AZ-204 practice questions 311–320

1. Question 311 · 462 in bank

   DRAG DROP - You are developing an Azure solution. You need to develop code to access a secret stored in Azure Key Vault. How should you complete the code segment? To answer, drag the appropriate code segments to the correct location. Each code segment may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   References

   • Microsoft Learn
   • Microsoft Learn

   

   Next question

2. Question 312 · 462 in bank

   HOTSPOT - You are a developer building a web site using a web app. The web site stores configuration data in Azure App Configuration. Access to Azure App Configuration has been configured to use the identity of the web app for authentication. Security requirements specify that no other authentication systems must be used. You need to load configuration data from Azure App Configuration. How should you complete the code? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   I think it should be ManagedIdentityCredential: ManagedIdentityCredential: attempts to authenticate using a managed identity that is assigned to the deployment environment (if any). DefaultAzureCredential can not be, since only one type of authentication is allowed. ChainedTokenCredential could work if there is only one authentication type is specified in code. Source: https://yourazurecoach.com/2020/08/13/managed-identity-simplified-with-the-new-azure-net-sdks/

   Source: Adapted from community discussion — Taschiloge

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

3. Question 313 · 462 in bank

   Select 2

   You are developing several microservices to deploy to a new Azure Kubernetes Service cluster. The microservices manage data stored in Azure Cosmos DB and Azure Blob storage. The data is secured by using customer-managed keys stored in Azure Key Vault. You must automate key rotation for all Azure Key Vault keys and allow for manual key rotation. Keys must rotate every three months. Notifications of expiring keys must be sent before key expiry. You need to configure key rotation and enable key expiry notifications. Which two actions should you perform? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.

   • ACreate and configure a new Azure Event Grid instance.
   • BConfigure Azure Key Vault alerts.
   • CCreate and assign an Azure Key Vault access policy.
   • DCreate and configure a key rotation policy during key creation.

   Show answer

   Answer: AD

   Explanation

   B & D To configure key rotation and enable key expiry notifications for Azure Key Vault, you should perform the following two actions: B. Configure Azure Key Vault alerts: Configure alerts for when a key is expiring, so that you can receive notifications before the key expiry. You can configure these alerts in Azure Key Vault using Azure Monitor, which sends an email or a webhook notification to a recipient or service when the key is about to expire. You can specify the notification threshold in terms of days, so you can receive alerts, for example, seven days before the key expiry. C. Create and assign an Azure Key Vault access policy: Create and assign an access policy for your Azure Key Vault that allows your microservices to perform key rotations manually, and automated key rotations using a key rotation script. You can create and assign access policies for Azure Key Vault through the Azure portal or the Azure CLI. These actions enable you to configure key rotation and notifications for key expiry.

   Source: Adapted from community discussion — paunski7

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

4. Question 314 · 462 in bank

   Select 3

   You are developing a web application that uses the Microsoft identity platform to authenticate users and resources. The web application calls several REST APIs. The APIs require an access token from the Microsoft identity platform. You need to request a token. Which three properties should you use? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.

   • ARedirect URI/URL
   • BApplication ID
   • CApplication name
   • DApplication secret
   • ESupported account type

   Show answer

   Answer: ABD

   Explanation

   I got this question on my exam, 2023Dec, go with what I remember was the most voted answer. Score 902, most of the questions were here, slightly different on wording because the Azure Ad Entra Id change. Case was City Power & Light. Good luck! Important tip, you have access to microsoft learn during the exam!

   Source: Adapted from community discussion — CarlosTheBoldest

   References

   • Microsoft Learn

   Next question

5. Question 315 · 462 in bank

   HOTSPOT - You are developing an application that uses Azure Storage to store customer data. The data must only be decrypted by the customer and the customer must be provided a script to rotate keys. You need to provide a script to rotate keys to the customer. How should you complete the command? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   References

   • Microsoft Learn
   • Microsoft Learn

   

   Next question

6. Question 316 · 462 in bank

   You are developing several Azure API Management (APIM) hosted APIs. You must transform the APIs to hide private backend information and obscure the technology stack used to implement the backend processing. You need to protect all APIs. What should you do?

