AZ-204 practice questions 41–50

1. Question 41 · 462 in bank

   Select 2

   You need to secure the Azure Functions to meet the security requirements. Which two actions should you perform? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.

   • AStore the RSA-HSM key in Azure Key Vault with soft-delete and purge-protection features enabled.
   • BStore the RSA-HSM key in Azure Blob storage with an immutability policy applied to the container.
   • CCreate a free tier Azure App Configuration instance with a new Azure AD service principal.
   • DCreate a standard tier Azure App Configuration instance with an assigned Azure AD managed identity.
   • EStore the RSA-HSM key in Azure Cosmos DB. Apply the built-in policies for customer-managed keys and allowed locations.

   Show answer

   Answer: AD

   Explanation

   All the Case Study information is available to you as you are answering the questions. You can go back and forth between questions and the Case Study information as you like. But after you answer all questions and finish the Case Study, you cannot go back. It's like a mini-exam within the main exam.

   Source: Adapted from community discussion — mmdex

   References

   • Microsoft Learn
   • Microsoft Learn

   Next question

2. Question 42 · 462 in bank

   DRAG DROP - You need to add markup at line AM04 to implement the ContentReview role. How should you complete the markup? To answer, drag the appropriate json segments to the correct locations. Each json segment may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content. NOTE: Each correct selection is worth one point. Select and Place:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Box 1: allowedMemberTypes - allowedMemberTypes specifies whether this app role definition can be assigned to users and groups by setting to "User", or to other applications (that are accessing this application in daemon service scenarios) by setting to "Application", or to both. Note: The following example shows the appRoles that you can assign to users. "appId": "8763f1c4-f988-489c-a51e-158e9ef97d6a", "appRoles": [ { "allowedMemberTypes": [ "User" ], "displayName": "Writer", "id": "d1c2ade8-98f8-45fd-aa4a-6d06b947c66f", "isEnabled": true, "description": "Writers Have the ability to create tasks.", "value": "Writer" } ], "availableToOtherTenants": false, Box 2: User - Scenario: In order to review content a user must be part of a ContentReviewer role. Box 3: value - value specifies the value which will be included in the roles claim in authentication and access tokens. Reference: https://docs.microsoft.com/en-us/graph/api/resources/approle

   Source: Adapted from community discussion — coffecold

   References

   • Microsoft Learn

   

   Next question

3. Question 43 · 462 in bank

   HOTSPOT - You need to add code at line AM09 to ensure that users can review content using ContentAnalysisService. How should you complete the code? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Box 1: "oauth2AllowIdTokenImplicitFlow":true This value indicates whether the web app can request ID tokens of the implicit OAuth 2.0 flow. The default setting is "false". Box 2: "oauth2AllowImplicitFlow":true This value indicates whether the web app can request OAuth 2.0 implicit flow access tokens. The default setting is "false". Reference: https://docs.microsoft.com/de-de/azure/active-directory/develop/reference-app-manifest https://docs.microsoft.com/de-de/azure/active-directory/develop/reference-app-manifest#oauth2allowidtokenimplicitflow-attribute https://docs.microsoft.com/de-de/azure/active-directory/develop/reference-app-manifest#oauth2allowimplicitflow-attribute

   Source: Adapted from community discussion — mlantonis

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

4. Question 44 · 462 in bank

   HOTSPOT - You need to ensure that network security policies are met. How should you configure network security? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Box 1: Valid root certificate - Scenario: All websites and services must use SSL from a valid root certificate authority. Box 2: Azure Application Gateway Scenario: ✑ Any web service accessible over the Internet must be protected from cross site scripting attacks. ✑ All Internal services must only be accessible from Internal Virtual Networks (VNets) All parts of the system must support inbound and outbound traffic restrictions. Azure Web Application Firewall (WAF) on Azure Application Gateway provides centralized protection of your web applications from common exploits and vulnerabilities. Web applications are increasingly targeted by malicious attacks that exploit commonly known vulnerabilities. SQL injection and cross-site scripting are among the most common attacks. Application Gateway supports autoscaling, SSL offloading, and end-to-end SSL, a web application firewall (WAF), cookie-based session affinity, URL path-based routing, multisite hosting, redirection, rewrite HTTP headers and other features. Note: Both Nginx and Azure Application Gateway act as a reverse proxy with Layer 7 load-balancing features plus a WAF to ensure strong protection against common web vulnerabilities and exploits. You can modify Nginx web server configuration/SSL for X-XSS protection. This helps to prevent cross-site scripting exploits by forcing the injection of HTTP headers with X-XSS protection. Reference: https://docs.microsoft.com/en-us/azure/web-application-firewall/ag/ag-overview https://www.upguard.com/articles/10-tips-for-securing-your-nginx-deployment

   Source: Adapted from community discussion — mlantonis

   

