Preview real exam questions, verified answers and available explanations before choosing a study plan.
Question 1
Hotspot
HOTSPOT
You provisioned an Azure Cosmos DB for NoSQL account named account1 with the default consistency level.
You plan to configure the consistency level on a per request basis. The level needs to be set for consistent prefix for read and write operations to account1.
You need to identify the resulting consistency level for read and write operations.
Which levels should you configure? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Reveal answer detailsClose answer details
Explanation
Box 1: consistent prefix
Note: Override the default consistency level Clients can override the default consistency level that is set by the service. Consistency level can be set on a per request, which overrides the default consistency level set at the account level.
Consistency can only be relaxed at the SDK instance or request level. To move from weaker to stronger consistency, update the default consistency for the Azure Cosmos DB account.
Azure Cosmos DB offers five well-defined levels. From strongest to weakest, the levels are:
Box 2: session One of the consistency levels in Azure Cosmos DB is Session consistency. This is the default level applied to Azure Cosmos DB accounts by default.
Overriding the default consistency level only applies to reads within the SDK client. An account configured for strong consistency by default will still write and replicate data synchronously to every region in the account.
You are developing an Azure solution to collect inventory data from thousands of stores located around the world. Each store location will send the inventory data hourly to an Azure Blob storage account for processing.
The solution must meet the following requirements:
1. Begin processing when data is saved to Azure Blob storage. 2. Filter data based on store location information. 3. Trigger an Azure Logic App to process the data for output to Azure Cosmos DB. 4. Enable high availability and geographic distribution. 5. Allow 24-hours for retries. 6. Implement an exponential back off data processing.
You need to configure the solution.
What should you implement? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Reveal answer detailsClose answer details
Explanation
Box 1: Azure Event Grid Blob storage events are pushed using Azure Event Grid to subscribers such as Azure Functions, Azure Logic Apps, or even to your own http listener. Event Grid provides reliable event delivery to your applications through rich retry policies and dead-lettering.
Box 2: Azure Logic App Event Grid uses event subscriptions to route event messages to subscribers. This image illustrates the relationship between event publishers, event subscriptions, and event handlers.
Box 3: Azure Service Bus The Event Grid service doesn't store events. Instead, events are stored in the Event Handlers, including ServiceBus, EventHubs, Storage Queue, WebHook endpoint, or many other supported Azure Services.
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You are developing an Azure solution to collect point-of-sale (POS) device data from 2,000 stores located throughout the world. A single device can produce 2 megabytes (MB) of data every 24 hours. Each store location has one to five devices that send data.
You must store the device data in Azure Blob storage. Device data must be correlated based on a device identifier. Additional stores are expected to open in the future.
You need to implement a solution to receive the device data.
Solution: Provision an Azure Service Bus. Configure a topic to receive the device data by using a correlation filter.
Does the solution meet the goal?
A
Yes
B
No
Reveal answer detailsClose answer details
Correct answerA
Explanation
A message is raw data produced by a service to be consumed or stored elsewhere. The Service Bus is for high-value enterprise messaging, and is used for order processing and financial transactions.
You need to ensure that the solution meets the following requirements:
1. Provide transactional support. 2. Provide duplicate detection. 3. Store the messages for an unlimited period of time.
Which two technologies will meet the requirements? Each correct answer presents a complete solution.
NOTE: Each correct selection is worth one point.
A
Azure Service Bus Topic
B
Azure Service Bus Queue
C
Azure Storage Queue
D
Azure Event Hub
Reveal answer detailsClose answer details
Correct answersA, B
Explanation
The Azure Service Bus Queue and Topic has duplicate detection. Enabling duplicate detection helps keep track of the application-controlled MessageId of all messages sent into a queue or topic during a specified time window.
Incorrect Answers: C: There is just no mechanism that can query a Storage queue and find out if a message with the same contents is already there or was there before.
D: Azure Event Hub does not have duplicate detection
You develop and deploy the following staticwebapp.config.json file to the app_location value specified in the workflow file of an Azure Static Web app.
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Reveal answer detailsClose answer details
Question 6
Single choice
You are a developer for a SaaS company that offers many web services.
All web services for the company must meet the following requirements:
Use API Management to access the services Use OpenID Connect for authentication Prevent anonymous usage
A recent security audit found that several web services can be called without any authentication.
Which API Management policy should you implement?
A
jsonp
B
authentication-certificate
C
check-header
D
validate-jwt
Reveal answer detailsClose answer details
Correct answerD
Explanation
Add the validate-jwt policy to validate the OAuth token for every incoming request.
Incorrect Answers: A: The jsonp policy adds JSON with padding (JSONP) support to an operation or an API to allow cross-domain calls from JavaScript browser-based clients. JSONP is a method used in JavaScript programs to request data from a server in a different domain. JSONP bypasses the limitation enforced by most web browsers where access to web pages must be in the same domain.
JSONP - Adds JSON with padding (JSONP) support to an operation or an API to allow cross-domain calls from JavaScript browser-based clients.
A company maintains multiple web and mobile applications. Each application uses custom in-house identity providers as well as social identity providers.
You need to implement single sign-on (SSO) for all the applications.
What should you do?
A
Use Azure Active Directory B2C (Azure AD B2C) with custom policies.
B
Use Azure Active Directory B2B (Azure AD B2B) and enable external collaboration.
C
Use Azure Active Directory B2C (Azure AD B2C) with user flows.
D
Use Azure Active Directory B2B (Azure AD B2B).
Reveal answer detailsClose answer details
Correct answerA
Explanation
Based on this article: https://docs.microsoft.com/en-us/azure/active-directory/external-identities/external-collaboration-settings-configure External collaboration settings let you specify what roles in your organization can invite external users for B2B collaboration. These settings also include options for allowing or blocking specific domains, and options for restricting what external guest users can see in your Azure AD directory. https://docs.microsoft.com/en-us/azure/active-directory-b2c/custom-policy-reference-sso
Case study
Case Study 7
Background
VanArsdel, Ltd. is a global office supply company. The company is based in Canada and has retail store locations across the world. The company is developing several cloud-based solutions to support their stores, distributors, suppliers, and delivery services.
Current environment
Corporate website
The company provides a public website located at http://www.vanarsdelltd.com. The website consists of a React JavaScript user interface, HTML, CSS, image assets, and several APIs hosted in Azure Functions.
Retail Store Locations
The company supports thousands of store locations globally. Store locations send data every hour to an Azure Blob storage account to support inventory, purchasing and delivery services. Each record includes a location identifier and sales transaction information.
Requirements
The application components must meet the following requirements:
Corporate website
1. Secure the website by using SSL. 2. Minimize costs for data storage and hosting. 3. Implement native GitHub workflows for continuous integration and continuous deployment (CI/CD). 4. Distribute the website content globally for local use. 5. Implement monitoring by using Application Insights and availability web tests including SSL certificate validity and custom header value verification. 6. The website must have 99.95 percent uptime.
Retail store locations
1. Azure Functions must process data immediately when data is uploaded to Blob storage. Azure
Functions must update Azure Cosmos DB by using native SQL language queries. 2. Audit store sale transaction information nightly to validate data, process sales financials, and reconcile inventory.
Delivery services
1. Store service telemetry data in Azure Cosmos DB by using an Azure Function. Data must include an item id, the delivery vehicle license plate, vehicle package capacity, and current vehicle location coordinates. 2. Store delivery driver profile information in Azure Active Directory (Azure AD) by using an Azure Function called from the corporate website.
Inventory services
The company has contracted a third-party to develop an API for inventory processing that requires access to a specific blob within the retail store storage account for three months to include read-only access to the data.
Security
1. All Azure Functions must centralize management and distribution of configuration data for different environments and geographies, encrypted by using a company-provided RSA-HSM key. 2. Authentication and authorization must use Azure AD and services must use managed identities where possible.
Issues
Retail Store Locations
1. You must perform a point-in-time restoration of the retail store location data due to an unexpected and accidental deletion of data. 2. Azure Cosmos DB queries from the Azure Function exhibit high Request Unit (RU) usage and contain multiple, complex queries that exhibit high point read latency for large items as the function app is scaling.
Question 8
Testlet 7Hotspot
HOTSPOT
You need to reliably identify the delivery driver profile information.
How should you configure the system? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Reveal answer detailsClose answer details
Explanation
Box 1: ID Scenario: Store delivery driver profile information in Azure Active Directory (Azure AD) by using an Azure Function called from the corporate website.
ID token - A JWT that contains claims that you can use to identify users in your application. This token is securely sent in HTTP requests for communication between two components of the same application or service. You can use the claims in an ID token as you see fit. They're commonly used to display account information or to make access control decisions in an application. ID tokens are signed, but the're not encrypted. When your application or API receives an ID token, it must validate the signature to prove that the token is authentic. Your application or API must also validate a few claims in the token to prove that it's valid. Depending on the scenario requirements, the claims validated by an application can vary, but your application must perform some common claim validations in every scenario.
Box 2: Oid Oid - The immutable identifier for the "principal" of the request - the user or service principal whose identity has been verified. In ID tokens and app+user tokens, this is the object ID of the user. In app-only tokens, this is the object ID of the calling service principal. It can also be used to perform authorization checks safely and as a key in database tables. This ID uniquely identifies the principal across applications - two different applications signing in the same user will receive the same value in the oid claim.
Incorrect: Aud - Identifies the intended recipient of the token. For Azure AD B2C, the audience is the application ID. Your application should validate this value and reject the token if it doesn't match. Audience is synonymous with resource.
Idp - Records the identity provider that authenticated the subject of the token. This value is identical to the value of the Issuer claim unless the user account not in the same tenant as the issuer - guests, for instance. If the claim isn't present, it means that the value of iss can be used instead. For personal accounts being used in an organizational context (for instance, a personal account invited to an Azure AD tenant), the idp claim may be 'live.com' or an STS URI containing the Microsoft account tenant.
This virtual machine (VM) runs BizTalk Server 2016. The VM runs the following workflows:
1. Ocean Transport - This workflow gathers and validates container information including container contents and arrival notices at various shipping ports. 2. Inland Transport - This workflow gathers and validates trucking information including fuel usage, number of stops, and routes.
The VM supports the following REST API calls:
1. Container API - This API provides container information including weight, contents, and other attributes. 2. Location API - This API provides location information regarding shipping ports of call and trucking stops. 3. Shipping REST API - This API provides shipping information for use and display on the shipping website.
Shipping Data
The application uses MongoDB JSON document storage database for all container and transport information.
Shipping Web Site
The site displays shipping container tracking information and container contents. The site is located at http://shipping.wideworldimporters.com/
Proposed solution
The on-premises shipping application must be moved to Azure. The VM has been migrated to a new Standard_D16s_v3 Azure VM by using Azure Site Recovery and must remain running in Azure to complete the BizTalk component migrations. You create a Standard_D16s_v3 Azure VM to host BizTalk Server. The Azure architecture diagram for the proposed solution is shown below:
Requirements
Shipping Logic app
The Shipping Logic app must meet the following requirements:
1. Support the ocean transport and inland transport workflows by using a Logic App. 2. Support industry-standard protocol X12 message format for various messages including vessel content details and arrival notices. 3. Secure resources to the corporate VNet and use dedicated storage resources with a fixed costing model. 4. Maintain on-premises connectivity to support legacy applications and final BizTalk migrations.
Shipping Function app
Implement secure function endpoints by using app-level security and include Azure Active Directory (Azure AD).
REST APIs
The REST API's that support the solution must meet the following requirements:
1. Secure resources to the corporate VNet. 2. Allow deployment to a testing location within Azure while not incurring additional costs. 3. Automatically scale to double capacity during peak shipping times while not causing application downtime. 4. Minimize costs when selecting an Azure payment model.
Shipping data
Data migration from on-premises to Azure must minimize costs and downtime.
Shipping website
Use Azure Content Delivery Network (CDN) and ensure maximum performance for dynamic content while minimizing latency and costs.
Issues
Windows Server 2016 VM
The VM shows high network latency, jitter, and high CPU utilization. The VM is critical and has not been
backed up in the past. The VM must enable a quick restore from a 7-day snapshot to include in-place restore of disks in case of failure.
Shipping website and REST APIs
The following error message displays while you are testing the website:
Failed to load http://test-shippingapi.wideworldimporters.com/: No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'http://test.wideworldimporters.com/' is therefore not allowed access.
Question 9
Testlet 2Hotspot
HOTSPOT
You need to configure Azure CDN for the Shipping web site.
Which configuration options should you use? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Reveal answer detailsClose answer details
Explanation
Scenario: Shipping website Use Azure Content Delivery Network (CDN) and ensure maximum performance for dynamic content while minimizing latency and costs.
Tier: Standard
Profile: Akamai
Optimization: Dynamic site acceleration Dynamic site acceleration (DSA) is available for Azure CDN Standard from Akamai, Azure CDN Standard from Verizon, and Azure CDN Premium from Verizon profiles.
DSA includes various techniques that benefit the latency and performance of dynamic content. Techniques include route and network optimization, TCP optimization, and more.
You can use this optimization to accelerate a web app that includes numerous responses that aren't cacheable. Examples are search results, checkout transactions, or real-time data. You can continue to use core Azure CDN caching capabilities for static data.
You are developing a solution for a hospital to support the following use cases:
1. The most recent patient status details must be retrieved even if multiple users in different locations have updated the patient record. 2. Patient health monitoring data retrieved must be the current version or the prior version. 3. After a patient is discharged and all charges have been assessed, the patient billing record contains the final charges.
You provision a Cosmos D6 NoSQL database and set the default consistency level for the database account to Strong. You set the value for Indexing Mode to Consistent. You need to configure the consistency levels to support each scenario. You must minimize latency and any impact to the availability of the solution. You must override the default consistency level at the query level to meet the required consistency guarantees for the scenarios.
Which consistency levels should you implement? To answer, drag the appropriate consistency levels to the correct requirements. Each consistency level may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content. NOTE: Each correct selection is worth one point.
Reveal answer detailsClose answer details
Explanation
Box 1: Strong
Strong: Strong consistency offers a linearizability guarantee. The reads are guaranteed to return the most recent committed version of an item. A client never sees an uncommitted or partial write. Users are always guaranteed to read the latest committed write.
Box 2: Bounded staleness Bounded staleness: The reads are guaranteed to honor the consistent-prefix guarantee. The reads might lag behind writes by at most "K" versions (that is "updates") of an item or by "t" time interval. When you choose bounded staleness, the "staleness" can be configured in two ways:
The number of versions (K) of the item The time interval (t) by which the reads might lag behind the writes
Box 3: Eventual Eventual: There's no ordering guarantee for reads. In the absence of any further writes, the replicas eventually converge.
Question 11
Single choice
A development team is creating a new REST API. The API will store data in Azure Blob storage. You plan to deploy the API to Azure App Service.
Developers must access the Azure Blob storage account to develop the API for the next two months. The Azure Blob storage account must not be accessible by the developers after the two-month time period.
You need to grant developers access to the Azure Blob storage account.
What should you do?
A
Generate a shared access signature (SAS) for the Azure Blob storage account and provide the SAS to all developers.
B
Create and apply a new lifecycle management policy to include a last accessed date value. Apply the policy to the Azure Blob storage account.
C
Provide all developers with the access key for the Azure Blob storage account. Update the API to include the Coordinated Universal Time (UTC) timestamp for the request header.
D
Grant all developers access to the Azure Blob storage account by assigning role-based access control (RBAC) roles.
You are developing a back-end Azure App Service that scales based on the number of messages contained in a Service Bus queue.
A rule already exists to scale up the App Service when the average queue length of unprocessed and valid queue messages is greater than 1000.
You need to add a new rule that will continuously scale down the App Service as long as the scale up condition is not met.
How should you configure the Scale rule? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Reveal answer detailsClose answer details
Explanation
Box 1: Service bus queue You are developing a back-end Azure App Service that scales based on the number of messages contained in a Service Bus queue.
Box 2: ActiveMessage Count ActiveMessageCount: Messages in the queue or subscription that are in the active state and ready for delivery.
Box 3: Count
Box 4: Less than or equal to You need to add a new rule that will continuously scale down the App Service as long as the scale up condition is not met.
Box 5: Decrease count by
Question 13
Single choice
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this question, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You are developing a website that will run as an Azure Web App. Users will authenticate by using their Azure Active Directory (Azure AD) credentials.
You plan to assign users one of the following permission levels for the website: admin, normal, and reader. A user's Azure AD group membership must be used to determine the permission level. You need to configure authorization.
Solution:
1. Create a new Azure AD application's manifest, set value of the groupMembershipClaims option to All. 2. In the website, use the value of the groups claim from the JWI for the user to determine permissions.
Does the solution meet the goal?
A
Yes
B
No
Reveal answer detailsClose answer details
Correct answerA
Explanation
To configure Manifest to include Group Claims in Auth Token
1. Go to Azure Active Directory to configure the Manifest. Click on Azure Active Directory, and go to App registrations to find your application 2. Click on your application (or search for it if you have a lot of apps) and edit the Manifest by clicking on it.
3. Locate the "groupMembershipClaims" setting. Set its value to either "SecurityGroup" or "All". To help you decide which:
"SecurityGroup" - groups claim will contain the identifiers of all security groups of which the user is a member.
"All" - groups claim will contain the identifiers of all security groups and all distribution lists of which the user is a member
Now your application will include group claims in your manifest and you can use this fact in your code.
Munson's Pickles and Preserves Farm is an agricultural cooperative corporation based in Washington, US, with farms located across the United States. The company supports agricultural production resources by distributing seeds fertilizers, chemicals, fuel, and farm machinery to the farms.
Current Environment
The company is migrating all applications from an on-premises datacenter to Microsoft Azure. Applications support distributors, farmers, and internal company staff.
Corporate website
The company hosts a public website located at http://www.munsonspicklesandpreservesfarm.com. The site supports farmers and distributors who request agricultural production resources.
Farms
The company created a new customer tenant in the Microsoft Entra admin center to support authentication and authorization for applications.
Distributors
Distributors integrate their applications with data that is accessible by using APIs hosted at http://www.munsonspicklesandpreservesfarm.com/api to receive and update resource data.
Requirements
The application components must meet the following requirements:
Corporate website
1. The site must be migrated to Azure App Service. 2. Costs must be minimized when hosting in Azure. 3. Applications must automatically scale independent of the compute resources. 4. All code changes must be validated by internal staff before release to production.
5. File transfer speeds must improve, and webpage-load performance must increase. 6. All site settings must be centrally stored, secured without using secrets, and encrypted at rest and in transit. 7. A queue-based load leveling pattern must be implemented by using Azure Service Bus queues to support high volumes of website agricultural production resource requests.
Farms
Farmers must authenticate to applications by using Microsoft Entra ID.
Distributors
1. The company must track a custom telemetry value with each API call and monitor performance of all APIs. 2. API telemetry values must be charted to evaluate variations and trends for resource data.
Internal staff
1. App and API updates must be validated before release to production. 2. Staff must be able to select a link to direct them back to the production app when validating an app or API update. 3. Staff profile photos and email must be displayed on the website once they authenticate to applications by using their Microsoft Entra ID.
Security
1. All web communications must be secured by using TLS/HTTPS. 2. Web content must be restricted by country/region to support corporate compliance standards. 3. The principle of least privilege must be applied when providing any user rights or process access rights. 4. Managed identities for Azure resources must be used to authenticate services that support Microsoft Entra ID authentication.
Issues
Corporate website
1. Farmers report HTTP 503 errors at the same time as internal staff report that CPU and memory usage are high. 2. Distributors report HTTP 502 errors at the same time as internal staff report that average response times and networking traffic are high. 3. Internal staff report webpage load sizes are large and take a long time to load. 4. Developers receive authentication errors to Service Bus when they debug locally.
Distributors
Many API telemetry values are sent in a short period of time. Telemetry traffic, data costs, and storage costs must be reduced while preserving a statistically correct analysis of the data points sent by the APIs.
Question 14
Testlet 8Multiple choice
You need to implement farmer authentication.
Which three actions should you perform? Each correct answer presents part of the solution.
NOTE: Each correct selection is worth one point.
A
Add the shared access signature (SAS) token to the app
B
Create a shared access signature (SAS) token.
C
Register the app in Microsoft Entra ID.
D
Create a user flow.
E
Add the app to the user flow.
Reveal answer detailsClose answer details
Correct answersC, D, E
Question 15
Hotspot
HOTSPOT
You develop and deploy a web app to Azure App service. The web app allows users to authenticate by using social identity providers through the Azure B2C service. All user profile information is stored in Azure B2C.
You must update the web app to display common user properties from Azure B2C to include the following information:
1. Email address 2. Job title 3. First name 4. Last name 5. Office location
You need to implement the user properties in the web app.
Which code library and API should you use? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Reveal answer detailsClose answer details
Explanation
Box 1: Microsoft Graph Microsoft Graph allows you to manage resources in your Azure AD B2C directory. Microsoft Graph API operations are supported for the management of Azure AD B2C resources, including users, identity providers, user flows, custom policies, and policy keys
Box 2: Microsoft Authentication Library (MSAL) MSAL.js supports authentication with social (Microsoft, Google, Facebook etc.), enterprise (ADFS, Salesforce etc.) and local (stored in the Azure AD B2C directory) identities using Azure AD B2C (B2C for short).
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You develop and deploy an Azure App Service API app to a Windows-hosted deployment slot named Development. You create additional deployment slots named Testing and Production. You enable auto swap on the Production deployment slot.
You need to ensure that scripts run and resources are available before a swap operation occurs.
Solution: Update the app with a method named statuscheck to run the scripts. Update the app settings for the app. Set the WEBSITE_SWAP_WARMUP_PING_PATH and WEBSITE_SWAP_WARMUP_PING_STATUSES with a path to the new method and appropriate response codes.
