-in-a-filter-expression

    Source: Adapted from community discussion — CarlosTheBoldest

    References

    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn

    

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

AZ-204 practice, question 301. 462 questions available.