   • AConfigure and apply a new inbound policy scoped to a product.
   • BConfigure and apply a new outbound policy scoped to the operation.
   • CConfigure and apply a new outbound policy scoped to global.
   • DConfigure and apply a new backend policy scoped to global.

   Show answer

   Answer: C

   Explanation

   To safeguard private backend information and mask the underlying technology stack utilized in the backend processes of your Azure API Management (APIM) hosted APIs, implement and apply a fresh global-scoped outbound policy. This policy will uniformly apply the necessary transformations and concealments to the responses of all APIs within your APIM instance, ensuring a consistent approach to securing backend details and technology stack disclosure. So C

   Source: Adapted from community discussion — tempacc4nk

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

7. Question 317 · 462 in bank

   HOTSPOT - You are developing an Azure Function App named App1. You also plan to use cross-origin requests (CORS). You have the following requirements: • App1 functions must securely access an Azure Blob Storage account. • Access to the Azure Blob Storage account must not require the provisioning or rotation of secrets. • JavaScript code running in a browser on an external host must not be allowed to interact with the function. You need to implement App1. Which configuration should you use? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   System Managed Identity: System managed identities are tied to your Azure service and are automatically cleaned up when the resource is deleted. They are easier to use if your application only needs to authenticate to services that support Azure AD authentication. Configure CORS allowed origins to none: To disallow JavaScript code running in a browser on an external host from interacting with the function, you should not include that host in your CORS policy. Configuring CORS allowed origins to none will prevent any domain from accessing your function app.

   Source: Adapted from community discussion — 130nk3r5

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

8. Question 318 · 462 in bank

   HOTSPOT - You develop a containerized application. The application must be deployed to an existing Azure Kubernetes Service (AKS) cluster from an Azure Container Registry (ACR) instance. You use the Azure command-line interface (Azure CLI) to deploy the application image to AKS. Images must be pulled from the registry. You must be able to view all registries within the current Azure subscription. Authentication must be managed by Microsoft Entra ID and removed when the registry is deleted. The solution must use the principle of least privilege. You need to configure authentication to the registry. Which authentication configuration should you use? To answer, select the appropriate configuration values in the answer area, NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Authentication: System-assigned managed identity Role: Reader Only the 'Reader' role has access to 'Access Resource Manager' which is required to get a list of registries. This is aligned with "You must be able to view all registries within the current Azure subscription.". Reference: https://learn.microsoft.com/en-us/azure/container-registry/container-registry-roles?tabs=azure-cli#pull-image

   Source: Adapted from community discussion — KevinZeng

   References

   • Microsoft Learn
   • Microsoft Learn

   