Does the solution meet the goal?
A
Yes
B
No
Reveal answer detailsClose answer details
Correct answerB
Explanation
These are valid warm-up behavior options, but are not helpful in fixing swap problems.
Instead update the web.config file to include the applicationInitialization configuration element. Specify custom initialization actions to run the scripts.
Note: Some apps might require custom warm-up actions before the swap. The applicationInitialization configuration element in web.config lets you specify custom initialization actions. The swap operation waits for this custom warm-up to finish before swapping with the target slot. Here's a sample web.config fragment.
You plan to develop an Azure Functions app with an Azure Blob Storage trigger. The app will be used infrequently, with a limited duration of individual executions.
The app must meet the following requirements:
Event-driven scaling Support for deployment slots Minimize costs
You need to identify the hosting plan and the maximum duration when executing the app.
Which configuration setting values should you use? To answer, select the appropriate values in the answer area.
NOTE: Each correct selection is worth one point.
Reveal answer detailsClose answer details
Explanation
Box 1: Consumption Hosting plan
The Consumption plan is the cheapest.
On the Consumption plan, instances of the Functions host are dynamically added and removed based on the number of incoming events.
You are developing a microservices-based application that uses Azure Container Apps.
The application consists of several containerized services that handle tasks, such as processing orders, managing inventory, and generating reports.
You deploy a new revision of the processing orders app.
Processing orders must be triggered by a web request and must always be available based on incoming web requests.
You need to validate that the replica is ready to handle incoming requests.
What should you implement?
A
TCP liveness probe
B
HTTP readiness probe
C
HTTP startup probe
D
TCP readiness probe
E
HTTP liveness probe
Reveal answer detailsClose answer details
Correct answerB
Question 19
Hotspot
HOTSPOT
You create the following PowerShell script:
For each of the following statements, select Yes if the statement is true. Otherwise, select No,
NOTE: Each correct selection is worth one point.
Reveal answer detailsClose answer details
Explanation
Box 1: No The AzScheduledQueryRuleSource is Heartbeat, not CPU.
Box 2: Yes The AzScheduledQueryRuleSource is Heartbeat!
Note: New-AzScheduledQueryRuleTriggerCondition creates an object of type Trigger Condition. This object is to be passed to the command that creates Alerting Action object.
Box 3: No The schedule is 60 minutes, not two hours. -FrequencyInMinutes: The alert frequency. -TimeWindowInMinutes: The alert time window
The New-AzAscheduledQueryRuleSchedule command creates an object of type Schedule. This object is to be passed to the command that creates Log Alert Rule.
Case study
Case Study 3
Background
Overview
You are a developer for Contoso, Ltd. The company has a social networking website that is developed as a Single Page Application (SPA). The main web application for the social networking website loads user uploaded content from blob storage.
You are developing a solution to monitor uploaded data for inappropriate content. The following process occurs when users upload content by using the SPA:
1. Messages are sent to ContentUploadService. 2. Content is processed by ContentAnalysisService. 3. After processing is complete, the content is posted to the social network or a rejection message is posted in its place.
The ContentAnalysisService is deployed with Azure Container Instances from a private Azure Container Registry named contosoimages.
The solution will use eight CPU cores.
Azure Active Directory
Contoso, Ltd. uses Azure Active Directory (Azure AD) for both internal and guest accounts.
Requirements
ContentAnalysisService
The company's data science group built ContentAnalysisService which accepts user generated content as a string and returns a probable value for inappropriate content. Any values over a specific threshold must be reviewed by an employee of Contoso, Ltd.
You must create an Azure Function named CheckUserContent to perform the content checks.
Costs
You must minimize costs for all Azure services.
Manual review
To review content, the user must authenticate to the website portion of the ContentAnalysisService using their Azure AD credentials. The website is built using React and all pages and API endpoints require authentication. In order to review content a user must be part of a ContentReviewer role. All completed reviews must include the reviewer's email address for auditing purposes.
High availability
All services must run in multiple regions. The failure of any service in a region must not impact overall application availability.
Monitoring
An alert must be raised if the ContentUploadService uses more than 80 percent of available CPU cores.
Security
You have the following security requirements: 1. Any web service accessible over the Internet must be protected from cross site scripting attacks. 2. All websites and services must use SSL from a valid root certificate authority. 3. Azure Storage access keys must only be stored in memory and must be available only to the service. 4. All Internal services must only be accessible from internal Virtual Networks (VNets). 5. All parts of the system must support inbound and outbound traffic restrictions. 6. All service calls must be authenticated by using Azure AD.
User agreements
When a user submits content, they must agree to a user agreement. The agreement allows employees of Contoso, Ltd. to review content, store cookies on user devices, and track user's IP addresses.
Information regarding agreements is used by multiple divisions within Contoso, Ltd.
User responses must not be lost and must be available to all parties regardless of individual service uptime. The volume of agreements is expected to be in the millions per hour.
Validation testing
When a new version of the ContentAnalysisService is available the previous seven days of content must be processed with the new version to verify that the new version does not significantly deviate from the old version.
Issues
Users of the ContentUploadService report that they occasionally see HTTP 502 responses on specific pages.
Code
ContentUploadService
Question 20
Testlet 3Single choice
You need to store the user agreements.
Where should you store the agreement after it is completed?
A
Azure Storage queue
B
Azure Event Hub
C
Azure Service Bus topic
D
Azure Event Grid topic
Reveal answer detailsClose answer details
Correct answerB
Explanation
Azure Event Hub is used for telemetry and distributed data streaming.
This service provides a single solution that enables rapid data retrieval for real-time processing as well as repeated replay of stored raw data. It can capture the streaming data into a file for processing and analysis.
It has the following characteristics: 1. low latency 2. capable of receiving and processing millions of events per second 3. at least once delivery
You are building an application to track cell towers that are available to phones in near real time. A phone will send information to the application by using the Azure Web PubSub service. The data will be processed by using an Azure Functions app. Traffic will be transmitted by using a content delivery network (CDN).
The Azure function must be protected against misconfigured or unauthorized invocations.
You need to ensure that the CDN allows for the Azure function protection.
Which HTTP header should be on the allowed list?
A
Authorization
B
WebHook-Request-Callback
C
Resource
D
WebHook-Request-Origin
Reveal answer detailsClose answer details
Correct answerD
Explanation
CloudEvents extension for Azure Web PubSub event handler with HTTP protocol The Web PubSub service delivers client events to the upstream webhook using the CloudEvents HTTP protocol binding.
Webhook validation The Webhook validation follows CloudEvents. The request always contains WebHook-Request-Origin: xxx.webpubsub.azure.com in the header.
If and only if the delivery target does allow delivery of the events, it MUST reply to the request by including WebHook-Allowed-Origin header, for example:
WebHook-Allowed-Origin: *
Or:
WebHook-Allowed-Origin: xxx.webpubsub.azure.com
For now, WebHook-Request-Rate and WebHook-Request-Callback are not supported.
Incorrect: * WebHook-Request-Callback. An optional field that provides the webhook with an alternative to grant permission asynchronously, by way of a HTTP callback.
VanArsdel, Ltd. is a global office supply company. The company is based in Canada and has retail store locations across the world. The company is developing several cloud-based solutions to support their stores, distributors, suppliers, and delivery services.
Current environment
Corporate website
The company provides a public website located at http://www.vanarsdelltd.com. The website consists of a React JavaScript user interface, HTML, CSS, image assets, and several APIs hosted in Azure Functions.
Retail Store Locations
The company supports thousands of store locations globally. Store locations send data every hour to an Azure Blob storage account to support inventory, purchasing and delivery services. Each record includes a location identifier and sales transaction information.
Requirements
The application components must meet the following requirements:
Corporate website
1. Secure the website by using SSL. 2. Minimize costs for data storage and hosting. 3. Implement native GitHub workflows for continuous integration and continuous deployment (CI/CD). 4. Distribute the website content globally for local use. 5. Implement monitoring by using Application Insights and availability web tests including SSL certificate validity and custom header value verification. 6. The website must have 99.95 percent uptime.
Retail store locations
1. Azure Functions must process data immediately when data is uploaded to Blob storage. Azure
Functions must update Azure Cosmos DB by using native SQL language queries. 2. Audit store sale transaction information nightly to validate data, process sales financials, and reconcile inventory.
Delivery services
1. Store service telemetry data in Azure Cosmos DB by using an Azure Function. Data must include an item id, the delivery vehicle license plate, vehicle package capacity, and current vehicle location coordinates. 2. Store delivery driver profile information in Azure Active Directory (Azure AD) by using an Azure Function called from the corporate website.
Inventory services
The company has contracted a third-party to develop an API for inventory processing that requires access to a specific blob within the retail store storage account for three months to include read-only access to the data.
Security
1. All Azure Functions must centralize management and distribution of configuration data for different environments and geographies, encrypted by using a company-provided RSA-HSM key. 2. Authentication and authorization must use Azure AD and services must use managed identities where possible.
Issues
Retail Store Locations
1. You must perform a point-in-time restoration of the retail store location data due to an unexpected and accidental deletion of data. 2. Azure Cosmos DB queries from the Azure Function exhibit high Request Unit (RU) usage and contain multiple, complex queries that exhibit high point read latency for large items as the function app is scaling.
Question 22
Testlet 7Hotspot
HOTSPOT
You need to implement event routing for retail store location data.
Which configurations should you use? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Reveal answer detailsClose answer details
Explanation
Box 1: Azure Blob Storage Azure event publishers and event handlers are at the core of the Event Grid routing-service. Event Grid listens to Azure event publishers, such as Blog Storage, then reacts by routing specific events to Azure event handlers, such as WebHooks. You can easily control this entire process at a granular level through event subscriptions and event filters.
Box 2: Azure Event Grid Azure Event Grid is a highly scalable event-routing service that listens for specific system events, then reacts to them according to your precise specifications. In the past, event handling has relied largely on polling - a high latency, low-efficiency approach that can prove prohibitively expensive at scale.
Box 3: Azure Logic App Event Grid's supported event handlers currently include Event Hubs, WebHooks, Logic Apps, Azure Functions, Azure Automation and Microsoft Flow.
You have an Azure Batch project that processes and converts files and stores the files in Azure storage. You are developing a function to start the batch job.
You add the following parameters to the function.
You must ensure that converted files are placed in the container referenced by the outputContainerSasUrl parameter. Files which fail to convert are placed in the container referenced by the failedContainerSasUrl parameter.
You need to ensure the files are correctly processed.
How should you complete the code segment? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Reveal answer detailsClose answer details
Explanation
Box 1: CreateJob
Box 2: TaskSuccess TaskSuccess: Upload the file(s) only after the task process exits with an exit code of 0.
Incorrect: TaskCompletion: Upload the file(s) after the task process exits, no matter what the exit code was.
Box 3: TaskFailure TaskFailure:Upload the file(s) only after the task process exits with a nonzero exit code.
Box 4: OutputFiles To specify output files for a task, create a collection of OutputFile objects and assign it to the CloudTask.OutputFiles property when you create the task.
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
Your company has an Azure Active Directory (Azure AD) environment. Users occasionally connect to Azure AD via the Internet.
You need to ensure that users who connect to Azure AD via the internet using an unidentified IP address, are automatically instructed to change their passwords.
Solution: You configure the use of Azure Key Vault.
You are developing an application that uses Azure Storage to store customer data. The data must only be decrypted by the customer and the customer must be provided a script to rotate keys.
You need to provide a script to rotate keys to the customer.
How should you complete the command? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Reveal answer detailsClose answer details
Explanation
Box 1: key When you manually update the key version, you'll need to update the storage account's encryption settings to use the new version. First, query for the key vault URI by calling az keyvault show, and for the key version by calling az keyvault key list-versions. Then call az storage account update to update the storage account's encryption settings to use the new version of the key, as shown in the example below.
Box 2: Microsoft.Keyvault Call az storage account update to update the storage account's encryption settings, as shown in the following example. Include the --encryption-key-source parameter and set it to Microsoft.Keyvault to enable customer-managed keys for the account.
This virtual machine (VM) runs BizTalk Server 2016. The VM runs the following workflows:
1. Ocean Transport - This workflow gathers and validates container information including container contents and arrival notices at various shipping ports. 2. Inland Transport - This workflow gathers and validates trucking information including fuel usage, number of stops, and routes.
The VM supports the following REST API calls:
1. Container API - This API provides container information including weight, contents, and other attributes. 2. Location API - This API provides location information regarding shipping ports of call and trucking stops. 3. Shipping REST API - This API provides shipping information for use and display on the shipping website.
Shipping Data
The application uses MongoDB JSON document storage database for all container and transport information.
Shipping Web Site
The site displays shipping container tracking information and container contents. The site is located at http://shipping.wideworldimporters.com/
Proposed solution
The on-premises shipping application must be moved to Azure. The VM has been migrated to a new Standard_D16s_v3 Azure VM by using Azure Site Recovery and must remain running in Azure to complete the BizTalk component migrations. You create a Standard_D16s_v3 Azure VM to host BizTalk Server. The Azure architecture diagram for the proposed solution is shown below:
Requirements
Shipping Logic app
The Shipping Logic app must meet the following requirements:
1. Support the ocean transport and inland transport workflows by using a Logic App. 2. Support industry-standard protocol X12 message format for various messages including vessel content details and arrival notices. 3. Secure resources to the corporate VNet and use dedicated storage resources with a fixed costing model. 4. Maintain on-premises connectivity to support legacy applications and final BizTalk migrations.
Shipping Function app
Implement secure function endpoints by using app-level security and include Azure Active Directory (Azure AD).
REST APIs
The REST API's that support the solution must meet the following requirements:
1. Secure resources to the corporate VNet. 2. Allow deployment to a testing location within Azure while not incurring additional costs. 3. Automatically scale to double capacity during peak shipping times while not causing application downtime. 4. Minimize costs when selecting an Azure payment model.
Shipping data
Data migration from on-premises to Azure must minimize costs and downtime.
Shipping website
Use Azure Content Delivery Network (CDN) and ensure maximum performance for dynamic content while minimizing latency and costs.
Issues
Windows Server 2016 VM
The VM shows high network latency, jitter, and high CPU utilization. The VM is critical and has not been
backed up in the past. The VM must enable a quick restore from a 7-day snapshot to include in-place restore of disks in case of failure.
Shipping website and REST APIs
The following error message displays while you are testing the website:
Failed to load http://test-shippingapi.wideworldimporters.com/: No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'http://test.wideworldimporters.com/' is therefore not allowed access.
Question 26
Testlet 2Single choice
You need to support the requirements for the Shipping Logic App.
What should you use?
A
Azure Active Directory Application Proxy
B
Site-to-Site (S2S) VPN connection
C
On-premises Data Gateway
D
Point-to-Site (P2S) VPN connection
Reveal answer detailsClose answer details
Correct answerC
Explanation
Before you can connect to on-premises data sources from Azure Logic Apps, download and install the on-premises data gateway on a local computer. The gateway works as a bridge that provides quick data transfer and encryption between data sources on premises (not in the cloud) and your logic apps.
The gateway supports BizTalk Server 2016.
Note: Microsoft have now fully incorporated the Azure BizTalk Services capabilities into Logic Apps and Azure App Service Hybrid Connections.
Logic Apps Enterprise Integration pack bring some of the enterprise B2B capabilities like AS2 and X12, EDI standards support
Scenario: The Shipping Logic app must meet the following requirements: 1. Support the ocean transport and inland transport workflows by using a Logic App. 2. Support industry-standard protocol X12 message format for various messages including vessel content details and arrival notices. 3. Secure resources to the corporate VNet and use dedicated storage resources with a fixed costing model. 4. Maintain on-premises connectivity to support legacy applications and final BizTalk migrations.
You plan to develop code that will process messages in queuel.
You need to implement a queue operation to set the visibility timeout value of individual messages in queuel.
Which two operations can you use? Each correct answer presents a complete solution.
NOTE: Each correct selection is worth one point.
A
Peek at a message in the queue.
B
Update a message in the queue.
C
Delete a message in the queue.
D
Receive a message from the queue.
E
Add a message to the queuer t
Reveal answer detailsClose answer details
Correct answersC, D
Case study
Case Study 4
Background
City Power & Light company provides electrical infrastructure monitoring solutions for homes and businesses. The company is migrating solutions to Azure.
Current environment
Architecture overview
The company has a public website located at http://www.cpandl.com/. The site is a single-page web application that runs in Azure App Service on Linux. The website uses files stored in Azure Storage and cached in Azure Content Delivery Network (CDN) to serve static content.
API Management and Azure Function App functions are used to process and store data in Azure Database for PostgreSQL. API Management is used to broker communications to the Azure Function app functions for Logic app integration. Logic apps are used to orchestrate the data processing while Service Bus and Event Grid handle messaging and events.
The solution uses Application Insights, Azure Monitor, and Azure Key Vault.
Architecture diagram
The company has several applications and services that support their business. The company plans to implement serverless computing where possible. The overall architecture is shown below.
User authentication
The following steps detail the user authentication process:
1. The user selects Sign in in the website. 2. The browser redirects the user to the Azure Active Directory (Azure AD) sign in page. 3. The user signs in. 4. Azure AD redirects the user's session back to the web application. The URL includes an access token. 5. The web application calls an API and includes the access token in the authentication header. The application ID is sent as the audience ('aud') claim in the access token. 6. The back-end API validates the access token.
Requirements
Corporate website
1. Communications and content must be secured by using SSL. 2. Communications must use HTTPS. 3. Data must be replicated to a secondary region and three availability zones. 4. Data storage costs must be minimized.
Azure Database for PostgreSQL
The database connection string is stored in Azure Key Vault with the following attributes:
The connection information is updated frequently. The application must always use the latest information to connect to the database.
Azure Service Bus and Azure Event Grid
1. Azure Event Grid must use Azure Service Bus for queue-based load leveling.
2. Events in Azure Event Grid must be routed directly to Service Bus queues for use in buffering. 3. Events from Azure Service Bus and other Azure services must continue to be routed to Azure Event Grid for processing.
Security
1. All SSL certificates and credentials must be stored in Azure Key Vault. 2. File access must restrict access by IP, protocol, and Azure AD rights. 3. All user accounts and processes must receive only those privileges which are essential to perform their intended function.
Compliance
Auditing of the file updates and transfers must be enabled to comply with General Data Protection Regulation (GDPR). The file updates must be read-only, stored in the order in which they occurred, include only create, update, delete, and copy operations, and be retained for compliance reasons.
Issues
Corporate website
While testing the site, the following error message displays: CryptographicException: The system cannot find the file specified.
Function app
You perform local testing for the RequestUserApproval function. The following error message displays: 'Timeout value of 00:10:00 exceeded by function: RequestUserApproval'
The same error message displays when you test the function in an Azure development environment when you run the following Kusto query: FunctionAppLogs | where FunctionName = = "RequestUserApproval"
Logic app
You test the Logic app in a development environment. The following error message displays: '400 Bad Request' Troubleshooting of the error shows an HttpTrigger action to call the RequestUserApproval function.
Code
Corporate website
Security.cs:
Function app
RequestUserApproval.cs:
Question 28
Testlet 4Hotspot
HOTSPOT
You need to configure security and compliance for the corporate website files.
Which Azure Blob storage settings should you use? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Reveal answer detailsClose answer details
Explanation
Box 1: role-based access control (RBAC) Azure Storage supports authentication and authorization with Azure AD for the Blob and Queue services via Azure role-based access control (Azure RBAC). Scenario: File access must restrict access by IP, protocol, and Azure AD rights.
Box 2: storage account type
Scenario: The website uses files stored in Azure Storage Auditing of the file updates and transfers must be enabled to comply with General Data Protection Regulation (GDPR).
Creating a diagnostic setting: 1. Sign in to the Azure portal. 2. Navigate to your storage account. 3. In the Monitoring section, click Diagnostic settings (preview).
4. Choose file as the type of storage that you want to enable logs for. 5. Click Add diagnostic setting.
You are developing an ASP.NET Core time sheet application that runs as an Azure Web App. Users of the application enter their time sheet information on the first day of every month.
The application uses a third-party web service to validate data.
The application encounters periodic server errors due to errors that result from calling a third-party web server. Each request to the third-party server has the same chance of failure.
You need to configure an Azure Monitor alert to detect server errors unrelated to the third-party service. You must minimize false-positive alerts.
How should you complete the Azure Resource Manager template? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Reveal answer detailsClose answer details
Explanation
Box 1: DynamicThresholdCriterion
Box 2: Http5xx Server errors are in the 5xx range. Client errors are in the 4xx range
You have an Azure Cosmos 06 instance that uses the Strong consistency level and 10,000 Request Units (RUs) per container. Geo-replication is enabled.
The instance stores restaurant information including location, menu items, and start. You currently store information for 1,000 restaurant locations, 500 menu items, and 10,000 staff members. You select the location id as the partition key.
How many logical partitions will be created for the container?
A
500
B
1,100
C
10.000
D
10,000,000
Reveal answer detailsClose answer details
Correct answerC
Case study
Case Study 6
Background
You are a developer for Litware Inc., a SaaS company that provides a solution for managing employee expenses. The solution consists of an ASP.NET Core Web API project that is deployed as an Azure Web App.
Overall architecture
Employees upload receipts for the system to process. When processing is complete, the employee receives a summary report email that details the processing results. Employees then use a web application to manage their receipts and perform any additional tasks needed for reimbursement.
Receipt processing Employees may upload receipts in two ways:
1. Uploading using an Azure Files mounted folder 2. Uploading using the web application
Data Storage Receipt and employee information is stored in an Azure SQL database.
Documentation
Employees are provided with a getting started document when they first use the solution. The documentation includes details on supported operating systems for Azure File upload, and instructions on how to configure the mounted folder.