   Next question

5. Question 45 · 462 in bank

   DRAG DROP - You need to add YAML markup at line CS17 to ensure that the ContentUploadService can access Azure Storage access keys. How should you complete the YAML markup? To answer, drag the appropriate YAML segments to the correct locations. Each YAML segment may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content. NOTE: Each correct selection is worth one point. Select and Place:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Box 1: volumeMounts - Example: volumeMounts: - mountPath: /mnt/secrets name: secretvolume1 volumes: - name: secretvolume1 secret: mysecret1: TXkgZmlyc3Qgc2VjcmV0IEZPTwo= Box 2: volumes - Box 3: secret - Reference: https://docs.microsoft.com/en-us/azure/container-instances/container-instances-volume-secret

   Source: Adapted from community discussion — coffecold

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

6. Question 46 · 462 in bank

   HOTSPOT - You need to add code at line AM10 of the application manifest to ensure that the requirement for manually reviewing content can be met. How should you complete the code? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Box 1: sid - Sid: Session ID, used for per-session user sign-out. Personal and Azure AD accounts. Scenario: Manual review - To review content, the user must authenticate to the website portion of the ContentAnalysisService using their Azure AD credentials. The website is built using React and all pages and API endpoints require authentication. In order to review content a user must be part of a ContentReviewer role. Box 2: email - Scenario: All completed reviews must include the reviewer's email address for auditing purposes.

   Source: Adapted from community discussion — mlantonis

   References

   • Microsoft Learn
   • Microsoft Learn

   

   Next question

7. Question 47 · 462 in bank

   HOTSPOT - You need to secure the Shipping Function app. How should you configure the app? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Scenario: Shipping Function app: Implement secure function endpoints by using app-level security and include Azure Active Directory (Azure AD). Box 1: Function - Box 2: JSON based Token (JWT) Azure AD uses JSON based tokens (JWTs) that contain claims Box 3: HTTP - How a web app delegates sign-in to Azure AD and obtains a token User authentication happens via the browser. The OpenID protocol uses standard HTTP protocol messages. Reference: https://docs.microsoft.com/en-us/azure/active-directory/develop/authentication-scenarios

   Source: Adapted from community discussion — uffuchsi

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

8. Question 48 · 462 in bank

   You need to secure the Shipping Logic App. What should you use?

   • AAzure App Service Environment (ASE)
   • BIntegration Service Environment (ISE)
   • CVNet service endpoint
   • DAzure AD B2B integration

   Show answer

   Answer: B

   Explanation

   Shipping Logic app: Secure resources to the corporate VNet and use dedicated storage resources with a fixed costing model. For scenarios where your logic apps and integration accounts need access to an Azure virtual network, create an integration service environment (ISE). An ISE is a dedicated environment that uses dedicated storage and other resources that are kept separate from the "global" multi-tenant Logic Apps service. This separation also reduces any impact that other Azure tenants might have on your apps' performance. An ISE also provides you with your own static IP addresses. These IP addresses are separate from the static IP addresses that are shared by the logic apps in the public, multi-tenant service. Reference: https://docs.microsoft.com/en-us/azure/logic-apps/connect-virtual-network-vnet-isolated-environment

   Source: Adapted from community discussion — mlantonis

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • azure.microsoft.com documentation
   • Microsoft Learn

   Next question

9. Question 49 · 462 in bank

   HOTSPOT - You need to retrieve the database connection string. Which values should you use? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Azure database connection string retrieve REST API vault.azure.net/secrets/ Box 1: cpandlkeyvault - We specify the key vault, cpandlkeyvault. Scenario: The database connection string is stored in Azure Key Vault with the following attributes: Azure Key Vault name: cpandlkeyvault Secret name: PostgreSQLConn - Id: 80df3e46ffcd4f1cb187f79905e9a1e8 Box 2: PostgreSQLConn - We specify the secret, PostgreSQLConn Example, sample request: https://myvault.vault.azure.net//secrets/mysecretname/4387e9f3d6e14c459867679a90fd0f79?api-version=7.1 Box 3: Querystring - Reference: https://docs.microsoft.com/en-us/rest/api/keyvault/getsecret/getsecret

   Source: Adapted from community discussion — mlantonis

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

10. Question 50 · 462 in bank

    DRAG DROP - You need to correct the corporate website error. Which four actions should you recommend be performed in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order. Select and Place:

    

    This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

    Show the answer figure

    Answer: See figure below

    Explanation

    Answer: • Generate a certificate • Upload the certificate to Azure key vault • Import the certificate to Azure App Service • Add the certificate thumbprint to the WEBSITE_LOAD_CERTIFICATES app setting https://ankitvijay.net/2021/04/14/certificate-azure-app-service-linux/

    Source: Adapted from community discussion — Frakandel

    References

    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn

    

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

AZ-204 practice, question 41. 462 questions available.