   Next question

9. Question 319 · 462 in bank

   Select 3

   Case study - This is a case study. Case studies are not timed separately. You can use as much exam time as you would like to complete each case. However, there may be additional case studies and sections on this exam. You must manage your time to ensure that you are able to complete all questions included on this exam in the time provided. To answer the questions included in a case study, you will need to reference information that is provided in the case study. Case studies might contain exhibits and other resources that provide more information about the scenario that is described in the case study. Each question is independent of the other questions in this case study. At the end of this case study, a review screen will appear. This screen allows you to review your answers and to make changes before you move to the next section of the exam. After you begin a new section, you cannot return to this section. To start the case study - To display the first question in this case study, click the Next button. Use the buttons in the left pane to explore the content of the case study before you answer the questions. Clicking these buttons displays information such as business requirements, existing environment, and problem statements. When you are ready to answer a question, click the Question button to return to the question. Background - Munson’s Pickles and Preserves Farm is an agricultural cooperative corporation based in Washington, US, with farms located across the United States. The company supports agricultural production resources by distributing seeds fertilizers, chemicals, fuel, and farm machinery to the farms. Current Environment - The company is migrating all applications from an on-premises datacenter to Microsoft Azure. Applications support distributors, farmers, and internal company staff. Corporate website - • The company hosts a public website located at http://www.munsonspicklesandpreservesfarm.com. The site supports farmers and distributors who request agricultural production resources. Farms - • The company created a new customer tenant in the Microsoft Entra admin center to support authentication and authorization for applications. Distributors - • Distributors integrate their applications with data that is accessible by using APIs hosted at http://www.munsonspicklesandpreservesfarm.com/api to receive and update resource data. Requirements - The application components must meet the following requirements: Corporate website - • The site must be migrated to Azure App Service. • Costs must be minimized when hosting in Azure. • Applications must automatically scale independent of the compute resources. • All code changes must be validated by internal staff before release to production. • File transfer speeds must improve, and webpage-load performance must increase. • All site settings must be centrally stored, secured without using secrets, and encrypted at rest and in transit. • A queue-based load leveling pattern must be implemented by using Azure Service Bus queues to support high volumes of website agricultural production resource requests. Farms - • Farmers must authenticate to applications by using Microsoft Entra ID. Distributors - • The company must track a custom telemetry value with each API call and monitor performance of all APIs. • API telemetry values must be charted to evaluate variations and trends for resource data. Internal staff - • App and API updates must be validated before release to production. • Staff must be able to select a link to direct them back to the production app when validating an app or API update. • Staff profile photos and email must be displayed on the website once they authenticate to applications by using their Microsoft Entra ID. Security - • All web communications must be secured by using TLS/HTTPS. • Web content must be restricted by country/region to support corporate compliance standards. • The principle of least privilege must be applied when providing any user rights or process access rights. • Managed identities for Azure resources must be used to authenticate services that support Microsoft Entra ID authentication. Issues - Corporate website - • Farmers report HTTP 503 errors at the same time as internal staff report that CPU and memory usage are high. • Distributors report HTTP 502 errors at the same time as internal staff report that average response times and networking traffic are high. • Internal staff report webpage load sizes are large and take a long time to load. • Developers receive authentication errors to Service Bus when they debug locally. Distributors - • Many API telemetry values are sent in a short period of time. Telemetry traffic, data costs, and storage costs must be reduced while preserving a statistically correct analysis of the data points sent by the APIs. You need to implement farmer authentication. Which three actions should you perform? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.

   • AAdd the shared access signature (SAS) token to the app.
   • BCreate a shared access signature (SAS) token.
   • CCreate a user flow.
   • DAdd the app to the user flow.
   • ERegister the app in Microsoft Entra ID.

   Show answer

   Answer: CDE

   Explanation

   Create a user flow (Option C): This step is necessary to define how farmers will authenticate and possibly manage their profiles. Add the app to the user flow (Option D): Essential for integrating the user flow with the application, ensuring the app utilizes the defined authentication process. Register the app in Microsoft Entra ID (Option E): A fundamental step to allow the application to use Microsoft Entra ID for authentication.

   Source: Adapted from community discussion — FeriAZ

   References

   • Microsoft Learn

   Next question

10. Question 320 · 462 in bank

    DRAG DROP - You are developing an ASP.NET Core website that can be used to manage photographs which are stored in Azure Blob Storage containers. Users of the website authenticate by using their Azure Active Directory (Azure AD) credentials. You implement role-based access control (RBAC) role permissions on the containers that store photographs. You assign users to RBAC roles. You need to configure the website's Azure AD Application so that user's permissions can be used with the Azure Blob containers. How should you configure the application? To answer, drag the appropriate setting to the correct location. Each setting can be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content. NOTE: Each correct selection is worth one point. Select and Place:

    

    This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

    Show the answer figure

    Answer: See figure below

    Explanation

    Box 1: user_impersonation - Box 2: delegated - Example: 1. Select the API permissions section 2. Click the Add a permission button and then: Ensure that the My APIs tab is selected 3. In the list of APIs, select the API TodoListService-aspnetcore. 4. In the Delegated permissions section, ensure that the right permissions are checked: user_impersonation. 5. Select the Add permissions button. Box 3: delegated - Example - 1. Select the API permissions section 2. Click the Add a permission button and then, Ensure that the Microsoft APIs tab is selected 3. In the Commonly used Microsoft APIs section, click on Microsoft Graph 4. In the Delegated permissions section, ensure that the right permissions are checked: User.Read. Use the search box if necessary. 5. Select the Add permissions button Reference: https://docs.microsoft.com/en-us/samples/azure-samples/active-directory-dotnet-webapp-webapi-openidconnect-aspnetcore/calling-a-web-api-in-an-aspnet-core- web-application-using-azure-ad/

    Source: Adapted from community discussion — mlantonis

    References

    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn

    

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

AZ-204 practice, question 311. 462 questions available.