Solution details
Users table
Web Application
You enable MSI for the Web App and configure the Web App to use the security principal name WebAppIdentity.
Processing
Processing is performed by an Azure Function that uses version 2 of the Azure Function runtime. Once processing is completed, results are stored in Azure Blob Storage and an Azure SQL database. Then, an email summary is sent to the user with a link to the processing report. The link to the report must remain valid if the email is forwarded to another user.
Logging
Azure Application Insights is used for telemetry and logging in both the processor and the web application. The processor also has TraceWriter logging enabled. Application Insights must always contain all log messages.
Requirements
Receipt processing
Concurrent processing of a receipt must be prevented.
Disaster recovery
Regional outage must not impact application availability. All DR operations must not be dependent on application running and must ensure that data in the DR region is up to date.
Security
1. User's SecurityPin must be stored in such a way that access to the database does not allow the viewing of SecurityPins. The web application is the only system that should have access to SecurityPins. 2. All certificates and secrets used to secure data must be stored in Azure Key Vault. 3. You must adhere to the principle of least privilege and provide privileges which are essential to perform the intended function. 4. All access to Azure Storage and Azure SQL database must use the application's Managed Service Identity (MSI). 5. Receipt data must always be encrypted at rest. 6. All data must be protected in transit. 7. User's expense account number must be visible only to logged in users. All other views of the expense account number should include only the last segment, with the remaining parts obscured. 8. In the case of a security breach, access to all summary reports must be revoked without impacting other parts of the system.
Issues
Upload format issue
Employees occasionally report an issue with uploading a receipt using the web application. They report that when they upload a receipt using the Azure File Share, the receipt does not appear in their profile. When this occurs, they delete the file in the file share and use the web application, which returns a 500 Internal Server error page.
Capacity issue
During busy periods, employees report long delays between the time they upload the receipt and when it appears in the web application.
Log capacity issue
Developers report that the number of log messages in the trace output for the processor is too high, resulting in lost log messages.
Application code
Processing.cs
Database.cs
ReceiptUploader.cs
ConfigureSSE.ps1
Question 31
Testlet 6Single choice
You need to resolve the log capacity issue.
What should you do?
A
Create an Application Insights Telemetry Filter
B
Change the minimum log level in the host.json file for the function
C
Implement Application Insights Sampling
D
Set a LogCategoryFilter during startup
Reveal answer detailsClose answer details
Correct answerC
Explanation
Scenario, the log capacity issue: Developers report that the number of log message in the trace output for the processor is too high, resulting in lost log messages.
Sampling is a feature in Azure Application Insights. It is the recommended way to reduce telemetry traffic and storage, while preserving a statistically correct analysis of application data. The filter selects items that are related, so that you can navigate between items when you are doing diagnostic investigations. When metric counts are presented to you in the portal, they are renormalized to take account of the sampling, to minimize any effect on the statistics.
Sampling reduces traffic and data costs, and helps you avoid throttling.
You are maintaining an existing application that uses an Azure Blob GPv1 Premium storage account. Data older than three months is rarely used.
Data newer than three months must be available immediately. Data older than a year must be saved but does not need to be available immediately.
You need to configure the account to support a lifecycle management rule that moves blob data to archive storage for data not modified in the last year.
Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.
Reveal answer detailsClose answer details
Explanation
Step 1: Upgrade the storage account to GPv2 Object storage data tiering between hot, cool, and archive is supported in Blob Storage and General Purpose v2 (GPv2) accounts. General Purpose v1 (GPv1) accounts don't support tiering. You can easily convert your existing GPv1 or Blob Storage accounts to GPv2 accounts through the Azure portal.
Step 2: Copy the data to be archived to a Standard GPv2 storage account and then delete the data from the original storage account
Step 3: Change the storage account access tier from hot to cool
Note: Hot - Optimized for storing data that is accessed frequently. Cool - Optimized for storing data that is infrequently accessed and stored for at least 30 days.
Archive - Optimized for storing data that is rarely accessed and stored for at least 180 days with flexible latency requirements, on the order of hours.
Only the hot and cool access tiers can be set at the account level. The archive access tier can only be set at the blob level.
VanArsdel, Ltd. is a global office supply company. The company is based in Canada and has retail store locations across the world. The company is developing several cloud-based solutions to support their stores, distributors, suppliers, and delivery services.
Current environment
Corporate website
The company provides a public website located at http://www.vanarsdelltd.com. The website consists of a React JavaScript user interface, HTML, CSS, image assets, and several APIs hosted in Azure Functions.
Retail Store Locations
The company supports thousands of store locations globally. Store locations send data every hour to an Azure Blob storage account to support inventory, purchasing and delivery services. Each record includes a location identifier and sales transaction information.
Requirements
The application components must meet the following requirements:
Corporate website
1. Secure the website by using SSL. 2. Minimize costs for data storage and hosting. 3. Implement native GitHub workflows for continuous integration and continuous deployment (CI/CD). 4. Distribute the website content globally for local use. 5. Implement monitoring by using Application Insights and availability web tests including SSL certificate validity and custom header value verification. 6. The website must have 99.95 percent uptime.
Retail store locations
1. Azure Functions must process data immediately when data is uploaded to Blob storage. Azure
Functions must update Azure Cosmos DB by using native SQL language queries. 2. Audit store sale transaction information nightly to validate data, process sales financials, and reconcile inventory.
Delivery services
1. Store service telemetry data in Azure Cosmos DB by using an Azure Function. Data must include an item id, the delivery vehicle license plate, vehicle package capacity, and current vehicle location coordinates. 2. Store delivery driver profile information in Azure Active Directory (Azure AD) by using an Azure Function called from the corporate website.
Inventory services
The company has contracted a third-party to develop an API for inventory processing that requires access to a specific blob within the retail store storage account for three months to include read-only access to the data.
Security
1. All Azure Functions must centralize management and distribution of configuration data for different environments and geographies, encrypted by using a company-provided RSA-HSM key. 2. Authentication and authorization must use Azure AD and services must use managed identities where possible.
Issues
Retail Store Locations
1. You must perform a point-in-time restoration of the retail store location data due to an unexpected and accidental deletion of data. 2. Azure Cosmos DB queries from the Azure Function exhibit high Request Unit (RU) usage and contain multiple, complex queries that exhibit high point read latency for large items as the function app is scaling.
Question 33
Testlet 7Hotspot
HOTSPOT
You need to implement the delivery service telemetry data.
How should you configure the solution? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Reveal answer detailsClose answer details
Explanation
Box 1: Core SQL SQL API: Serverless database computing using Azure Cosmos DB and Azure Functions.
Note: Store service telemetry data in Azure Cosmos DB by using an Azure Function. Data must include an item id, the delivery vehicle license plate, vehicle package capacity, and current vehicle location coordinates.
Box 2: Vehicle license plate Selecting your partition key is a simple but important design choice in Azure Cosmos DB. Once you select your partition key, it is not possible to change it in-place. If you need to change your partition key, you should move your data to a new container with your new desired partition key.
For all containers, your partition key should:
Be a property that has a value which does not change. If a property is your partition key, you can't update that property's value.
Have a high cardinality. In other words, the property should have a wide range of possible values.
Spread request unit (RU) consumption and data storage evenly across all logical partitions. This ensures even RU consumption and storage distribution across your physical partitions.
Note: The company supports thousands of store locations globally. Store locations send data every hour to an Azure Blob storage account to support inventory, purchasing and delivery services. Each record includes a location identifier and sales transaction information.
This virtual machine (VM) runs BizTalk Server 2016. The VM runs the following workflows:
1. Ocean Transport - This workflow gathers and validates container information including container contents and arrival notices at various shipping ports. 2. Inland Transport - This workflow gathers and validates trucking information including fuel usage, number of stops, and routes.
The VM supports the following REST API calls:
1. Container API - This API provides container information including weight, contents, and other attributes. 2. Location API - This API provides location information regarding shipping ports of call and trucking stops. 3. Shipping REST API - This API provides shipping information for use and display on the shipping website.
Shipping Data
The application uses MongoDB JSON document storage database for all container and transport information.
Shipping Web Site
The site displays shipping container tracking information and container contents. The site is located at http://shipping.wideworldimporters.com/
Proposed solution
The on-premises shipping application must be moved to Azure. The VM has been migrated to a new Standard_D16s_v3 Azure VM by using Azure Site Recovery and must remain running in Azure to complete the BizTalk component migrations. You create a Standard_D16s_v3 Azure VM to host BizTalk Server. The Azure architecture diagram for the proposed solution is shown below:
Requirements
Shipping Logic app
The Shipping Logic app must meet the following requirements:
1. Support the ocean transport and inland transport workflows by using a Logic App. 2. Support industry-standard protocol X12 message format for various messages including vessel content details and arrival notices. 3. Secure resources to the corporate VNet and use dedicated storage resources with a fixed costing model. 4. Maintain on-premises connectivity to support legacy applications and final BizTalk migrations.
Shipping Function app
Implement secure function endpoints by using app-level security and include Azure Active Directory (Azure AD).
REST APIs
The REST API's that support the solution must meet the following requirements:
1. Secure resources to the corporate VNet. 2. Allow deployment to a testing location within Azure while not incurring additional costs. 3. Automatically scale to double capacity during peak shipping times while not causing application downtime. 4. Minimize costs when selecting an Azure payment model.
Shipping data
Data migration from on-premises to Azure must minimize costs and downtime.
Shipping website
Use Azure Content Delivery Network (CDN) and ensure maximum performance for dynamic content while minimizing latency and costs.
Issues
Windows Server 2016 VM
The VM shows high network latency, jitter, and high CPU utilization. The VM is critical and has not been
backed up in the past. The VM must enable a quick restore from a 7-day snapshot to include in-place restore of disks in case of failure.
Shipping website and REST APIs
The following error message displays while you are testing the website:
Failed to load http://test-shippingapi.wideworldimporters.com/: No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'http://test.wideworldimporters.com/' is therefore not allowed access.
Question 34
Testlet 2Single choice
You need to secure the Shipping Logic App.
What should you use?
A
Azure App Service Environment (ASE)
B
Integration Service Environment (ISE)
C
VNet service endpoint
D
Azure AD B2B integration
Reveal answer detailsClose answer details
Correct answerB
Explanation
Scenario: The Shipping Logic App requires secure resources to the corporate VNet and use dedicated storage resources with a fixed costing model.
You can access to Azure Virtual Network resources from Azure Logic Apps by using integration service environments (ISEs).
Sometimes, your logic apps and integration accounts need access to secured resources, such as virtual machines (VMs) and other systems or services, that are inside an Azure virtual network. To set up this access, you can create an integration service environment (ISE) where you can run your logic apps and create your integration accounts.
You need to create a report for the portal that lists information about employees who are subject matter experts for a specific topic. You must ensure that administrators have full control and cosent over the data.
Which technology should you use?
A
Microsoft Graph connectors
B
Microosft graph API
C
Microsoft Graph data connect
Reveal answer detailsClose answer details
Correct answerC
Explanation
Data Connect grants a more granular control and consent model: you can manage data, see who is accessing it, and request specific properties of an entity. This enhances the Microsoft Graph model, which grants or denies applications access to entire entities.
Microsoft Graph Data Connect augments Microsoft Graph's transactional model with an intelligent way to access rich data at scale. The data covers how workers communicate, collaborate, and manage their time across all the applications and services in Microsoft 365.
Incorrect: Not B: The Microsoft Graph API is a RESTful web API that enables you to access Microsoft Cloud service resources. After you register your app and get authentication tokens for a user or service, you can make requests to the Microsoft Graph API.
A simplistic definition of a Graph API is an API that models the data in terms of nodes and edges (objects and relationships) and allows the client to interact with multiple nodes in a single request.
Not C: Microsoft Graph connectors, your organization can index third-party data so that it appears in Microsoft Search results. With Microsoft Graph connectors, your organization can index third-party data so that it appears in Microsoft Search results.
This question requires that you evaluate the underlined text to determine if it is correct.
Your Azure Active Directory Azure (Azure AD) tenant has an Azure subscription linked to it.
Your developer has created a mobile application that obtains Azure AD access tokens using the OAuth 2 implicit grant type.
The mobile application must be registered in Azure AD.
You require a redirect URI from the developer for registration purposes.
Instructions: Review the underlined text. If it makes the statement correct, select "No change is needed." If the statement is incorrect, select the answer choice that makes the statement correct.
A
No change required.
B
a secret
C
a login hint
D
a client ID
Reveal answer detailsClose answer details
Correct answerA
Explanation
For Native Applications you need to provide a Redirect URI, which Azure AD will use to return token responses.
VanArsdel, Ltd. is a global office supply company. The company is based in Canada and has retail store locations across the world. The company is developing several cloud-based solutions to support their stores, distributors, suppliers, and delivery services.
Current environment
Corporate website
The company provides a public website located at http://www.vanarsdelltd.com. The website consists of a React JavaScript user interface, HTML, CSS, image assets, and several APIs hosted in Azure Functions.
Retail Store Locations
The company supports thousands of store locations globally. Store locations send data every hour to an Azure Blob storage account to support inventory, purchasing and delivery services. Each record includes a location identifier and sales transaction information.
Requirements
The application components must meet the following requirements:
Corporate website
1. Secure the website by using SSL. 2. Minimize costs for data storage and hosting. 3. Implement native GitHub workflows for continuous integration and continuous deployment (CI/CD). 4. Distribute the website content globally for local use. 5. Implement monitoring by using Application Insights and availability web tests including SSL certificate validity and custom header value verification. 6. The website must have 99.95 percent uptime.
Retail store locations
1. Azure Functions must process data immediately when data is uploaded to Blob storage. Azure
Functions must update Azure Cosmos DB by using native SQL language queries. 2. Audit store sale transaction information nightly to validate data, process sales financials, and reconcile inventory.
Delivery services
1. Store service telemetry data in Azure Cosmos DB by using an Azure Function. Data must include an item id, the delivery vehicle license plate, vehicle package capacity, and current vehicle location coordinates. 2. Store delivery driver profile information in Azure Active Directory (Azure AD) by using an Azure Function called from the corporate website.
Inventory services
The company has contracted a third-party to develop an API for inventory processing that requires access to a specific blob within the retail store storage account for three months to include read-only access to the data.
Security
1. All Azure Functions must centralize management and distribution of configuration data for different environments and geographies, encrypted by using a company-provided RSA-HSM key. 2. Authentication and authorization must use Azure AD and services must use managed identities where possible.
Issues
Retail Store Locations
1. You must perform a point-in-time restoration of the retail store location data due to an unexpected and accidental deletion of data. 2. Azure Cosmos DB queries from the Azure Function exhibit high Request Unit (RU) usage and contain multiple, complex queries that exhibit high point read latency for large items as the function app is scaling.
Question 37
Testlet 7Hotspot
HOTSPOT
You need to implement the Azure Function for delivery driver profile information.
Which configurations should you use? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Reveal answer detailsClose answer details
Explanation
Box 1: Azure Identity library
Store delivery driver profile information in Azure Active Directory (Azure AD) by using an Azure Function called from the corporate website.
We recommend that you use a managed identity for applications deployed to Azure. The preceding authentication scenarios are supported by the Azure Identity client library and integrated with Key Vault SDKs.
Note: What is Managed Service Identity? Azure Key Vault avoids the need to store keys and secrets in application code or source control. However, in order to retrieve keys and secrets from Azure Key Vault, you need to authorize a user or application with Azure Key Vault, which in its turn needs another credential. Managed Service Identity avoids the need of storing credentials for Azure Key Vault in application or environment settings by creating a Service Principal for each application or cloud service on which Managed Service Identity is enabled. This Service Principal enables you to call a local MSI endpoint to get an access token from Azure AD using the credentials of the Service Principal. This token is then used to authenticate to an Azure Service, for example Azure Key Vault.
Box 2: Azure Key Vault Azure Key Vault allows you to securely access sensitive information from within your applications: * Keys, secrets, and certificates are protected without your having to write the code yourself, and you can easily use them from your applications.
Use Azure Key Vault to store only secrets for your application. Examples of secrets that should be stored in Key Vault include:
1. Enable developers to write the functions by using the Rust language. 2. Declaratively connect to an Azure Blob Storage account.
You need to implement the app.
Which Azure Function app features should you use? To answer, drag the appropriate features to the correct requirements. Each feature may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.
NOTE: Each correct selection is worth one point.
Reveal answer detailsClose answer details
Explanation
Box 1: Custom handler Custom handlers can be used to create functions in any language or runtime by running an HTTP server process, for example Go or Rust.
Box 2: Trigger
Functions are invoked by a trigger and can have exactly one. In addition to invoking the function, certain triggers also serve as bindings. You may also define multiple bindings in addition to the trigger. Bindings provide a declarative way to connect data to your code.
Case study
Case Study 4
Background
City Power & Light company provides electrical infrastructure monitoring solutions for homes and businesses. The company is migrating solutions to Azure.
Current environment
Architecture overview
The company has a public website located at http://www.cpandl.com/. The site is a single-page web application that runs in Azure App Service on Linux. The website uses files stored in Azure Storage and cached in Azure Content Delivery Network (CDN) to serve static content.
API Management and Azure Function App functions are used to process and store data in Azure Database for PostgreSQL. API Management is used to broker communications to the Azure Function app functions for Logic app integration. Logic apps are used to orchestrate the data processing while Service Bus and Event Grid handle messaging and events.
The solution uses Application Insights, Azure Monitor, and Azure Key Vault.
Architecture diagram
The company has several applications and services that support their business. The company plans to implement serverless computing where possible. The overall architecture is shown below.
User authentication
The following steps detail the user authentication process:
1. The user selects Sign in in the website. 2. The browser redirects the user to the Azure Active Directory (Azure AD) sign in page. 3. The user signs in. 4. Azure AD redirects the user's session back to the web application. The URL includes an access token. 5. The web application calls an API and includes the access token in the authentication header. The application ID is sent as the audience ('aud') claim in the access token. 6. The back-end API validates the access token.
Requirements
Corporate website
1. Communications and content must be secured by using SSL. 2. Communications must use HTTPS. 3. Data must be replicated to a secondary region and three availability zones. 4. Data storage costs must be minimized.
Azure Database for PostgreSQL
The database connection string is stored in Azure Key Vault with the following attributes:
The connection information is updated frequently. The application must always use the latest information to connect to the database.
Azure Service Bus and Azure Event Grid
1. Azure Event Grid must use Azure Service Bus for queue-based load leveling.
2. Events in Azure Event Grid must be routed directly to Service Bus queues for use in buffering. 3. Events from Azure Service Bus and other Azure services must continue to be routed to Azure Event Grid for processing.
Security
1. All SSL certificates and credentials must be stored in Azure Key Vault. 2. File access must restrict access by IP, protocol, and Azure AD rights. 3. All user accounts and processes must receive only those privileges which are essential to perform their intended function.
Compliance
Auditing of the file updates and transfers must be enabled to comply with General Data Protection Regulation (GDPR). The file updates must be read-only, stored in the order in which they occurred, include only create, update, delete, and copy operations, and be retained for compliance reasons.
Issues
Corporate website
While testing the site, the following error message displays: CryptographicException: The system cannot find the file specified.
Function app
You perform local testing for the RequestUserApproval function. The following error message displays: 'Timeout value of 00:10:00 exceeded by function: RequestUserApproval'
The same error message displays when you test the function in an Azure development environment when you run the following Kusto query: FunctionAppLogs | where FunctionName = = "RequestUserApproval"
Logic app
You test the Logic app in a development environment. The following error message displays: '400 Bad Request' Troubleshooting of the error shows an HttpTrigger action to call the RequestUserApproval function.
Code
Corporate website
Security.cs:
Function app
RequestUserApproval.cs:
Question 39
Testlet 4Hotspot
HOTSPOT
You need to correct the Azure Logic app error message.
Which configuration values should you use? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Reveal answer detailsClose answer details
Explanation
Scenario: You test the Logic app in a development environment. The following error message displays: '400 Bad Request' Troubleshooting of the error shows an HttpTrigger action to call the RequestUserApproval function.
Note: If the inbound call's request body doesn't match your schema, the trigger returns an HTTP 400 Bad Request error.
Box 1: function If you have an Azure function where you want to use the system-assigned identity, first enable authentication for Azure functions.
Box 2: system-assigned Your logic app or individual connections can use either the system-assigned identity or a single user-assigned identity, which you can share across a group of logic apps, but not both.
You develop and deploy an ASP.NET Core application that connects to an Azure Database for MySQL instance.
Connections to the database appear to drop intermittently and the application code does not handle the connection failure.
You need to handle the transient connection errors in code by implementing retries.
What are three possible ways to achieve this goal? Each correct answer presents part of the solution.
NOTE: Each correct selection is worth one point.
A
Increase connection repeat attempts exponentially up to 120 seconds.
B
Close the database connection and immediately report an error.
C
Wait five seconds before repeating the connection attempt to the database.
D
Disable connection pooling and configure a second Azure Database for MySQL instance.
E
Set a maximum number of connection attempts to 10 and report an error on subsequent connections.
Reveal answer detailsClose answer details
Correct answersA, C, E
Explanation
A transient error is an error that will resolve itself. Transient errors can occur for example when hardware or network failure happens.
A best practice for designing and developing applications in the cloud is to expect transient errors. Assume they can happen in any component at any time and have the appropriate logic to handle these situations. Transient errors should be handled using retry logic. A good pattern to follow is:
Wait for 5 seconds before your first retry. For each following retry, the increase the wait exponentially, up to 60 seconds. Set a max number of retries at which point your application considers the operation failed.
You are building a traffic monitoring system that monitors traffic along six highways. The system produces time series analysis-based reports for each highway. Data from traffic sensors are stored in Azure Event Hub.
Traffic data is consumed by four departments. Each department has an Azure Web App that displays the time series-based reports and contains a WebJob that processes the incoming data from Event Hub. All Web Apps run on App Service Plans with three instances.
Data throughput must be maximized. Latency must be minimized.
You need to implement the Azure Event Hub.
Which settings should you use? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Reveal answer detailsClose answer details
Explanation
Box 1: 6 The number of partitions is specified at creation and must be between 2 and 32. There are 6 highways.
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You are developing an Azure Service application that processes queue data when it receives a message from a mobile application. Messages may not be sent to the service consistently.
You have the following requirements:
1. Queue size must not grow larger than 80 gigabytes (GB). 2. Use first-in-first-out (FIFO) ordering of messages. 3. Minimize Azure costs.
You need to implement the messaging solution.
Solution: Use the .Net API to add a message to an Azure Storage Queue from the mobile application. Create an Azure VM that is triggered from Azure Storage Queue events.
Does the solution meet the goal?
A
Yes
B
No
Reveal answer detailsClose answer details
Correct answerB
Explanation
Don't use a VM, instead create an Azure Function App that uses an Azure Service Bus Queue trigger.
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear on the review screen.
You are developing an application that needs to react to events from multiple Azure services, such as Azure Blob Storage and Azure Resource Manager, in near real time.
The application must meet the following requirements:
1. Handle a high volume of events without manual intervention. 2. Receive only specific events relevant to your application, based on event types or resource patterns. 3. Ensure that no events are missed, even if the processing application is temporarily unavailable. 4. Use Azure Functions for processing events without managing any infrastructure. 5. Minimize the amount of custom code required for event routing and handling.
You need to develop the solution.
Solution: Deploy an Azure Service Bus namespace. Configure the Azure services to send events to the Service Bus. Implement Azure Functions with Service Bus triggers to process the events. Use Service Bus sessions and message deferral to manage event ordering and reliability.
Does the solution meet the goal?
A
Yes
B
No
Reveal answer detailsClose answer details
Correct answerB
Question 45
Single choice
You are developing a software solution for an autonomous transportation system. The solution uses large data sets and Azure Batch processing to simulate navigation sets for entire fleets of vehicles.
You need to create compute nodes for the solution on Azure Batch.
What should you do?
A
In the Azure portal, create a Batch account.
B
In a .NET method, call the method: BatchClient.PoolOperations.CreatePool
C
In Python, implement the class: JobAddParameter
D
In Python, implement the class: TaskAddParameter
Reveal answer detailsClose answer details
Correct answerB
Explanation
A Batch job is a logical grouping of one or more tasks. A job includes settings common to the tasks, such as priority and the pool to run tasks on. The app uses the BatchClient.JobOperations.CreateJob method to create a job on your pool.
Incorrect Answers: C, D: To create a Batch pool in Python, the app uses the PoolAddParameter class to set the number of nodes, VM size, and a pool configuration.
You have developed a Web App for your company. The Web App provides services and must run in multiple regions.
You want to be notified whenever the Web App uses more than 85 percent of the available CPU cores over a 5 minute period. Your solution must minimize costs.
Which command should you use? To answer, select the appropriate settings to the answer area.
City Power & Light company provides electrical infrastructure monitoring solutions for homes and businesses. The company is migrating solutions to Azure.
Current environment
Architecture overview
The company has a public website located at http://www.cpandl.com/. The site is a single-page web application that runs in Azure App Service on Linux. The website uses files stored in Azure Storage and cached in Azure Content Delivery Network (CDN) to serve static content.
API Management and Azure Function App functions are used to process and store data in Azure Database for PostgreSQL. API Management is used to broker communications to the Azure Function app functions for Logic app integration. Logic apps are used to orchestrate the data processing while Service Bus and Event Grid handle messaging and events.
The solution uses Application Insights, Azure Monitor, and Azure Key Vault.
Architecture diagram
The company has several applications and services that support their business. The company plans to implement serverless computing where possible. The overall architecture is shown below.
User authentication
The following steps detail the user authentication process:
1. The user selects Sign in in the website. 2. The browser redirects the user to the Azure Active Directory (Azure AD) sign in page. 3. The user signs in. 4. Azure AD redirects the user's session back to the web application. The URL includes an access token. 5. The web application calls an API and includes the access token in the authentication header. The application ID is sent as the audience ('aud') claim in the access token. 6. The back-end API validates the access token.
Requirements
Corporate website
1. Communications and content must be secured by using SSL. 2. Communications must use HTTPS. 3. Data must be replicated to a secondary region and three availability zones. 4. Data storage costs must be minimized.
Azure Database for PostgreSQL
The database connection string is stored in Azure Key Vault with the following attributes:
The connection information is updated frequently. The application must always use the latest information to connect to the database.
Azure Service Bus and Azure Event Grid
1. Azure Event Grid must use Azure Service Bus for queue-based load leveling.
2. Events in Azure Event Grid must be routed directly to Service Bus queues for use in buffering. 3. Events from Azure Service Bus and other Azure services must continue to be routed to Azure Event Grid for processing.
Security
1. All SSL certificates and credentials must be stored in Azure Key Vault. 2. File access must restrict access by IP, protocol, and Azure AD rights. 3. All user accounts and processes must receive only those privileges which are essential to perform their intended function.
Compliance
Auditing of the file updates and transfers must be enabled to comply with General Data Protection Regulation (GDPR). The file updates must be read-only, stored in the order in which they occurred, include only create, update, delete, and copy operations, and be retained for compliance reasons.
Issues
Corporate website
While testing the site, the following error message displays: CryptographicException: The system cannot find the file specified.
Function app
You perform local testing for the RequestUserApproval function. The following error message displays: 'Timeout value of 00:10:00 exceeded by function: RequestUserApproval'
The same error message displays when you test the function in an Azure development environment when you run the following Kusto query: FunctionAppLogs | where FunctionName = = "RequestUserApproval"
Logic app
You test the Logic app in a development environment. The following error message displays: '400 Bad Request' Troubleshooting of the error shows an HttpTrigger action to call the RequestUserApproval function.
Code
Corporate website
Security.cs:
Function app
RequestUserApproval.cs:
Question 47
Testlet 4Hotspot
HOTSPOT
You need to retrieve the database connection string.
Which values should you use? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Reveal answer detailsClose answer details
Explanation
Azure database connection string retrieve REST API vault.azure.net/secrets/
Box 1: cpandlkeyvault We specify the key vault, cpandlkeyvault.
Scenario: The database connection string is stored in Azure Key Vault with the following attributes: Azure Key Vault name: cpandlkeyvault Secret name: PostgreSQLConn Id: 80df3e46ffcd4f1cb187f79905e9a1e8
Box 2: PostgreSQLConn We specify the secret, PostgreSQLConn
Example, sample request: https://myvault.vault.azure.net//secrets/mysecretname/4387e9f3d6e14c459867679a90fd0f79?api-version=7.1
You are developing a Java application that uses Cassandra to store key and value data. You plan to use a new Azure Cosmos DB resource and the Cassandra API in the application. You create an Azure Active Directory (Azure AD) group named Cosmos DB Creators to enable provisioning of Azure Cosmos accounts, databases, and containers.
The Azure AD group must not be able to access the keys that are required to access the data.
You need to restrict access to the Azure AD group.
Which role-based access control should you use?
A
DocumentDB Accounts Contributor
B
Cosmos Backup Operator
C
Cosmos DB Operator
D
Cosmos DB Account Reader
Reveal answer detailsClose answer details
Correct answerC
Explanation
Azure Cosmos DB now provides a new RBAC role, Cosmos DB Operator. This new role lets you provision Azure Cosmos accounts, databases, and containers, but can't access the keys that are required to access the data. This role is intended for use in scenarios where the ability to grant access to Azure Active Directory service principals to manage deployment operations for Cosmos DB is needed, including the account, database, and containers.
You are developing a .NET Core model-view controller (MVC) application hosted on Azure for a health care system that allows providers access to their information. You develop the following code:
You define a role named SysAdmin. You need to ensure that the application meets the following authorization requirements: Allow the ProviderAdmin and SysAdmin roles access to the Partner controller regardless of whether the user holds an editor claim of partner. Limit access to the Manage action of the controller to users with an editor claim of partner who are also members of the SysAdmin role. How should you complete the code? To answer, drag the appropriate code segments to the correct locations. Each code segment may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content. NOTE: Each correct selection is worth one point.
Reveal answer detailsClose answer details
Explanation
Box 1: Allow the ProviderAdmin and SysAdmin roles access to the Partner controller regardless of whether the user holds an editor claim of partner. Box 2: Limit access to the Manage action of the controller to users with an editor claim of partner who are also members of the SysAdmin role.
Question 50
Hotspot
HOTSPOT
You have an Azure Web app that uses Azure Cosmos DB as a data store. You create a CosmosDB container by running the following PowerShell script:
You create the following queries that target the container:
SELECT * FROM c WHERE c.EmployeeId > '12345'
SELECT * FROM c WHERE c.UserID = '12345'
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Reveal answer detailsClose answer details
Explanation
Box 1: No You set the highest, or maximum RU/s Tmax you don't want the system to exceed. The system automatically scales the throughput T such that 0.1* Tmax <= T <= Tmax. In this example we have autoscaleMaxThroughput = 5000, so the minimum throughput for the container is 500 R/Us.
Box 2: No
First query: SELECT * FROM c WHERE c.EmployeeId > '12345' Here's a query that has a range filter on the partition key and won't be scoped to a single physical partition. In order to be an in-partition query, the query must have an equality filter that includes the partition key: SELECT * FROM c WHERE c.DeviceId > 'XMS-0001'
Box 3: Yes Example of In-partition query: Consider the below query with an equality filter on DeviceId. If we run this query on a container partitioned on DeviceId, this query will filter to a single physical partition. SELECT * FROM c WHERE c.DeviceId = 'XMS-0001' References: https://docs.microsoft.com/en-us/azure/cosmos-db/how-to-choose-offer https://docs.microsoft.com/en-us/azure/cosmos-db/how-to-query-container
Question 51
Hotspot
HOTSPOT
You are implementing a software as a service (SaaS) ASP.NET Core web service that will run as an Azure Web App. The web service will use an on-premises SQL Server database for storage. The web service also includes a WebJob that processes data updates. Four customers will use the web service.
1. Each instance of the WebJob processes data for a single customer and must run as a singleton instance. 2. Each deployment must be tested by using deployment slots prior to serving production data. 3. Azure costs must be minimized. 4. Azure resources must be located in an isolated network.
You need to configure the App Service plan for the Web App.
How should you configure the App Service plan? To answer, select the appropriate settings in the answer area.
NOTE: Each correct selection is worth one point.
Reveal answer detailsClose answer details
Explanation
Number of VM instances: 4 You are not charged extra for deployment slots.
Pricing tier: Isolated
The App Service Environment (ASE) is a powerful feature offering of the Azure App Service that gives network isolation and improved scale capabilities. It is essentially a deployment of the Azure App Service into a subnet of a customer's Azure Virtual Network (VNet).
Munson's Pickles and Preserves Farm is an agricultural cooperative corporation based in Washington, US, with farms located across the United States. The company supports agricultural production resources by distributing seeds fertilizers, chemicals, fuel, and farm machinery to the farms.
Current Environment
The company is migrating all applications from an on-premises datacenter to Microsoft Azure. Applications support distributors, farmers, and internal company staff.
Corporate website
The company hosts a public website located at http://www.munsonspicklesandpreservesfarm.com. The site supports farmers and distributors who request agricultural production resources.
Farms
The company created a new customer tenant in the Microsoft Entra admin center to support authentication and authorization for applications.
Distributors
Distributors integrate their applications with data that is accessible by using APIs hosted at http://www.munsonspicklesandpreservesfarm.com/api to receive and update resource data.
Requirements
The application components must meet the following requirements:
Corporate website
1. The site must be migrated to Azure App Service. 2. Costs must be minimized when hosting in Azure. 3. Applications must automatically scale independent of the compute resources. 4. All code changes must be validated by internal staff before release to production.
5. File transfer speeds must improve, and webpage-load performance must increase. 6. All site settings must be centrally stored, secured without using secrets, and encrypted at rest and in transit. 7. A queue-based load leveling pattern must be implemented by using Azure Service Bus queues to support high volumes of website agricultural production resource requests.
Farms
Farmers must authenticate to applications by using Microsoft Entra ID.
Distributors
1. The company must track a custom telemetry value with each API call and monitor performance of all APIs. 2. API telemetry values must be charted to evaluate variations and trends for resource data.
Internal staff
1. App and API updates must be validated before release to production. 2. Staff must be able to select a link to direct them back to the production app when validating an app or API update. 3. Staff profile photos and email must be displayed on the website once they authenticate to applications by using their Microsoft Entra ID.
Security
1. All web communications must be secured by using TLS/HTTPS. 2. Web content must be restricted by country/region to support corporate compliance standards. 3. The principle of least privilege must be applied when providing any user rights or process access rights. 4. Managed identities for Azure resources must be used to authenticate services that support Microsoft Entra ID authentication.
Issues
Corporate website
1. Farmers report HTTP 503 errors at the same time as internal staff report that CPU and memory usage are high. 2. Distributors report HTTP 502 errors at the same time as internal staff report that average response times and networking traffic are high. 3. Internal staff report webpage load sizes are large and take a long time to load. 4. Developers receive authentication errors to Service Bus when they debug locally.
Distributors
Many API telemetry values are sent in a short period of time. Telemetry traffic, data costs, and storage costs must be reduced while preserving a statistically correct analysis of the data points sent by the APIs.
Question 52
Testlet 8Hotspot
HOTSPOT
You need to resolve the authentication errors for developers.
Which Service Bus security configuration should you use? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Reveal answer detailsClose answer details
Question 53
Hotspot
HOTSPOT
You have an app that stores player scores for an online game. The app stores data in Azure tables using a class named PlayerScore as the table entity. The table is populated with 100,000 records.
You are reviewing the following section of code that is intended to retrieve 20 records where the player score exceeds 15,000. (Line numbers are included for reference only.)
You have the following code. (Line numbers are included for reference only.)
You store customer information in an Azure Cosmos database. The following data already exists in the database:
You develop the following code. (Line numbers are included for reference only.)
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Reveal answer detailsClose answer details
Question 54
Multiple choice
You are creating a hazard notification system that has a single signaling server which triggers audio and visual alarms to start and stop.
You implement Azure Service Bus to publish alarms. Each alarm controller uses Azure Service Bus to
receive alarm signals as part of a transaction. Alarm events must be recorded for audit purposes. Each transaction record must include information about the alarm type that was activated.
You need to implement a reply trail auditing solution.
NOTE: Each correct selection is worth one point.
A
Assign the value of the hazard message MessageId property to the DeliveryCount property.
B
Assign the value of the hazard message SequenceNumber property to the DeliveryCount property.
C
Assign the value of the hazard message MessageId property to the SequenceNumber property.
D
Assign the value of the hazard message MessageId property to the CorrelationId property.
E
Assign the value of the hazard message SessionID property to the SequenceNumber property..
F
Assign the value of the hazard message SessionID property to the ReplyToSessionId property.
Reveal answer detailsClose answer details
Correct answersD, F
Explanation
D: CorrelationId: Enables an application to specify a context for the message for the purposes of correlation; for example, reflecting the MessageId of a message that is being replied to.
F: ReplyToSessionId: This value augments the ReplyTo information and specifies which SessionId should be set for the reply when sent to the reply entity.
Incorrect Answers: A, B: DeliveryCount Number of deliveries that have been attempted for this message. The count is incremented when a message lock expires, or the message is explicitly abandoned by the receiver. This property is read-only.
C, E: SequenceNumber The sequence number is a unique 64-bit integer assigned to a message as it is accepted and stored by the broker and functions as its true identifier. For partitioned entities, the topmost 16 bits reflect the partition identifier. Sequence numbers monotonically increase and are gapless. They roll over to 0 when the 48-64 bit range is exhausted. This property is read-only.
You are developing an Azure App Service hosted ASP.NET Core API app by using C#. The API app will allow users to authenticate by using Twitter and Azure Active Directory (Azure AD).
Users must be authenticated before calling API methods. You must log the user's name for each method call.
You need to configure the API method calls.
Which values should you use? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Reveal answer detailsClose answer details
Explanation
Box 1: Authorize
Box 2: X-MS-CLIENT-PRINCIPAL-NAME
App Service passes user claims to your application by using special headers. External requests aren't allowed to set these headers, so they are present only if set by App Service. Some example headers include:
X-MS-CLIENT-PRINCIPAL-NAME X-MS-CLIENT-PRINCIPAL-ID Here's the set of headers you get from Easy Auth for a Twitter authenticated user:
You are building a web application that performs image analysis on user photos and returns metadata containing objects identified. The image is very costly in terms of time and compute resources. You are planning to use Azure Redis Cache so duplicate uploads do not need to be reprocessed.
In case of an Azure data center outage, metadata loss must be kept to a minimum. You need to configure the Azure Redis cache instance.
Which two actions should you perform?
A
Configure Azure Redis with AOF persistence.
B
Configure Azure Redis with RDB persistence.
C
Configure second storage account for persistence.
D
Set backup frequency to the minimum value.
Reveal answer detailsClose answer details
Correct answersA, C
Explanation
"RDB is NOT good if you need to minimize the chance of data loss in case Redis stops working". source: https://redis.io/docs/management/persistence/ since the question doesn't mention ZRS for Redis cache, we can use AOF with a 2nd storage to store replica cache data. check the config with AOF: https://learn.microsoft.com/en-us/azure/azure-cache-for-redis/cache-how-to-premium-persistence#set-up-data-persistence
Case study
Case Study 2
Current environment
Windows Server 2016 virtual machine
This virtual machine (VM) runs BizTalk Server 2016. The VM runs the following workflows:
1. Ocean Transport - This workflow gathers and validates container information including container contents and arrival notices at various shipping ports. 2. Inland Transport - This workflow gathers and validates trucking information including fuel usage, number of stops, and routes.
The VM supports the following REST API calls:
1. Container API - This API provides container information including weight, contents, and other attributes. 2. Location API - This API provides location information regarding shipping ports of call and trucking stops. 3. Shipping REST API - This API provides shipping information for use and display on the shipping website.
Shipping Data
The application uses MongoDB JSON document storage database for all container and transport information.
Shipping Web Site
The site displays shipping container tracking information and container contents. The site is located at http://shipping.wideworldimporters.com/
Proposed solution
The on-premises shipping application must be moved to Azure. The VM has been migrated to a new Standard_D16s_v3 Azure VM by using Azure Site Recovery and must remain running in Azure to complete the BizTalk component migrations. You create a Standard_D16s_v3 Azure VM to host BizTalk Server. The Azure architecture diagram for the proposed solution is shown below:
Requirements
Shipping Logic app
The Shipping Logic app must meet the following requirements:
1. Support the ocean transport and inland transport workflows by using a Logic App. 2. Support industry-standard protocol X12 message format for various messages including vessel content details and arrival notices. 3. Secure resources to the corporate VNet and use dedicated storage resources with a fixed costing model. 4. Maintain on-premises connectivity to support legacy applications and final BizTalk migrations.
Shipping Function app
Implement secure function endpoints by using app-level security and include Azure Active Directory (Azure AD).
REST APIs
The REST API's that support the solution must meet the following requirements:
1. Secure resources to the corporate VNet. 2. Allow deployment to a testing location within Azure while not incurring additional costs. 3. Automatically scale to double capacity during peak shipping times while not causing application downtime. 4. Minimize costs when selecting an Azure payment model.
Shipping data
Data migration from on-premises to Azure must minimize costs and downtime.
Shipping website
Use Azure Content Delivery Network (CDN) and ensure maximum performance for dynamic content while minimizing latency and costs.
Issues
Windows Server 2016 VM
The VM shows high network latency, jitter, and high CPU utilization. The VM is critical and has not been
backed up in the past. The VM must enable a quick restore from a 7-day snapshot to include in-place restore of disks in case of failure.
Shipping website and REST APIs
The following error message displays while you are testing the website:
Failed to load http://test-shippingapi.wideworldimporters.com/: No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'http://test.wideworldimporters.com/' is therefore not allowed access.
Question 57
Testlet 2Hotspot
HOTSPOT
You need to configure Azure App Service to support the REST API requirements.
Which values should you use? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Reveal answer detailsClose answer details
Explanation
Plan: Standard Standard support auto-scaling Instance Count: 10 Max instances for standard is 10.
Scenario: The REST API's that support the solution must meet the following requirements:
1. Allow deployment to a testing location within Azure while not incurring additional costs. 2. Automatically scale to double capacity during peak shipping times while not causing application downtime. 3. Minimize costs when selecting an Azure payment model
You are developing an application that use an Azure blob named data to store application data. The application creates blob snapshots to allow application state to be reverted to an earlier state. The Azure storage account has soft deleted enabled.
The system performs the following operations in order:
1. The blob is updated 2. Snapshot 1 is created. 3. Snapshot 2 is created. 4. Snapshot 1 is deleted.
A system error then deletes the data blob and all snapshots.
You need to determine which application states can be restored.
What is the restorability of the application data? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Reveal answer detailsClose answer details
Explanation
Box 1: Can be restored. When enabled, soft delete enables you to save and recover your data when blobs or blob snapshots are deleted. This protection extends to blob data that is erased as the result of an overwrite.
You are developing an application to retrieve user profile information. The application will use the Microsoft Graph SDK.
The app must retrieve user profile information by using a Microsoft Graph API call.
You need to call the Microsoft Graph API from the application.
In which order should you perform the actions? To answer, move all actions from the list of actions to the answer area and arrange them in the correct order.
Reveal answer detailsClose answer details
Explanation
Step 1: Register the application with the Microsoft identity platform. To authenticate with the Microsoft identity platform endpoint, you must first register your app at the Azure app registration portal
Step 2: Build a client by using the client app ID
Step 3: Create an authentication provider Create an authentication provider by passing in a client application and graph scopes.
Code example: DeviceCodeProvider authProvider = new DeviceCodeProvider(publicClientApplication, graphScopes); // Create a new instance of GraphServiceClient with the authentication provider. GraphServiceClient graphClient = new GraphServiceClient(authProvider);
Step 4: Create a new instance of the GraphServiceClient
Step 5: Invoke the request to the Microsoft Graph API
You need to design network connectivity for a subnet in an Azure virtual network. The subnet will contain 30 virtual machines. The virtual machines will establish outbound connections to internet hosts by using the same a pool of four public IP addresses, inbound connections to the virtual machines will be prevented.
What should include in the design?
A
Azure Private Link
B
NAT Gateway
C
User Defined Routes
D
Azure Virtual WAN
Reveal answer detailsClose answer details
Correct answerD
Question 61
Single choice
You develop Azure solutions.
A .NET application needs to receive a message each time an Azure virtual machine finishes processing data. The messages must NOT persist after being processed by the receiving application.
You need to implement the .NET object that will receive the messages.
Which object should you use?
A
QueueClient
B
SubscriptionClient
C
TopicClient
D
CloudQueueClient
Reveal answer detailsClose answer details
Correct answerA
Explanation
A queue allows processing of a message by a single consumer. Need a CloudQueueClient to access the Azure VM.
Incorrect Answers: B, C: In contrast to queues, topics and subscriptions provide a one-to-many form of communication in a publish and subscribe pattern. It's useful for scaling to large numbers of recipients.
The solution must receive and store messages until they can be processed. You create an Azure Service Bus instance by providing a name, pricing tier, subscription, resource group, and location.
You need to complete the configuration.
Which Azure CLI or PowerShell command should you run?
Fourth Coffee is a global coffeehouse chain and coffee company recognized as one of the world's most influential coffee brands. The company is renowned for its specialty coffee beverages, including a wide range of espresso-based dnnks, teas, and other beverages. Fourth Coffee operates thousands of stores worldwide. The company is developing cloud-native applications hosted in Azure.
Corporate website The company hosts a public website located at http://www.fourthcoffee.com/. The website is used to place orders as well as view and update inventory items.
Inventory items In addition to its core coffee offerings, Fourth Coffee recently expanded its menu to include inventory items such as lunch items, snacks, and merchandise. Corporate team members constantly update inventory. Users can customize items. Corporate team members configure inventory items and associated images on the website.
Orders Associates in the store serve customized beverages and items to customers. Orders are placed on the website for pickup. The application components process data as follows: 1. Azure Traffic Manager routes a user order request to the corporate website hosted in Azure App Service. 2. Azure Content Delivery Network serves static images and content to the user. 3. The user signs in to the application through a Microsoft Entra ID for customers tenant. 4. Users search for items and place an order on the website as item images are pulled from Azure Blob Storage 5. Item customizations are placed in an Azure Service Bus queue message. 6. Azure Functions processes item customizations and saves the customized items to Azure Cosmos DB. 7. The website saves order details to Azure SQL Database. 8. SQL Database query results are cached in Azure Cache for Redis to improve performance.
The application consists of the following Azure services:
Requirements
The application components must meet the following requirements: 1. Azure Cosmos DB development must use a native API that receives the latest updates and stores data in a document format. 2. Costs must be minimized for all Azure services. 3. Developers must test Azure Blob Storage integrations locally before deployment to Azure Testing must support the latest versions of the Azure Storage APIs.
Corporate website 1. User authentication and authorization must allow one-time passcode sign-in methods and social identity providers (Google or Facebook). 2. Static web content must be stored closest to end users to reduce network latency.
Inventory items 1. Customized items read from Azure Cosmos DB must maximize throughput while ensuring data is
accurate for the current user on the website. 2. Processing of inventory item updates must automatically scale and enable updates across an entire Azure Cosmos DB container. 3. Inventory items must be processed in the order they were placed in the queue. 4. Inventory item images must be stored as JPEG files in their native format to include exchangeable image file format (data) stored with the blob data upon upload of the image file. 5. The Inventory Items API must securely access the Azure Cosmos DB data.
Orders Orders must receive inventory item changes automatically after inventory items are updated or saved.
Issues 1. Developers are storing the Azure Cosmos DB credentials in an insecure clear text manner within the Inventory Items API code. 2. Production Azure Cache for Redis maintenance has negatively affected application performance.
Question 63
Testlet 9Hotspot
HOTSPOT
You need to save customized items to Azure Cosmos DB.
Which Azure Cosmos DB configuration should you use? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Reveal answer detailsClose answer details
Question 64
Multiple choice
You develop a Python application for image rendering that uses GPU resources to optimize rendering processes. You deploy the application to an Azure Container Instances (ACI) Linux container.
The application requires a secret value to be passed when the container is started. The value must only be accessed from within the container.
You need to pass the secret value.
What are two possible ways to achieve this goal? Each correct answer presents a complete solution.
NOTE: Each correct selection is worth one point.
A
Create an environment variable Set the secureValue property to the secret value.
B
Add the secret value to the container image. Use a managed identity.
C
Add the secret value to the application code Set the container startup command.
D
Add the secret value to an Azure Blob storage account. Generate a SAS token.
E
Mount a secret volume containing the secret value in a secrets file.
Reveal answer detailsClose answer details
Correct answersA, E
Explanation
A: Secure environment variables - Another method (another than a secret volume) for providing sensitive information to containers (including Windows containers) is through the use of secure environment variables. E: Use a secret volume to supply sensitive information to the containers in a container group. The secret volume stores your secrets in files within the volume, accessible by the containers in the container group. By storing secrets in a secret volume, you can avoid adding sensitive data like SSH keys or database credentials to your application code. References: https://docs.microsoft.com/en-us/azure/container-instances/container-instances-volume-secret
Question 65
Drag & drop
DRAG DROP
You are developing several microservices to run on Azure Container Apps.
The microservices must allow HTTPS access by using a custom domain.
You need to configure the custom domain in Azure Container Apps.
In which order should you perform the actions? To answer, move all actions from the list of actions to the answer area and arrange them in the correct order.
Reveal answer detailsClose answer details
Explanation
Step 1: Enable ingress
Step 2: Add the custom domain name
Step 3: Validate the custom domain name
Step 4: Bind certificate
Step 5: Add DNS records to the domain
Custom domain names and bring your own certificates in Azure Container Apps Add a custom domain and certificate 1. Navigate to your container app in the Azure portal 2. Verify that your app has ingress enabled by selecting Ingress in the Settings section. If ingress is not enabled, enable it. (Step 1) 3. Under the Settings section, select Custom domains. 4. Select the Add custom domain button. (Step 2) 5. In the Add custom domain and certificate window, in TLS/SSL certificate, select Bring your own certificate. (Step 3) 6. In domain, enter the domain you want to add. 7. Select Add a certificate. 8. In the Add certificate window, in Certificate name, enter a name for this certificate. (Step 4)
9. In Certificate file section, browse for the certificate file you want to upload. 10. Select Validate. 11. Once validation succeeds, select Add. 12. In the Add custom domain and certificate window, in Certificate, select the certificate you just added. 13. Select the Hostname record type based on the type of your domain. 14. Using the DNS provider that is hosting your domain, create DNS records based on the Hostname record type you selected using the values shown in the Domain validation section. The records point the domain to your container app and verify that you own it. (Step 5) 15. Select the Validate button. 16. Once validation succeeds, select the Add button. 17. Once the operation is complete, you see your domain name in the list of custom domains with a status of Secured. Navigate to your domain to verify that it's accessible.
You are creating an app that uses Event Grid to connect with other services. Your app's event data will be sent to a serverless function that checks compliance. This function is maintained by your company.
You write a new event subscription at the scope of your resource. The event must be invalidated after 3
specific period of time. You need to configure Event Grid to ensure security.
What should you implement? To answer, select the appropriate options in the answer area;
NOTE: Each correct selection is worth one point
Reveal answer detailsClose answer details
Explanation
Box 1: SAS tokens Custom topics use either Shared Access Signature (SAS) or key authentication.
Microsoft recommends SAS, but key authentication provides simple programming, and is compatible with many existing webhook publishers. In this case we need the expiration time provided by SAS tokens. Box 2: ValidationCode handshake Event Grid supports two ways of validating the subscription: ValidationCode handshake (programmatic) and ValidationURL handshake (manual). If you control the source code for your endpoint, this method is recommended. Incorrect Answers: ValidationURL handshake (manual): In certain cases, you can't access the source code of the endpoint to implement the ValidationCode handshake. For example, if you use a third-party service (like Zapier or IFTTT), you can't programmatically respond with the validation code. References: https://docs.microsoft.com/en-us/azure/event-grid/security-authentication
Question 67
Single choice
You develop Azure solutions.
You must connect to a No-SQL globally-distributed database by using the .NET API.
You need to create an object to configure and execute requests in the database.
Which code segment should you use?
A
new Container(EndpointUri, PrimaryKey);
B
new Database(Endpoint, PrimaryKey);
C
new CosmosClient(EndpointUri, PrimaryKey);
Reveal answer detailsClose answer details
Correct answerC
Explanation
Example: // Create a new instance of the Cosmos Client this.cosmosClient = new CosmosClient(EndpointUri, PrimaryKey)
//ADD THIS PART TO YOUR CODE await this.CreateDatabaseAsync();
You develop a web application that sells access to last-minute openings for child camps that run on the weekends. The application uses Azure Application Insights for all alerting and monitoring.
The application must alert operators when a technical issue is preventing sales to camps.
You need to build an alert to detect technical issues.
Which alert type should you use?
A
Metric alert using multiple time series
B
Metric alert using dynamic thresholds
C
Log alert using multiple time series
D
Log alert using dynamic thresholds
Reveal answer detailsClose answer details
Correct answerB
Explanation
Availability alerts Application Insights availability tests send web requests to your application at regular intervals from points around the world. You can receive alerts if your application isn't responding or if it responds too slowly.
Create a custom alert rule If you need advanced capabilities, you can create a custom alert rule on the Alerts tab. Select Create > Alert rule. Choose Metrics for Signal type to show all available signals and select Availability.
In the Alert logic section: * Threshold Select if the threshold should be evaluated based on a static value or a dynamic value. A static threshold evaluates the rule by using the threshold value that you configure. Dynamic thresholds use machine learning algorithms to continuously learn the metric behavior patterns and calculate the appropriate thresholds for unexpected behavior.
You are developing an Azure-hosted application that must use an on-premises hardware security module (HSM) key.
The key must be transferred to your existing Azure Key Vault by using the Bring Your Own Key (BYOK) process.
You need to securely transfer the key to Azure Key Vault.
Which four actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.
Reveal answer detailsClose answer details
Explanation
To perform a key transfer, a user performs following steps: 1. Generate KEK. 2. Retrieve the public key of the KEK. 3. Using HSM vendor provided BYOK tool - Import the KEK into the target HSM and exports the Target Key protected by the KEK. 4. Import the protected Target Key to Azure Key Vault.
Step 1: Generate a Key Exchange Key (KEK).
Step 2: Retrieve the Key Exchange Key (KEK) public key.
Step 3: Generate a key transfer blob file by using the HSM vendor-provided tool. Generate key transfer blob using HSM vendor provided BYOK tool
Step 4: Run the az keyvault key import command Upload key transfer blob to import HSM-key. Customer will transfer the Key Transfer Blob (".byok" file) to an online workstation and then run a az keyvault key import command to import this blob as a new HSM-backed key into Key Vault.
To import an RSA key use this command: az keyvault key import
You need to test the availability of the corporate website.
Which two test types can you use?
A
Custom testing using the TrackAvailability API method
B
Standard
C
URL Ping
D
Multi-step
Reveal answer detailsClose answer details
Correct answersA, B
Question 71
Single choice
Note: The question is included in a number of questions that depicts the identical set-up. However, every question has a distinctive result. Establish if the solution satisfies the requirements.
You are developing a solution for a public facing API.
The API back end is hosted in an Azure App Service instance. You have implemented a RESTful service for the API back end.
You must configure back-end authentication for the API Management service instance.
Solution: You configure Basic gateway credentials for the Azure resource.
Does the solution meet the goal?
A
Yes
B
No
Reveal answer detailsClose answer details
Correct answerB
Explanation
API Management allows to secure access to the back-end service of an API using client certificates.
You are developing an application that uses Azure Blob storage.
The application must read the transaction logs of all the changes that occur to the blobs and the blob metadata in the storage account for auditing purposes. The changes must be in the order in which they occurred, include only create, update, delete, and copy operations and be retained for compliance reasons.
You need to process the transaction logs asynchronously.
What should you do?
A
Process all Azure Blob storage events by using Azure Event Grid with a subscriber Azure Function app.
B
Enable the change feed on the storage account and process all changes for available events.
C
Process all Azure Storage Analytics logs for successful blob events.
D
Use the Azure Monitor HTTP Data Collector API and scan the request body for successful blob events.
Reveal answer detailsClose answer details
Correct answerB
Explanation
Change feed support in Azure Blob Storage The purpose of the change feed is to provide transaction logs of all the changes that occur to the blobs and the blob metadata in your storage account. The change feed provides ordered, guaranteed, durable, immutable, read-only log of these changes. Client applications can read these logs at any time, either in streaming or in batch mode. The change feed enables you to build efficient and scalable solutions that process change events that occur in your Blob Storage account at a low cost.
You have downloaded an Azure Resource Manager template to deploy numerous virtual machines. The template is based on a current virtual machine, but must be adapted to reference an administrative password.
You need to make sure that the password is not stored in plain text.
You are preparing to create the necessary components to achieve your goal.
Which of the following should you create to achieve your goal? Answer by dragging the correct option from the list to the answer area.
Reveal answer detailsClose answer details
Question 74
Single choice
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You are developing a medical records document management website. The website is used to store
scanned copies of patient intake forms.
If the stored intake forms are downloaded from storage by a third party, the contents of the forms must not be compromised.
You need to store the intake forms according to the requirements.
Solution: 1. Create an Azure Cosmos DB database with Storage Service Encryption enabled. 2. Store the intake forms in the Azure Cosmos DB database.
Does the solution meet the goal?
A
Yes
B
No
Reveal answer detailsClose answer details
Correct answerB
Explanation
Instead use an Azure Key vault and public key encryption. Store the encrypted from in Azure Storage Blob storage.
Question 75
Drag & drop
DRAG DROP
You manage several existing Logic Apps.
You need to change definitions, add new logic, and optimize these apps on a regular basis.
What should you use? To answer, drag the appropriate tools to the correct functionalities. Each tool may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.
NOTE: Each correct selection is worth one point.
Reveal answer detailsClose answer details
Explanation
Box 1: Enterprise Integration Pack For business-to-business (B2B) solutions and seamless communication between organizations, you can build automated scalable enterprise integration workflows by using the Enterprise Integration Pack (EIP) with Azure Logic Apps.
Box 2: Code View Editor Edit JSON - Azure portal 1. Sign in to the Azure portal. 2. From the left menu, choose All services. In the search box, find "logic apps", and then from the results, select your logic app. 3. On your logic app's menu, under Development Tools, select Logic App Code View. 4. The Code View editor opens and shows your logic app definition in JSON format.
The Azure Functions app has the following requirements:
Must be triggered by a message placed in an Azure Storage queue. Must use the queue name set by an app setting named input_queue. Must create an Azure Blob Storage named the same as the content of the message.
You need to identify how to reference the queue and blob name in the function.json file of the Azure Functions app.
How should you reference the names? To answer, select the appropriate values in the answer area.
NOTE: Each correct selection is worth one point.
Reveal answer detailsClose answer details
Explanation
Box 1: {input_queue} Queue name Must be triggered by a message placed in an Azure Storage queue. Must use the queue name set by an app setting named input_queue.
Most expressions are identified by wrapping them in curly braces.
Box 2: {queueTrigger} Blob name Must create an Azure Blob Storage named the same as the content of the message.
Most expressions are identified by wrapping them in curly braces. For example, in a queue trigger function, {queueTrigger} resolves to the queue message text. If the path property for a blob output binding is container/{queueTrigger} and the function is triggered by a queue message HelloWorld, a blob named HelloWorld is created.
You are developing a microservice to run on Azure Container Apps for a company. External HTTP ingress traffic has been enabled.
The company requires that updates to the microservice must not cause downtime.
You need to deploy an update to the microservices.
What should you do?
A
Enable single revision mode.
B
Use multiple environments for each container.
C
Use a private container registry and single image for all containers.
D
Use a single environment for all containers.
E
Enable multiple revision mode.
Reveal answer detailsClose answer details
Correct answerA
Explanation
Update As a container app is updated with a revision scope-change, a new revision is created. You can choose whether to automatically deactivate old revisions (single revision mode), or allow them to remain available (multiple revision mode).
When in single revision mode, Container Apps handles the automatic switch between revisions to support zero downtime deployment.
You are a developer for Contoso, Ltd. The company has a social networking website that is developed as a Single Page Application (SPA). The main web application for the social networking website loads user uploaded content from blob storage.
You are developing a solution to monitor uploaded data for inappropriate content. The following process occurs when users upload content by using the SPA:
1. Messages are sent to ContentUploadService. 2. Content is processed by ContentAnalysisService. 3. After processing is complete, the content is posted to the social network or a rejection message is posted in its place.
The ContentAnalysisService is deployed with Azure Container Instances from a private Azure Container Registry named contosoimages.
The solution will use eight CPU cores.
Azure Active Directory
Contoso, Ltd. uses Azure Active Directory (Azure AD) for both internal and guest accounts.
Requirements
ContentAnalysisService
The company's data science group built ContentAnalysisService which accepts user generated content as a string and returns a probable value for inappropriate content. Any values over a specific threshold must be reviewed by an employee of Contoso, Ltd.
You must create an Azure Function named CheckUserContent to perform the content checks.
Costs
You must minimize costs for all Azure services.
Manual review
To review content, the user must authenticate to the website portion of the ContentAnalysisService using their Azure AD credentials. The website is built using React and all pages and API endpoints require authentication. In order to review content a user must be part of a ContentReviewer role. All completed reviews must include the reviewer's email address for auditing purposes.
High availability
All services must run in multiple regions. The failure of any service in a region must not impact overall application availability.
Monitoring
An alert must be raised if the ContentUploadService uses more than 80 percent of available CPU cores.
Security
You have the following security requirements: 1. Any web service accessible over the Internet must be protected from cross site scripting attacks. 2. All websites and services must use SSL from a valid root certificate authority. 3. Azure Storage access keys must only be stored in memory and must be available only to the service. 4. All Internal services must only be accessible from internal Virtual Networks (VNets). 5. All parts of the system must support inbound and outbound traffic restrictions. 6. All service calls must be authenticated by using Azure AD.
User agreements
When a user submits content, they must agree to a user agreement. The agreement allows employees of Contoso, Ltd. to review content, store cookies on user devices, and track user's IP addresses.
Information regarding agreements is used by multiple divisions within Contoso, Ltd.
User responses must not be lost and must be available to all parties regardless of individual service uptime. The volume of agreements is expected to be in the millions per hour.
Validation testing
When a new version of the ContentAnalysisService is available the previous seven days of content must be processed with the new version to verify that the new version does not significantly deviate from the old version.
Issues
Users of the ContentUploadService report that they occasionally see HTTP 502 responses on specific pages.
Code
ContentUploadService
Question 78
Testlet 3Single choice
You need to deploy the CheckUserContent Azure Function. The solution must meet the security and cost requirements.
Which hosting model should you use?
A
Premium plan
B
App Service plan
C
Consumption plan
Reveal answer detailsClose answer details
Correct answerB
Explanation
Scenario: You must minimize costs for all Azure services. All Internal services must only be accessible from internal Virtual Networks (VNets).
Best for long-running scenarios where Durable Functions can't be used. Consider an App Service plan in the following situations: 1. You have existing, underutilized VMs that are already running other App Service instances. 2. You want to provide a custom image on which to run your functions. 3. Predictive scaling and costs are required.
Note: When you create a function app in Azure, you must choose a hosting plan for your app. There are three basic hosting plans available for Azure Functions: Consumption plan, Premium plan, and Dedicated (App Service) plan.
Incorrect Answers: A: A Premium plan would be more costly. C: Need the VNET functionality.
Note: This question is part of a series of questions that present the same scenario. Each question in the
series contains a unique solution. Determine whether the solution meets the stated goals.
You are developing and deploying several ASP.Net web applications to Azure App Service. You plan to save session state information and HTML output. You must use a storage mechanism with the following requirements:
1. Share session state across all ASP.NET web applications 2. Support controlled, concurrent access to the same session state data for multiple readers and a single writer 3. Save full HTTP responses for concurrent requests
You need to store the information.
Proposed Solution: Add the web applications to Docker containers. Deploy the containers. Deploy the containers to Azure Kubernetes Service (AKS).
Does the solution meet the goal?
A
Yes
B
No
Reveal answer detailsClose answer details
Correct answerB
Explanation
Instead use Azure Cache for Redis.
Note: Azure Cache for Redis provides a session state provider that you can use to store your session state in-memory with Azure Cache for Redis instead of a SQL Server database. To use the caching session state provider, first configure your cache, and then configure your ASP.NET application for cache using the Azure Cache for Redis Session State NuGet package.
You are developing a ticket reservation system for an airline.
The storage solution for the application must meet the following requirements:
Ensure at least 99/99% availability and provide low latency. Accept reservations even in network outages or other unforseen failures Process reservations in the exact sequence as reservation are submitted to minimize overbooking or selling the same seat to multiple travelers. Allow simultaneous and out-of-order reservations with a maximum five-second tolerance window.
You provision a resource group named airlineResourceGroup in the Azure South-Central US region.
You need to provision a SQL API Cosmos DB account to support the app.
How should you complete the Azure CLI commands? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Reveal answer detailsClose answer details
Explanation
Box 1: Strong Strong consistency offers a linearizability guarantee. The reads are guaranteed to return the most recent committed version of an item. A client never sees an uncommitted or partial write. Users are always guaranteed to read the latest committed write.
" Process reservations in the exact sequence as reservation are submitted to minimize overbooking or selling the same seat to multiple travelers."
Box 2: Enable-automatic-failover For multi-region Cosmos accounts that are configured with a single-write region, enable automatic-failover by using Azure CLI or Azure portal. After you enable automatic failover, whenever there is a regional disaster, Cosmos DB will automatically failover your account.
" Accept reservations even in network outages or other unforseen failures"
Box 3: southcentralus " You provision a resource group named airlineResourceGroup in the Azure South-Central US region."
The API must be called by an Azure App Service web app. The API must retrieve and update user profile information stored in Azure Active Directory (Azure AD).
You need to configure the API to make the updates.
Which two tools should you use? Each correct answer presents part of the solution
NOTE: Each correct selection is worth one point.
A
Microsoft Graph API
B
Microsoft Authentication Library (MSAL)
C
Azure API Management
D
Microsoft Azure Security Center
E
Microsoft Azure Key Vault SDK
Reveal answer detailsClose answer details
Correct answersA, C
Explanation
A: You can use the Azure AD REST APIs in Microsoft Graph to create unique workflows between Azure AD resources and third-party services.
Enterprise developers use Microsoft Graph to integrate Azure AD identity management and other services to automate administrative workflows, such as employee onboarding (and termination), profile maintenance, license deployment, and more.
C: API Management (APIM) is a way to create consistent and modern API gateways for existing back-end services.
API Management helps organizations publish APIs to external, partner, and internal developers to unlock the potential of their data and services.
You have an application that includes an Azure Web app and several Azure Function apps. Application secrets including connection strings and certificates are stored in Azure Key Vault.
Secrets must not be stored in the application or application runtime environment. Changes to Azure Active Directory (Azure AD) must be minimized.
You need to design the approach to loading application secrets.
What should you do?
A
Create a single user-assigned Managed Identity with permission to access Key Vault and configure each App Service to use that Managed Identity.
B
Create a single Azure AD Service Principal with permission to access Key Vault and use a client secret from within the App Services to access Key Vault.
C
Create a system assigned Managed Identity in each App Service with permission to access Key Vault.
D
Create an Azure AD Service Principal with Permissions to access Key Vault for each App Service and use a certificate from within the App Services to access Key Vault.
Reveal answer detailsClose answer details
Correct answerC
Explanation
Use Key Vault references for App Service and Azure Functions. Key Vault references currently only support system-assigned managed identities. User-assigned identities cannot be used.
You are developing a software solution for an autonomous transportation system. The solution uses large data sets and Azure Batch processing to simulate navigation sets for entire fleets of vehicles.
You need to create compute nodes for the solution on Azure Batch.
What should you do?
A
In the Azure portal, add a Job to a Batch account.
B
In a .NET method, call the method: BatchClient.PoolOperations.CreateJob
C
In Python, implement the class: JobAddParameter
D
In Azure CLI, run the command: az batch pool create
Reveal answer detailsClose answer details
Correct answerB
Explanation
A Batch job is a logical grouping of one or more tasks. A job includes settings common to the tasks, such as priority and the pool to run tasks on. The app uses the BatchClient.JobOperations.CreateJob method to create a job on your pool.
Note: Step 1: Create a pool of compute nodes. When you create a pool, you specify the number of compute nodes for the pool, their size, and the operating system. When each task in your job runs, it's assigned to execute on one of the nodes in your pool. Step 2 : Create a job. A job manages a collection of tasks. You associate each job to a specific pool where that job's tasks will run. Step 3: Add tasks to the job. Each task runs the application or script that you uploaded to process the data files it downloads from your Storage account. As each task completes, it can upload its output to Azure Storage.
Incorrect Answers: C: To create a Batch pool in Python, the app uses the PoolAddParameter class to set the number of nodes, VM size, and a pool configuration.
You are building a traffic monitoring system that monitors traffic along six highways. The system produces time series analysis-based reports for each highway. Data from traffic sensors are stored in Azure Event Hub.
Traffic data is consumed by four departments. Each department has an Azure Web App that displays the time-series-based reports and contains a WebJob that processes the incoming data from Event Hub. All Web Apps run on App Service Plans with three instances.
Data throughout must be maximized. Latency must be minimized.
You need to implement the Azure Event Hub.
Which settings should you use? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Reveal answer detailsClose answer details
Explanation
Box 1: 6 The number of partitions is specified at creation and must be between 2 and 32. There are 6 highways.
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You develop and deploy an Azure App Service API app to a Windows-hosted deployment slot named Development. You create additional deployment slots named Testing and Production. You enable auto swap on the Production deployment slot.
You need to ensure that scripts run and resources are available before a swap operation occurs.
Solution: Enable auto swap for the Testing slot. Deploy the app to the Testing slot.
Does the solution meet the goal?
A
No
B
Yes
Reveal answer detailsClose answer details
Correct answerB
Explanation
Instead update the web.config file to include the applicationInitialization configuration element. Specify custom initialization actions to run the scripts.
Note: Some apps might require custom warm-up actions before the swap. The applicationInitialization configuration element in web.config lets you specify custom initialization actions. The swap operation waits for this custom warm-up to finish before swapping with the target slot. Here's a sample web.config fragment.
You are developing a service where customers can report news events from a browser using Azure Web PubSub. The service is implemented as an Azure Function App that uses the JSON WebSocket
subprotocol to receive news events.
You need to implement the bindings for the Azure Function App.
How should you configure the binding? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Reveal answer detailsClose answer details
Explanation
Box 1: webPubSubTrigger WebPubSubTrigger is used when you need to handle requests from service side.
Box 2: user eventType - Required - the value must be set as the event type of messages for the function to be triggered. The value should be either user or system.
You develop and deploy an Azure App Service web app that connects to Azure Cache for Redis as a content cache. All resources have been deployed to the East US 2 region.
The security team requires the following audit information from Azure Cache for Redis:
1. The number of Redis client connections from an associated IP address. 2. Redis operations completed on the content cache. 3. The location (region) in which the Azure Cach3e for Redis instance was accessed.
The audit information must be captured and analyzed by a security team application deployed to the Central US region.
You need to log information on all client connections to the cache.
Which configuration values should you use? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Reveal answer detailsClose answer details
Explanation
Box 1: Log Analytics workspace The regions are different so we must the Log Analytics workspace as Log Destinations
Note: Log Destinations You can turn on diagnostic settings for Azure Cache for Redis instances and send resource logs to the following destinations:
Log Analytics workspace - doesn't need to be in the same region as the resource being monitored.
Storage account - must be in the same region as the cache.
Event hub - diagnostic settings can't access event hub resources when virtual networks are enabled. The event hub must be in the same region as the cache.
Box 2: Diagnostic settings Monitor Azure Cache for Redis data using diagnostic settings Diagnostic settings in Azure are used to collect resource logs. An Azure resource emits resource logs and provides rich, frequent data about the operation of that resource. These logs are captured per request and are also referred to as "data plane logs".
You are developing a medical records document management website. The website is used to store scanned copies of patient intake forms. If the stored intake forms are downloaded from storage by a third party, the content of the forms must not be compromised.
You need to store the intake forms according to the requirements.
Solution: uk.co.certification.simulator.questionpool.PList@1898d9c0 Does the solution meet the goal?
A
Yes
B
No
Reveal answer detailsClose answer details
Correct answerB
Explanation
Instead use an Azure Key vault and public key encryption. Store the encrypted from in Azure Storage Blob storage.
Question 89
Single choice
Note: The question is included in a number of questions that depicts the identical set-up. However, every question has a distinctive result. Establish if the solution satisfies the requirements.
You are configuring a web app that delivers streaming video to users. The application makes use of continuous integration and deployment.
You need to ensure that the application is highly available and that the users' streaming experience is constant. You also want to configure the application to store data in a geographic location that is nearest to the user.
Solution: You include the use of a Storage Area Network (SAN) in your design.
You provisioned an Azure Cosmos DB for NoSQL account named account1 with the default consistency level.
You plan to configure the consistency level on a per request basis. The level needs to be set for consistent prefix for read and write operations to account1.
You need to identify the resulting consistency level for read and write operations.
Which levels should you configure? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Correct Answer:
Explanation
Explanation/Reference:
Box 1: consistent prefix
Note: Override the default consistency level Clients can override the default consistency level that is set by the service. Consistency level can be set on a per request, which overrides the default consistency level set at the account level.
Consistency can only be relaxed at the SDK instance or request level. To move from weaker to stronger consistency, update the default consistency for the Azure Cosmos DB account.
Azure Cosmos DB offers five well-defined levels. From strongest to weakest, the levels are:
Box 2: session One of the consistency levels in Azure Cosmos DB is Session consistency. This is the default level applied to Azure Cosmos DB accounts by default.
Overriding the default consistency level only applies to reads within the SDK client. An account configured for strong consistency by default will still write and replicate data synchronously to every region in the account.
You are developing an Azure solution to collect inventory data from thousands of stores located around the world. Each store location will send the inventory data hourly to an Azure Blob storage account for processing.
The solution must meet the following requirements:
1. Begin processing when data is saved to Azure Blob storage. 2. Filter data based on store location information. 3. Trigger an Azure Logic App to process the data for output to Azure Cosmos DB. 4. Enable high availability and geographic distribution. 5. Allow 24-hours for retries. 6. Implement an exponential back off data processing.
You need to configure the solution.
What should you implement? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Correct Answer:
Explanation
Explanation/Reference:
Box 1: Azure Event Grid Blob storage events are pushed using Azure Event Grid to subscribers such as Azure Functions, Azure Logic Apps, or even to your own http listener. Event Grid provides reliable event delivery to your applications through rich retry policies and dead-lettering.
Box 2: Azure Logic App Event Grid uses event subscriptions to route event messages to subscribers. This image illustrates the relationship between event publishers, event subscriptions, and event handlers.
Box 3: Azure Service Bus The Event Grid service doesn't store events. Instead, events are stored in the Event Handlers, including ServiceBus, EventHubs, Storage Queue, WebHook endpoint, or many other supported Azure Services.
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You are developing an Azure solution to collect point-of-sale (POS) device data from 2,000 stores located throughout the world. A single device can produce 2 megabytes (MB) of data every 24 hours. Each store location has one to five devices that send data.
You must store the device data in Azure Blob storage. Device data must be correlated based on a device identifier. Additional stores are expected to open in the future.
You need to implement a solution to receive the device data.
Solution: Provision an Azure Service Bus. Configure a topic to receive the device data by using a correlation filter.
Does the solution meet the goal?
A.
Yes
B.
No
Correct Answer: A
Explanation
Explanation/Reference:
A message is raw data produced by a service to be consumed or stored elsewhere. The Service Bus is for high-value enterprise messaging, and is used for order processing and financial transactions.
You need to ensure that the solution meets the following requirements:
1. Provide transactional support. 2. Provide duplicate detection. 3. Store the messages for an unlimited period of time.
Which two technologies will meet the requirements? Each correct answer presents a complete solution.
NOTE: Each correct selection is worth one point.
A.
Azure Service Bus Topic
B.
Azure Service Bus Queue
C.
Azure Storage Queue
D.
Azure Event Hub
Correct Answer: AB
Explanation
Explanation/Reference:
The Azure Service Bus Queue and Topic has duplicate detection. Enabling duplicate detection helps keep track of the application-controlled MessageId of all messages sent into a queue or topic during a specified time window.
Incorrect Answers: C: There is just no mechanism that can query a Storage queue and find out if a message with the same contents is already there or was there before.
D: Azure Event Hub does not have duplicate detection
You develop and deploy the following staticwebapp.config.json file to the app_location value specified in the workflow file of an Azure Static Web app.
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Correct Answer:
QUESTION 6
You are a developer for a SaaS company that offers many web services.
All web services for the company must meet the following requirements:
Use API Management to access the services Use OpenID Connect for authentication Prevent anonymous usage
A recent security audit found that several web services can be called without any authentication.
Which API Management policy should you implement?
A.
jsonp
B.
authentication-certificate
C.
check-header
D.
validate-jwt
Correct Answer: D
Explanation
Explanation/Reference:
Add the validate-jwt policy to validate the OAuth token for every incoming request.
Incorrect Answers: A: The jsonp policy adds JSON with padding (JSONP) support to an operation or an API to allow cross-domain calls from JavaScript browser-based clients. JSONP is a method used in JavaScript programs to request data from a server in a different domain. JSONP bypasses the limitation enforced by most web browsers where access to web pages must be in the same domain.
JSONP - Adds JSON with padding (JSONP) support to an operation or an API to allow cross-domain calls from JavaScript browser-based clients.
A company maintains multiple web and mobile applications. Each application uses custom in-house identity providers as well as social identity providers.
You need to implement single sign-on (SSO) for all the applications.
What should you do?
A.
Use Azure Active Directory B2C (Azure AD B2C) with custom policies.
B.
Use Azure Active Directory B2B (Azure AD B2B) and enable external collaboration.
C.
Use Azure Active Directory B2C (Azure AD B2C) with user flows.
D.
Use Azure Active Directory B2B (Azure AD B2B).
Correct Answer: A
Explanation
Explanation/Reference:
Based on this article: https://docs.microsoft.com/en-us/azure/active-directory/external-identities/external-collaboration-settings-configure External collaboration settings let you specify what roles in your organization can invite external users for B2B collaboration. These settings also include options for allowing or blocking specific domains, and options for restricting what external guest users can see in your Azure AD directory. https://docs.microsoft.com/en-us/azure/active-directory-b2c/custom-policy-reference-sso
Case Study 7
Case Study Questions
Background
VanArsdel, Ltd. is a global office supply company. The company is based in Canada and has retail store locations across the world. The company is developing several cloud-based solutions to support their stores, distributors, suppliers, and delivery services.
Current environment
Corporate website
The company provides a public website located at http://www.vanarsdelltd.com. The website consists of a React JavaScript user interface, HTML, CSS, image assets, and several APIs hosted in Azure Functions.
Retail Store Locations
The company supports thousands of store locations globally. Store locations send data every hour to an Azure Blob storage account to support inventory, purchasing and delivery services. Each record includes a location identifier and sales transaction information.
Requirements
The application components must meet the following requirements:
Corporate website
1. Secure the website by using SSL. 2. Minimize costs for data storage and hosting. 3. Implement native GitHub workflows for continuous integration and continuous deployment (CI/CD). 4. Distribute the website content globally for local use. 5. Implement monitoring by using Application Insights and availability web tests including SSL certificate validity and custom header value verification. 6. The website must have 99.95 percent uptime.
Retail store locations
1. Azure Functions must process data immediately when data is uploaded to Blob storage. Azure
Functions must update Azure Cosmos DB by using native SQL language queries. 2. Audit store sale transaction information nightly to validate data, process sales financials, and reconcile inventory.
Delivery services
1. Store service telemetry data in Azure Cosmos DB by using an Azure Function. Data must include an item id, the delivery vehicle license plate, vehicle package capacity, and current vehicle location coordinates. 2. Store delivery driver profile information in Azure Active Directory (Azure AD) by using an Azure Function called from the corporate website.
Inventory services
The company has contracted a third-party to develop an API for inventory processing that requires access to a specific blob within the retail store storage account for three months to include read-only access to the data.
Security
1. All Azure Functions must centralize management and distribution of configuration data for different environments and geographies, encrypted by using a company-provided RSA-HSM key. 2. Authentication and authorization must use Azure AD and services must use managed identities where possible.
Issues
Retail Store Locations
1. You must perform a point-in-time restoration of the retail store location data due to an unexpected and accidental deletion of data. 2. Azure Cosmos DB queries from the Azure Function exhibit high Request Unit (RU) usage and contain multiple, complex queries that exhibit high point read latency for large items as the function app is scaling.
QUESTION 8
HOTSPOT
You need to reliably identify the delivery driver profile information.
How should you configure the system? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Correct Answer:
Explanation
Explanation/Reference:
Box 1: ID Scenario: Store delivery driver profile information in Azure Active Directory (Azure AD) by using an Azure Function called from the corporate website.
ID token - A JWT that contains claims that you can use to identify users in your application. This token is securely sent in HTTP requests for communication between two components of the same application or service. You can use the claims in an ID token as you see fit. They're commonly used to display account information or to make access control decisions in an application. ID tokens are signed, but the're not encrypted. When your application or API receives an ID token, it must validate the signature to prove that the token is authentic. Your application or API must also validate a few claims in the token to prove that it's valid. Depending on the scenario requirements, the claims validated by an application can vary, but your application must perform some common claim validations in every scenario.
Box 2: Oid Oid - The immutable identifier for the "principal" of the request - the user or service principal whose identity has been verified. In ID tokens and app+user tokens, this is the object ID of the user. In app-only tokens, this is the object ID of the calling service principal. It can also be used to perform authorization checks safely and as a key in database tables. This ID uniquely identifies the principal across applications - two different applications signing in the same user will receive the same value in the oid claim.
Incorrect: Aud - Identifies the intended recipient of the token. For Azure AD B2C, the audience is the application ID. Your application should validate this value and reject the token if it doesn't match. Audience is synonymous with resource.
Idp - Records the identity provider that authenticated the subject of the token. This value is identical to the value of the Issuer claim unless the user account not in the same tenant as the issuer - guests, for instance. If the claim isn't present, it means that the value of iss can be used instead. For personal accounts being used in an organizational context (for instance, a personal account invited to an Azure AD tenant), the idp claim may be 'live.com' or an STS URI containing the Microsoft account tenant.
This virtual machine (VM) runs BizTalk Server 2016. The VM runs the following workflows:
1. Ocean Transport - This workflow gathers and validates container information including container contents and arrival notices at various shipping ports. 2. Inland Transport - This workflow gathers and validates trucking information including fuel usage, number of stops, and routes.
The VM supports the following REST API calls:
1. Container API - This API provides container information including weight, contents, and other attributes. 2. Location API - This API provides location information regarding shipping ports of call and trucking stops. 3. Shipping REST API - This API provides shipping information for use and display on the shipping website.
Shipping Data
The application uses MongoDB JSON document storage database for all container and transport information.
Shipping Web Site
The site displays shipping container tracking information and container contents. The site is located at http://shipping.wideworldimporters.com/
Proposed solution
The on-premises shipping application must be moved to Azure. The VM has been migrated to a new Standard_D16s_v3 Azure VM by using Azure Site Recovery and must remain running in Azure to complete the BizTalk component migrations. You create a Standard_D16s_v3 Azure VM to host BizTalk Server. The Azure architecture diagram for the proposed solution is shown below:
Requirements
Shipping Logic app
The Shipping Logic app must meet the following requirements:
1. Support the ocean transport and inland transport workflows by using a Logic App. 2. Support industry-standard protocol X12 message format for various messages including vessel content details and arrival notices. 3. Secure resources to the corporate VNet and use dedicated storage resources with a fixed costing model. 4. Maintain on-premises connectivity to support legacy applications and final BizTalk migrations.
Shipping Function app
Implement secure function endpoints by using app-level security and include Azure Active Directory (Azure AD).
REST APIs
The REST API's that support the solution must meet the following requirements:
1. Secure resources to the corporate VNet. 2. Allow deployment to a testing location within Azure while not incurring additional costs. 3. Automatically scale to double capacity during peak shipping times while not causing application downtime. 4. Minimize costs when selecting an Azure payment model.
Shipping data
Data migration from on-premises to Azure must minimize costs and downtime.
Shipping website
Use Azure Content Delivery Network (CDN) and ensure maximum performance for dynamic content while minimizing latency and costs.
Issues
Windows Server 2016 VM
The VM shows high network latency, jitter, and high CPU utilization. The VM is critical and has not been
backed up in the past. The VM must enable a quick restore from a 7-day snapshot to include in-place restore of disks in case of failure.
Shipping website and REST APIs
The following error message displays while you are testing the website:
Failed to load http://test-shippingapi.wideworldimporters.com/: No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'http://test.wideworldimporters.com/' is therefore not allowed access.
QUESTION 9
HOTSPOT
You need to configure Azure CDN for the Shipping web site.
Which configuration options should you use? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Correct Answer:
Explanation
Explanation/Reference:
Scenario: Shipping website Use Azure Content Delivery Network (CDN) and ensure maximum performance for dynamic content while minimizing latency and costs.
Tier: Standard
Profile: Akamai
Optimization: Dynamic site acceleration Dynamic site acceleration (DSA) is available for Azure CDN Standard from Akamai, Azure CDN Standard from Verizon, and Azure CDN Premium from Verizon profiles.
DSA includes various techniques that benefit the latency and performance of dynamic content. Techniques include route and network optimization, TCP optimization, and more.
You can use this optimization to accelerate a web app that includes numerous responses that aren't cacheable. Examples are search results, checkout transactions, or real-time data. You can continue to use core Azure CDN caching capabilities for static data.
You are developing a solution for a hospital to support the following use cases:
1. The most recent patient status details must be retrieved even if multiple users in different locations have updated the patient record. 2. Patient health monitoring data retrieved must be the current version or the prior version. 3. After a patient is discharged and all charges have been assessed, the patient billing record contains the final charges.
You provision a Cosmos D6 NoSQL database and set the default consistency level for the database account to Strong. You set the value for Indexing Mode to Consistent. You need to configure the consistency levels to support each scenario. You must minimize latency and any impact to the availability of the solution. You must override the default consistency level at the query level to meet the required consistency guarantees for the scenarios.
Which consistency levels should you implement? To answer, drag the appropriate consistency levels to the correct requirements. Each consistency level may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content. NOTE: Each correct selection is worth one point.
Correct Answer:
Explanation
Explanation/Reference:
Box 1: Strong
Strong: Strong consistency offers a linearizability guarantee. The reads are guaranteed to return the most recent committed version of an item. A client never sees an uncommitted or partial write. Users are always guaranteed to read the latest committed write.
Box 2: Bounded staleness Bounded staleness: The reads are guaranteed to honor the consistent-prefix guarantee. The reads might lag behind writes by at most "K" versions (that is "updates") of an item or by "t" time interval. When you choose bounded staleness, the "staleness" can be configured in two ways:
The number of versions (K) of the item The time interval (t) by which the reads might lag behind the writes
Box 3: Eventual Eventual: There's no ordering guarantee for reads. In the absence of any further writes, the replicas eventually converge.
QUESTION 11
A development team is creating a new REST API. The API will store data in Azure Blob storage. You plan to deploy the API to Azure App Service.
Developers must access the Azure Blob storage account to develop the API for the next two months. The Azure Blob storage account must not be accessible by the developers after the two-month time period.
You need to grant developers access to the Azure Blob storage account.
What should you do?
A.
Generate a shared access signature (SAS) for the Azure Blob storage account and provide the SAS to all developers.
B.
Create and apply a new lifecycle management policy to include a last accessed date value. Apply the policy to the Azure Blob storage account.
C.
Provide all developers with the access key for the Azure Blob storage account. Update the API to include the Coordinated Universal Time (UTC) timestamp for the request header.
D.
Grant all developers access to the Azure Blob storage account by assigning role-based access control (RBAC) roles.
You are developing a back-end Azure App Service that scales based on the number of messages contained in a Service Bus queue.
A rule already exists to scale up the App Service when the average queue length of unprocessed and valid queue messages is greater than 1000.
You need to add a new rule that will continuously scale down the App Service as long as the scale up condition is not met.
How should you configure the Scale rule? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Correct Answer:
Explanation
Explanation/Reference:
Box 1: Service bus queue You are developing a back-end Azure App Service that scales based on the number of messages contained in a Service Bus queue.
Box 2: ActiveMessage Count ActiveMessageCount: Messages in the queue or subscription that are in the active state and ready for delivery.
Box 3: Count
Box 4: Less than or equal to You need to add a new rule that will continuously scale down the App Service as long as the scale up condition is not met.
Box 5: Decrease count by
QUESTION 13
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this question, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You are developing a website that will run as an Azure Web App. Users will authenticate by using their Azure Active Directory (Azure AD) credentials.
You plan to assign users one of the following permission levels for the website: admin, normal, and reader. A user's Azure AD group membership must be used to determine the permission level. You need to configure authorization.
Solution:
1. Create a new Azure AD application's manifest, set value of the groupMembershipClaims option to All. 2. In the website, use the value of the groups claim from the JWI for the user to determine permissions.
Does the solution meet the goal?
A.
Yes
B.
No
Correct Answer: A
Explanation
Explanation/Reference:
To configure Manifest to include Group Claims in Auth Token
1. Go to Azure Active Directory to configure the Manifest. Click on Azure Active Directory, and go to App registrations to find your application 2. Click on your application (or search for it if you have a lot of apps) and edit the Manifest by clicking on it.
3. Locate the "groupMembershipClaims" setting. Set its value to either "SecurityGroup" or "All". To help you decide which:
"SecurityGroup" - groups claim will contain the identifiers of all security groups of which the user is a member.
"All" - groups claim will contain the identifiers of all security groups and all distribution lists of which the user is a member
Now your application will include group claims in your manifest and you can use this fact in your code.
Munson's Pickles and Preserves Farm is an agricultural cooperative corporation based in Washington, US, with farms located across the United States. The company supports agricultural production resources by distributing seeds fertilizers, chemicals, fuel, and farm machinery to the farms.
Current Environment
The company is migrating all applications from an on-premises datacenter to Microsoft Azure. Applications support distributors, farmers, and internal company staff.
Corporate website
The company hosts a public website located at http://www.munsonspicklesandpreservesfarm.com. The site supports farmers and distributors who request agricultural production resources.
Farms
The company created a new customer tenant in the Microsoft Entra admin center to support authentication and authorization for applications.
Distributors
Distributors integrate their applications with data that is accessible by using APIs hosted at http://www.munsonspicklesandpreservesfarm.com/api to receive and update resource data.
Requirements
The application components must meet the following requirements:
Corporate website
1. The site must be migrated to Azure App Service. 2. Costs must be minimized when hosting in Azure. 3. Applications must automatically scale independent of the compute resources. 4. All code changes must be validated by internal staff before release to production.
5. File transfer speeds must improve, and webpage-load performance must increase. 6. All site settings must be centrally stored, secured without using secrets, and encrypted at rest and in transit. 7. A queue-based load leveling pattern must be implemented by using Azure Service Bus queues to support high volumes of website agricultural production resource requests.
Farms
Farmers must authenticate to applications by using Microsoft Entra ID.
Distributors
1. The company must track a custom telemetry value with each API call and monitor performance of all APIs. 2. API telemetry values must be charted to evaluate variations and trends for resource data.
Internal staff
1. App and API updates must be validated before release to production. 2. Staff must be able to select a link to direct them back to the production app when validating an app or API update. 3. Staff profile photos and email must be displayed on the website once they authenticate to applications by using their Microsoft Entra ID.
Security
1. All web communications must be secured by using TLS/HTTPS. 2. Web content must be restricted by country/region to support corporate compliance standards. 3. The principle of least privilege must be applied when providing any user rights or process access rights. 4. Managed identities for Azure resources must be used to authenticate services that support Microsoft Entra ID authentication.
Issues
Corporate website
1. Farmers report HTTP 503 errors at the same time as internal staff report that CPU and memory usage are high. 2. Distributors report HTTP 502 errors at the same time as internal staff report that average response times and networking traffic are high. 3. Internal staff report webpage load sizes are large and take a long time to load. 4. Developers receive authentication errors to Service Bus when they debug locally.
Distributors
Many API telemetry values are sent in a short period of time. Telemetry traffic, data costs, and storage costs must be reduced while preserving a statistically correct analysis of the data points sent by the APIs.
QUESTION 14
You need to implement farmer authentication.
Which three actions should you perform? Each correct answer presents part of the solution.
NOTE: Each correct selection is worth one point.
A.
Add the shared access signature (SAS) token to the app
B.
Create a shared access signature (SAS) token.
C.
Register the app in Microsoft Entra ID.
D.
Create a user flow.
E.
Add the app to the user flow.
Correct Answer: CDE
QUESTION 15
HOTSPOT
You develop and deploy a web app to Azure App service. The web app allows users to authenticate by using social identity providers through the Azure B2C service. All user profile information is stored in Azure B2C.
You must update the web app to display common user properties from Azure B2C to include the following information:
1. Email address 2. Job title 3. First name 4. Last name 5. Office location
You need to implement the user properties in the web app.
Which code library and API should you use? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Correct Answer:
Explanation
Explanation/Reference:
Box 1: Microsoft Graph Microsoft Graph allows you to manage resources in your Azure AD B2C directory. Microsoft Graph API operations are supported for the management of Azure AD B2C resources, including users, identity providers, user flows, custom policies, and policy keys
Box 2: Microsoft Authentication Library (MSAL) MSAL.js supports authentication with social (Microsoft, Google, Facebook etc.), enterprise (ADFS, Salesforce etc.) and local (stored in the Azure AD B2C directory) identities using Azure AD B2C (B2C for short).
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You develop and deploy an Azure App Service API app to a Windows-hosted deployment slot named Development. You create additional deployment slots named Testing and Production. You enable auto swap on the Production deployment slot.
You need to ensure that scripts run and resources are available before a swap operation occurs.
Solution: Update the app with a method named statuscheck to run the scripts. Update the app settings for the app. Set the WEBSITE_SWAP_WARMUP_PING_PATH and WEBSITE_SWAP_WARMUP_PING_STATUSES with a path to the new method and appropriate response codes.
Does the solution meet the goal?
A.
Yes
B.
No
Correct Answer: B
Explanation
Explanation/Reference:
These are valid warm-up behavior options, but are not helpful in fixing swap problems.
Instead update the web.config file to include the applicationInitialization configuration element. Specify custom initialization actions to run the scripts.
Note: Some apps might require custom warm-up actions before the swap. The applicationInitialization configuration element in web.config lets you specify custom initialization actions. The swap operation waits for this custom warm-up to finish before swapping with the target slot. Here's a sample web.config fragment.
You plan to develop an Azure Functions app with an Azure Blob Storage trigger. The app will be used infrequently, with a limited duration of individual executions.
The app must meet the following requirements:
Event-driven scaling Support for deployment slots Minimize costs
You need to identify the hosting plan and the maximum duration when executing the app.
Which configuration setting values should you use? To answer, select the appropriate values in the answer area.
NOTE: Each correct selection is worth one point.
Correct Answer:
Explanation
Explanation/Reference:
Box 1: Consumption Hosting plan
The Consumption plan is the cheapest.
On the Consumption plan, instances of the Functions host are dynamically added and removed based on the number of incoming events.
You are developing a microservices-based application that uses Azure Container Apps.
The application consists of several containerized services that handle tasks, such as processing orders, managing inventory, and generating reports.
You deploy a new revision of the processing orders app.
Processing orders must be triggered by a web request and must always be available based on incoming web requests.
You need to validate that the replica is ready to handle incoming requests.
What should you implement?
A.
TCP liveness probe
B.
HTTP readiness probe
C.
HTTP startup probe
D.
TCP readiness probe
E.
HTTP liveness probe
Correct Answer: B
QUESTION 19
HOTSPOT
You create the following PowerShell script:
For each of the following statements, select Yes if the statement is true. Otherwise, select No,
NOTE: Each correct selection is worth one point.
Correct Answer:
Explanation
Explanation/Reference:
Box 1: No The AzScheduledQueryRuleSource is Heartbeat, not CPU.
Box 2: Yes The AzScheduledQueryRuleSource is Heartbeat!
Note: New-AzScheduledQueryRuleTriggerCondition creates an object of type Trigger Condition. This object is to be passed to the command that creates Alerting Action object.
Box 3: No The schedule is 60 minutes, not two hours. -FrequencyInMinutes: The alert frequency. -TimeWindowInMinutes: The alert time window
The New-AzAscheduledQueryRuleSchedule command creates an object of type Schedule. This object is to be passed to the command that creates Log Alert Rule.
Case Study 3
Case Study Questions
Background
Overview
You are a developer for Contoso, Ltd. The company has a social networking website that is developed as a Single Page Application (SPA). The main web application for the social networking website loads user uploaded content from blob storage.
You are developing a solution to monitor uploaded data for inappropriate content. The following process occurs when users upload content by using the SPA:
1. Messages are sent to ContentUploadService. 2. Content is processed by ContentAnalysisService. 3. After processing is complete, the content is posted to the social network or a rejection message is posted in its place.
The ContentAnalysisService is deployed with Azure Container Instances from a private Azure Container Registry named contosoimages.
The solution will use eight CPU cores.
Azure Active Directory
Contoso, Ltd. uses Azure Active Directory (Azure AD) for both internal and guest accounts.
Requirements
ContentAnalysisService
The company's data science group built ContentAnalysisService which accepts user generated content as a string and returns a probable value for inappropriate content. Any values over a specific threshold must be reviewed by an employee of Contoso, Ltd.
You must create an Azure Function named CheckUserContent to perform the content checks.
Costs
You must minimize costs for all Azure services.
Manual review
To review content, the user must authenticate to the website portion of the ContentAnalysisService using their Azure AD credentials. The website is built using React and all pages and API endpoints require authentication. In order to review content a user must be part of a ContentReviewer role. All completed reviews must include the reviewer's email address for auditing purposes.
High availability
All services must run in multiple regions. The failure of any service in a region must not impact overall application availability.
Monitoring
An alert must be raised if the ContentUploadService uses more than 80 percent of available CPU cores.
Security
You have the following security requirements: 1. Any web service accessible over the Internet must be protected from cross site scripting attacks. 2. All websites and services must use SSL from a valid root certificate authority. 3. Azure Storage access keys must only be stored in memory and must be available only to the service. 4. All Internal services must only be accessible from internal Virtual Networks (VNets). 5. All parts of the system must support inbound and outbound traffic restrictions. 6. All service calls must be authenticated by using Azure AD.
User agreements
When a user submits content, they must agree to a user agreement. The agreement allows employees of Contoso, Ltd. to review content, store cookies on user devices, and track user's IP addresses.
Information regarding agreements is used by multiple divisions within Contoso, Ltd.
User responses must not be lost and must be available to all parties regardless of individual service uptime. The volume of agreements is expected to be in the millions per hour.
Validation testing
When a new version of the ContentAnalysisService is available the previous seven days of content must be processed with the new version to verify that the new version does not significantly deviate from the old version.
Issues
Users of the ContentUploadService report that they occasionally see HTTP 502 responses on specific pages.
Code
ContentUploadService
QUESTION 20
You need to store the user agreements.
Where should you store the agreement after it is completed?
A.
Azure Storage queue
B.
Azure Event Hub
C.
Azure Service Bus topic
D.
Azure Event Grid topic
Correct Answer: B
Explanation
Explanation/Reference:
Azure Event Hub is used for telemetry and distributed data streaming.
This service provides a single solution that enables rapid data retrieval for real-time processing as well as repeated replay of stored raw data. It can capture the streaming data into a file for processing and analysis.
It has the following characteristics: 1. low latency 2. capable of receiving and processing millions of events per second 3. at least once delivery
You are building an application to track cell towers that are available to phones in near real time. A phone will send information to the application by using the Azure Web PubSub service. The data will be processed by using an Azure Functions app. Traffic will be transmitted by using a content delivery network (CDN).
The Azure function must be protected against misconfigured or unauthorized invocations.
You need to ensure that the CDN allows for the Azure function protection.
Which HTTP header should be on the allowed list?
A.
Authorization
B.
WebHook-Request-Callback
C.
Resource
D.
WebHook-Request-Origin
Correct Answer: D
Explanation
Explanation/Reference:
CloudEvents extension for Azure Web PubSub event handler with HTTP protocol The Web PubSub service delivers client events to the upstream webhook using the CloudEvents HTTP protocol binding.
Webhook validation The Webhook validation follows CloudEvents. The request always contains WebHook-Request-Origin: xxx.webpubsub.azure.com in the header.
If and only if the delivery target does allow delivery of the events, it MUST reply to the request by including WebHook-Allowed-Origin header, for example:
WebHook-Allowed-Origin: *
Or:
WebHook-Allowed-Origin: xxx.webpubsub.azure.com
For now, WebHook-Request-Rate and WebHook-Request-Callback are not supported.
Incorrect: * WebHook-Request-Callback. An optional field that provides the webhook with an alternative to grant permission asynchronously, by way of a HTTP callback.
VanArsdel, Ltd. is a global office supply company. The company is based in Canada and has retail store locations across the world. The company is developing several cloud-based solutions to support their stores, distributors, suppliers, and delivery services.
Current environment
Corporate website
The company provides a public website located at http://www.vanarsdelltd.com. The website consists of a React JavaScript user interface, HTML, CSS, image assets, and several APIs hosted in Azure Functions.
Retail Store Locations
The company supports thousands of store locations globally. Store locations send data every hour to an Azure Blob storage account to support inventory, purchasing and delivery services. Each record includes a location identifier and sales transaction information.
Requirements
The application components must meet the following requirements:
Corporate website
1. Secure the website by using SSL. 2. Minimize costs for data storage and hosting. 3. Implement native GitHub workflows for continuous integration and continuous deployment (CI/CD). 4. Distribute the website content globally for local use. 5. Implement monitoring by using Application Insights and availability web tests including SSL certificate validity and custom header value verification. 6. The website must have 99.95 percent uptime.
Retail store locations
1. Azure Functions must process data immediately when data is uploaded to Blob storage. Azure
Functions must update Azure Cosmos DB by using native SQL language queries. 2. Audit store sale transaction information nightly to validate data, process sales financials, and reconcile inventory.
Delivery services
1. Store service telemetry data in Azure Cosmos DB by using an Azure Function. Data must include an item id, the delivery vehicle license plate, vehicle package capacity, and current vehicle location coordinates. 2. Store delivery driver profile information in Azure Active Directory (Azure AD) by using an Azure Function called from the corporate website.
Inventory services
The company has contracted a third-party to develop an API for inventory processing that requires access to a specific blob within the retail store storage account for three months to include read-only access to the data.
Security
1. All Azure Functions must centralize management and distribution of configuration data for different environments and geographies, encrypted by using a company-provided RSA-HSM key. 2. Authentication and authorization must use Azure AD and services must use managed identities where possible.
Issues
Retail Store Locations
1. You must perform a point-in-time restoration of the retail store location data due to an unexpected and accidental deletion of data. 2. Azure Cosmos DB queries from the Azure Function exhibit high Request Unit (RU) usage and contain multiple, complex queries that exhibit high point read latency for large items as the function app is scaling.
QUESTION 22
HOTSPOT
You need to implement event routing for retail store location data.
Which configurations should you use? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Correct Answer:
Explanation
Explanation/Reference:
Box 1: Azure Blob Storage Azure event publishers and event handlers are at the core of the Event Grid routing-service. Event Grid listens to Azure event publishers, such as Blog Storage, then reacts by routing specific events to Azure event handlers, such as WebHooks. You can easily control this entire process at a granular level through event subscriptions and event filters.
Box 2: Azure Event Grid Azure Event Grid is a highly scalable event-routing service that listens for specific system events, then reacts to them according to your precise specifications. In the past, event handling has relied largely on polling - a high latency, low-efficiency approach that can prove prohibitively expensive at scale.
Box 3: Azure Logic App Event Grid's supported event handlers currently include Event Hubs, WebHooks, Logic Apps, Azure Functions, Azure Automation and Microsoft Flow.
You have an Azure Batch project that processes and converts files and stores the files in Azure storage. You are developing a function to start the batch job.
You add the following parameters to the function.
You must ensure that converted files are placed in the container referenced by the outputContainerSasUrl parameter. Files which fail to convert are placed in the container referenced by the failedContainerSasUrl parameter.
You need to ensure the files are correctly processed.
How should you complete the code segment? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Correct Answer:
Explanation
Explanation/Reference:
Box 1: CreateJob
Box 2: TaskSuccess TaskSuccess: Upload the file(s) only after the task process exits with an exit code of 0.
Incorrect: TaskCompletion: Upload the file(s) after the task process exits, no matter what the exit code was.
Box 3: TaskFailure TaskFailure:Upload the file(s) only after the task process exits with a nonzero exit code.
Box 4: OutputFiles To specify output files for a task, create a collection of OutputFile objects and assign it to the CloudTask.OutputFiles property when you create the task.
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
Your company has an Azure Active Directory (Azure AD) environment. Users occasionally connect to Azure AD via the Internet.
You need to ensure that users who connect to Azure AD via the internet using an unidentified IP address, are automatically instructed to change their passwords.
Solution: You configure the use of Azure Key Vault.
You are developing an application that uses Azure Storage to store customer data. The data must only be decrypted by the customer and the customer must be provided a script to rotate keys.
You need to provide a script to rotate keys to the customer.
How should you complete the command? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Correct Answer:
Explanation
Explanation/Reference:
Box 1: key When you manually update the key version, you'll need to update the storage account's encryption settings to use the new version. First, query for the key vault URI by calling az keyvault show, and for the key version by calling az keyvault key list-versions. Then call az storage account update to update the storage account's encryption settings to use the new version of the key, as shown in the example below.
Box 2: Microsoft.Keyvault Call az storage account update to update the storage account's encryption settings, as shown in the following example. Include the --encryption-key-source parameter and set it to Microsoft.Keyvault to enable customer-managed keys for the account.
This virtual machine (VM) runs BizTalk Server 2016. The VM runs the following workflows:
1. Ocean Transport - This workflow gathers and validates container information including container contents and arrival notices at various shipping ports. 2. Inland Transport - This workflow gathers and validates trucking information including fuel usage, number of stops, and routes.
The VM supports the following REST API calls:
1. Container API - This API provides container information including weight, contents, and other attributes. 2. Location API - This API provides location information regarding shipping ports of call and trucking stops. 3. Shipping REST API - This API provides shipping information for use and display on the shipping website.
Shipping Data
The application uses MongoDB JSON document storage database for all container and transport information.
Shipping Web Site
The site displays shipping container tracking information and container contents. The site is located at http://shipping.wideworldimporters.com/
Proposed solution
The on-premises shipping application must be moved to Azure. The VM has been migrated to a new Standard_D16s_v3 Azure VM by using Azure Site Recovery and must remain running in Azure to complete the BizTalk component migrations. You create a Standard_D16s_v3 Azure VM to host BizTalk Server. The Azure architecture diagram for the proposed solution is shown below:
Requirements
Shipping Logic app
The Shipping Logic app must meet the following requirements:
1. Support the ocean transport and inland transport workflows by using a Logic App. 2. Support industry-standard protocol X12 message format for various messages including vessel content details and arrival notices. 3. Secure resources to the corporate VNet and use dedicated storage resources with a fixed costing model. 4. Maintain on-premises connectivity to support legacy applications and final BizTalk migrations.
Shipping Function app
Implement secure function endpoints by using app-level security and include Azure Active Directory (Azure AD).
REST APIs
The REST API's that support the solution must meet the following requirements:
1. Secure resources to the corporate VNet. 2. Allow deployment to a testing location within Azure while not incurring additional costs. 3. Automatically scale to double capacity during peak shipping times while not causing application downtime. 4. Minimize costs when selecting an Azure payment model.
Shipping data
Data migration from on-premises to Azure must minimize costs and downtime.
Shipping website
Use Azure Content Delivery Network (CDN) and ensure maximum performance for dynamic content while minimizing latency and costs.
Issues
Windows Server 2016 VM
The VM shows high network latency, jitter, and high CPU utilization. The VM is critical and has not been
backed up in the past. The VM must enable a quick restore from a 7-day snapshot to include in-place restore of disks in case of failure.
Shipping website and REST APIs
The following error message displays while you are testing the website:
Failed to load http://test-shippingapi.wideworldimporters.com/: No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'http://test.wideworldimporters.com/' is therefore not allowed access.
QUESTION 26
You need to support the requirements for the Shipping Logic App.
What should you use?
A.
Azure Active Directory Application Proxy
B.
Site-to-Site (S2S) VPN connection
C.
On-premises Data Gateway
D.
Point-to-Site (P2S) VPN connection
Correct Answer: C
Explanation
Explanation/Reference:
Before you can connect to on-premises data sources from Azure Logic Apps, download and install the on-premises data gateway on a local computer. The gateway works as a bridge that provides quick data transfer and encryption between data sources on premises (not in the cloud) and your logic apps.
The gateway supports BizTalk Server 2016.
Note: Microsoft have now fully incorporated the Azure BizTalk Services capabilities into Logic Apps and Azure App Service Hybrid Connections.
Logic Apps Enterprise Integration pack bring some of the enterprise B2B capabilities like AS2 and X12, EDI standards support
Scenario: The Shipping Logic app must meet the following requirements: 1. Support the ocean transport and inland transport workflows by using a Logic App. 2. Support industry-standard protocol X12 message format for various messages including vessel content details and arrival notices. 3. Secure resources to the corporate VNet and use dedicated storage resources with a fixed costing model. 4. Maintain on-premises connectivity to support legacy applications and final BizTalk migrations.
You plan to develop code that will process messages in queuel.
You need to implement a queue operation to set the visibility timeout value of individual messages in queuel.
Which two operations can you use? Each correct answer presents a complete solution.
NOTE: Each correct selection is worth one point.
A.
Peek at a message in the queue.
B.
Update a message in the queue.
C.
Delete a message in the queue.
D.
Receive a message from the queue.
E.
Add a message to the queuer t
Correct Answer: CD
Case Study 4
Case Study Questions
Background
City Power & Light company provides electrical infrastructure monitoring solutions for homes and businesses. The company is migrating solutions to Azure.
Current environment
Architecture overview
The company has a public website located at http://www.cpandl.com/. The site is a single-page web application that runs in Azure App Service on Linux. The website uses files stored in Azure Storage and cached in Azure Content Delivery Network (CDN) to serve static content.
API Management and Azure Function App functions are used to process and store data in Azure Database for PostgreSQL. API Management is used to broker communications to the Azure Function app functions for Logic app integration. Logic apps are used to orchestrate the data processing while Service Bus and Event Grid handle messaging and events.
The solution uses Application Insights, Azure Monitor, and Azure Key Vault.
Architecture diagram
The company has several applications and services that support their business. The company plans to implement serverless computing where possible. The overall architecture is shown below.
User authentication
The following steps detail the user authentication process:
1. The user selects Sign in in the website. 2. The browser redirects the user to the Azure Active Directory (Azure AD) sign in page. 3. The user signs in. 4. Azure AD redirects the user's session back to the web application. The URL includes an access token. 5. The web application calls an API and includes the access token in the authentication header. The application ID is sent as the audience ('aud') claim in the access token. 6. The back-end API validates the access token.
Requirements
Corporate website
1. Communications and content must be secured by using SSL. 2. Communications must use HTTPS. 3. Data must be replicated to a secondary region and three availability zones. 4. Data storage costs must be minimized.
Azure Database for PostgreSQL
The database connection string is stored in Azure Key Vault with the following attributes:
The connection information is updated frequently. The application must always use the latest information to connect to the database.
Azure Service Bus and Azure Event Grid
1. Azure Event Grid must use Azure Service Bus for queue-based load leveling.
2. Events in Azure Event Grid must be routed directly to Service Bus queues for use in buffering. 3. Events from Azure Service Bus and other Azure services must continue to be routed to Azure Event Grid for processing.
Security
1. All SSL certificates and credentials must be stored in Azure Key Vault. 2. File access must restrict access by IP, protocol, and Azure AD rights. 3. All user accounts and processes must receive only those privileges which are essential to perform their intended function.
Compliance
Auditing of the file updates and transfers must be enabled to comply with General Data Protection Regulation (GDPR). The file updates must be read-only, stored in the order in which they occurred, include only create, update, delete, and copy operations, and be retained for compliance reasons.
Issues
Corporate website
While testing the site, the following error message displays: CryptographicException: The system cannot find the file specified.
Function app
You perform local testing for the RequestUserApproval function. The following error message displays: 'Timeout value of 00:10:00 exceeded by function: RequestUserApproval'
The same error message displays when you test the function in an Azure development environment when you run the following Kusto query: FunctionAppLogs | where FunctionName = = "RequestUserApproval"
Logic app
You test the Logic app in a development environment. The following error message displays: '400 Bad Request' Troubleshooting of the error shows an HttpTrigger action to call the RequestUserApproval function.
Code
Corporate website
Security.cs:
Function app
RequestUserApproval.cs:
QUESTION 28
HOTSPOT
You need to configure security and compliance for the corporate website files.
Which Azure Blob storage settings should you use? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Correct Answer:
Explanation
Explanation/Reference:
Box 1: role-based access control (RBAC) Azure Storage supports authentication and authorization with Azure AD for the Blob and Queue services via Azure role-based access control (Azure RBAC). Scenario: File access must restrict access by IP, protocol, and Azure AD rights.
Box 2: storage account type
Scenario: The website uses files stored in Azure Storage Auditing of the file updates and transfers must be enabled to comply with General Data Protection Regulation (GDPR).
Creating a diagnostic setting: 1. Sign in to the Azure portal. 2. Navigate to your storage account. 3. In the Monitoring section, click Diagnostic settings (preview).
4. Choose file as the type of storage that you want to enable logs for. 5. Click Add diagnostic setting.
You are developing an ASP.NET Core time sheet application that runs as an Azure Web App. Users of the application enter their time sheet information on the first day of every month.
The application uses a third-party web service to validate data.
The application encounters periodic server errors due to errors that result from calling a third-party web server. Each request to the third-party server has the same chance of failure.
You need to configure an Azure Monitor alert to detect server errors unrelated to the third-party service. You must minimize false-positive alerts.
How should you complete the Azure Resource Manager template? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Correct Answer:
Explanation
Explanation/Reference:
Box 1: DynamicThresholdCriterion
Box 2: Http5xx Server errors are in the 5xx range. Client errors are in the 4xx range
You have an Azure Cosmos 06 instance that uses the Strong consistency level and 10,000 Request Units (RUs) per container. Geo-replication is enabled.
The instance stores restaurant information including location, menu items, and start. You currently store information for 1,000 restaurant locations, 500 menu items, and 10,000 staff members. You select the location id as the partition key.
How many logical partitions will be created for the container?
A.
500
B.
1,100
C.
10.000
D.
10,000,000
Correct Answer: C
Case Study 6
Case Study Questions
Background
You are a developer for Litware Inc., a SaaS company that provides a solution for managing employee expenses. The solution consists of an ASP.NET Core Web API project that is deployed as an Azure Web App.
Overall architecture
Employees upload receipts for the system to process. When processing is complete, the employee receives a summary report email that details the processing results. Employees then use a web application to manage their receipts and perform any additional tasks needed for reimbursement.
Receipt processing Employees may upload receipts in two ways:
1. Uploading using an Azure Files mounted folder 2. Uploading using the web application
Data Storage Receipt and employee information is stored in an Azure SQL database.
Documentation
Employees are provided with a getting started document when they first use the solution. The documentation includes details on supported operating systems for Azure File upload, and instructions on how to configure the mounted folder.
Solution details
Users table
Web Application
You enable MSI for the Web App and configure the Web App to use the security principal name WebAppIdentity.
Processing
Processing is performed by an Azure Function that uses version 2 of the Azure Function runtime. Once processing is completed, results are stored in Azure Blob Storage and an Azure SQL database. Then, an email summary is sent to the user with a link to the processing report. The link to the report must remain valid if the email is forwarded to another user.
Logging
Azure Application Insights is used for telemetry and logging in both the processor and the web application. The processor also has TraceWriter logging enabled. Application Insights must always contain all log messages.
Requirements
Receipt processing
Concurrent processing of a receipt must be prevented.
Disaster recovery
Regional outage must not impact application availability. All DR operations must not be dependent on application running and must ensure that data in the DR region is up to date.
Security
1. User's SecurityPin must be stored in such a way that access to the database does not allow the viewing of SecurityPins. The web application is the only system that should have access to SecurityPins. 2. All certificates and secrets used to secure data must be stored in Azure Key Vault. 3. You must adhere to the principle of least privilege and provide privileges which are essential to perform the intended function. 4. All access to Azure Storage and Azure SQL database must use the application's Managed Service Identity (MSI). 5. Receipt data must always be encrypted at rest. 6. All data must be protected in transit. 7. User's expense account number must be visible only to logged in users. All other views of the expense account number should include only the last segment, with the remaining parts obscured. 8. In the case of a security breach, access to all summary reports must be revoked without impacting other parts of the system.
Issues
Upload format issue
Employees occasionally report an issue with uploading a receipt using the web application. They report that when they upload a receipt using the Azure File Share, the receipt does not appear in their profile. When this occurs, they delete the file in the file share and use the web application, which returns a 500 Internal Server error page.
Capacity issue
During busy periods, employees report long delays between the time they upload the receipt and when it appears in the web application.
Log capacity issue
Developers report that the number of log messages in the trace output for the processor is too high, resulting in lost log messages.
Application code
Processing.cs
Database.cs
ReceiptUploader.cs
ConfigureSSE.ps1
QUESTION 31
You need to resolve the log capacity issue.
What should you do?
A.
Create an Application Insights Telemetry Filter
B.
Change the minimum log level in the host.json file for the function
C.
Implement Application Insights Sampling
D.
Set a LogCategoryFilter during startup
Correct Answer: C
Explanation
Explanation/Reference:
Scenario, the log capacity issue: Developers report that the number of log message in the trace output for the processor is too high, resulting in lost log messages.
Sampling is a feature in Azure Application Insights. It is the recommended way to reduce telemetry traffic and storage, while preserving a statistically correct analysis of application data. The filter selects items that are related, so that you can navigate between items when you are doing diagnostic investigations. When metric counts are presented to you in the portal, they are renormalized to take account of the sampling, to minimize any effect on the statistics.
Sampling reduces traffic and data costs, and helps you avoid throttling.
You are maintaining an existing application that uses an Azure Blob GPv1 Premium storage account. Data older than three months is rarely used.
Data newer than three months must be available immediately. Data older than a year must be saved but does not need to be available immediately.
You need to configure the account to support a lifecycle management rule that moves blob data to archive storage for data not modified in the last year.
Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.
Correct Answer:
Explanation
Explanation/Reference:
Step 1: Upgrade the storage account to GPv2 Object storage data tiering between hot, cool, and archive is supported in Blob Storage and General Purpose v2 (GPv2) accounts. General Purpose v1 (GPv1) accounts don't support tiering. You can easily convert your existing GPv1 or Blob Storage accounts to GPv2 accounts through the Azure portal.
Step 2: Copy the data to be archived to a Standard GPv2 storage account and then delete the data from the original storage account
Step 3: Change the storage account access tier from hot to cool
Note: Hot - Optimized for storing data that is accessed frequently. Cool - Optimized for storing data that is infrequently accessed and stored for at least 30 days.
Archive - Optimized for storing data that is rarely accessed and stored for at least 180 days with flexible latency requirements, on the order of hours.
Only the hot and cool access tiers can be set at the account level. The archive access tier can only be set at the blob level.
VanArsdel, Ltd. is a global office supply company. The company is based in Canada and has retail store locations across the world. The company is developing several cloud-based solutions to support their stores, distributors, suppliers, and delivery services.
Current environment
Corporate website
The company provides a public website located at http://www.vanarsdelltd.com. The website consists of a React JavaScript user interface, HTML, CSS, image assets, and several APIs hosted in Azure Functions.
Retail Store Locations
The company supports thousands of store locations globally. Store locations send data every hour to an Azure Blob storage account to support inventory, purchasing and delivery services. Each record includes a location identifier and sales transaction information.
Requirements
The application components must meet the following requirements:
Corporate website
1. Secure the website by using SSL. 2. Minimize costs for data storage and hosting. 3. Implement native GitHub workflows for continuous integration and continuous deployment (CI/CD). 4. Distribute the website content globally for local use. 5. Implement monitoring by using Application Insights and availability web tests including SSL certificate validity and custom header value verification. 6. The website must have 99.95 percent uptime.
Retail store locations
1. Azure Functions must process data immediately when data is uploaded to Blob storage. Azure
Functions must update Azure Cosmos DB by using native SQL language queries. 2. Audit store sale transaction information nightly to validate data, process sales financials, and reconcile inventory.
Delivery services
1. Store service telemetry data in Azure Cosmos DB by using an Azure Function. Data must include an item id, the delivery vehicle license plate, vehicle package capacity, and current vehicle location coordinates. 2. Store delivery driver profile information in Azure Active Directory (Azure AD) by using an Azure Function called from the corporate website.
Inventory services
The company has contracted a third-party to develop an API for inventory processing that requires access to a specific blob within the retail store storage account for three months to include read-only access to the data.
Security
1. All Azure Functions must centralize management and distribution of configuration data for different environments and geographies, encrypted by using a company-provided RSA-HSM key. 2. Authentication and authorization must use Azure AD and services must use managed identities where possible.
Issues
Retail Store Locations
1. You must perform a point-in-time restoration of the retail store location data due to an unexpected and accidental deletion of data. 2. Azure Cosmos DB queries from the Azure Function exhibit high Request Unit (RU) usage and contain multiple, complex queries that exhibit high point read latency for large items as the function app is scaling.
QUESTION 33
HOTSPOT
You need to implement the delivery service telemetry data.
How should you configure the solution? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Correct Answer:
Explanation
Explanation/Reference:
Box 1: Core SQL SQL API: Serverless database computing using Azure Cosmos DB and Azure Functions.
Note: Store service telemetry data in Azure Cosmos DB by using an Azure Function. Data must include an item id, the delivery vehicle license plate, vehicle package capacity, and current vehicle location coordinates.
Box 2: Vehicle license plate Selecting your partition key is a simple but important design choice in Azure Cosmos DB. Once you select your partition key, it is not possible to change it in-place. If you need to change your partition key, you should move your data to a new container with your new desired partition key.
For all containers, your partition key should:
Be a property that has a value which does not change. If a property is your partition key, you can't update that property's value.
Have a high cardinality. In other words, the property should have a wide range of possible values.
Spread request unit (RU) consumption and data storage evenly across all logical partitions. This ensures even RU consumption and storage distribution across your physical partitions.
Note: The company supports thousands of store locations globally. Store locations send data every hour to an Azure Blob storage account to support inventory, purchasing and delivery services. Each record includes a location identifier and sales transaction information.
This virtual machine (VM) runs BizTalk Server 2016. The VM runs the following workflows:
1. Ocean Transport - This workflow gathers and validates container information including container contents and arrival notices at various shipping ports. 2. Inland Transport - This workflow gathers and validates trucking information including fuel usage, number of stops, and routes.
The VM supports the following REST API calls:
1. Container API - This API provides container information including weight, contents, and other attributes. 2. Location API - This API provides location information regarding shipping ports of call and trucking stops. 3. Shipping REST API - This API provides shipping information for use and display on the shipping website.
Shipping Data
The application uses MongoDB JSON document storage database for all container and transport information.
Shipping Web Site
The site displays shipping container tracking information and container contents. The site is located at http://shipping.wideworldimporters.com/
Proposed solution
The on-premises shipping application must be moved to Azure. The VM has been migrated to a new Standard_D16s_v3 Azure VM by using Azure Site Recovery and must remain running in Azure to complete the BizTalk component migrations. You create a Standard_D16s_v3 Azure VM to host BizTalk Server. The Azure architecture diagram for the proposed solution is shown below:
Requirements
Shipping Logic app
The Shipping Logic app must meet the following requirements:
1. Support the ocean transport and inland transport workflows by using a Logic App. 2. Support industry-standard protocol X12 message format for various messages including vessel content details and arrival notices. 3. Secure resources to the corporate VNet and use dedicated storage resources with a fixed costing model. 4. Maintain on-premises connectivity to support legacy applications and final BizTalk migrations.
Shipping Function app
Implement secure function endpoints by using app-level security and include Azure Active Directory (Azure AD).
REST APIs
The REST API's that support the solution must meet the following requirements:
1. Secure resources to the corporate VNet. 2. Allow deployment to a testing location within Azure while not incurring additional costs. 3. Automatically scale to double capacity during peak shipping times while not causing application downtime. 4. Minimize costs when selecting an Azure payment model.
Shipping data
Data migration from on-premises to Azure must minimize costs and downtime.
Shipping website
Use Azure Content Delivery Network (CDN) and ensure maximum performance for dynamic content while minimizing latency and costs.
Issues
Windows Server 2016 VM
The VM shows high network latency, jitter, and high CPU utilization. The VM is critical and has not been
backed up in the past. The VM must enable a quick restore from a 7-day snapshot to include in-place restore of disks in case of failure.
Shipping website and REST APIs
The following error message displays while you are testing the website:
Failed to load http://test-shippingapi.wideworldimporters.com/: No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'http://test.wideworldimporters.com/' is therefore not allowed access.
QUESTION 34
You need to secure the Shipping Logic App.
What should you use?
A.
Azure App Service Environment (ASE)
B.
Integration Service Environment (ISE)
C.
VNet service endpoint
D.
Azure AD B2B integration
Correct Answer: B
Explanation
Explanation/Reference:
Scenario: The Shipping Logic App requires secure resources to the corporate VNet and use dedicated storage resources with a fixed costing model.
You can access to Azure Virtual Network resources from Azure Logic Apps by using integration service environments (ISEs).
Sometimes, your logic apps and integration accounts need access to secured resources, such as virtual machines (VMs) and other systems or services, that are inside an Azure virtual network. To set up this access, you can create an integration service environment (ISE) where you can run your logic apps and create your integration accounts.
You need to create a report for the portal that lists information about employees who are subject matter experts for a specific topic. You must ensure that administrators have full control and cosent over the data.
Which technology should you use?
A.
Microsoft Graph connectors
B.
Microosft graph API
C.
Microsoft Graph data connect
Correct Answer: C
Explanation
Explanation/Reference:
Data Connect grants a more granular control and consent model: you can manage data, see who is accessing it, and request specific properties of an entity. This enhances the Microsoft Graph model, which grants or denies applications access to entire entities.
Microsoft Graph Data Connect augments Microsoft Graph's transactional model with an intelligent way to access rich data at scale. The data covers how workers communicate, collaborate, and manage their time across all the applications and services in Microsoft 365.
Incorrect: Not B: The Microsoft Graph API is a RESTful web API that enables you to access Microsoft Cloud service resources. After you register your app and get authentication tokens for a user or service, you can make requests to the Microsoft Graph API.
A simplistic definition of a Graph API is an API that models the data in terms of nodes and edges (objects and relationships) and allows the client to interact with multiple nodes in a single request.
Not C: Microsoft Graph connectors, your organization can index third-party data so that it appears in Microsoft Search results. With Microsoft Graph connectors, your organization can index third-party data so that it appears in Microsoft Search results.
This question requires that you evaluate the underlined text to determine if it is correct.
Your Azure Active Directory Azure (Azure AD) tenant has an Azure subscription linked to it.
Your developer has created a mobile application that obtains Azure AD access tokens using the OAuth 2 implicit grant type.
The mobile application must be registered in Azure AD.
You require a redirect URI from the developer for registration purposes.
Instructions: Review the underlined text. If it makes the statement correct, select "No change is needed." If the statement is incorrect, select the answer choice that makes the statement correct.
A.
No change required.
B.
a secret
C.
a login hint
D.
a client ID
Correct Answer: A
Explanation
Explanation/Reference:
For Native Applications you need to provide a Redirect URI, which Azure AD will use to return token responses.
VanArsdel, Ltd. is a global office supply company. The company is based in Canada and has retail store locations across the world. The company is developing several cloud-based solutions to support their stores, distributors, suppliers, and delivery services.
Current environment
Corporate website
The company provides a public website located at http://www.vanarsdelltd.com. The website consists of a React JavaScript user interface, HTML, CSS, image assets, and several APIs hosted in Azure Functions.
Retail Store Locations
The company supports thousands of store locations globally. Store locations send data every hour to an Azure Blob storage account to support inventory, purchasing and delivery services. Each record includes a location identifier and sales transaction information.
Requirements
The application components must meet the following requirements:
Corporate website
1. Secure the website by using SSL. 2. Minimize costs for data storage and hosting. 3. Implement native GitHub workflows for continuous integration and continuous deployment (CI/CD). 4. Distribute the website content globally for local use. 5. Implement monitoring by using Application Insights and availability web tests including SSL certificate validity and custom header value verification. 6. The website must have 99.95 percent uptime.
Retail store locations
1. Azure Functions must process data immediately when data is uploaded to Blob storage. Azure
Functions must update Azure Cosmos DB by using native SQL language queries. 2. Audit store sale transaction information nightly to validate data, process sales financials, and reconcile inventory.
Delivery services
1. Store service telemetry data in Azure Cosmos DB by using an Azure Function. Data must include an item id, the delivery vehicle license plate, vehicle package capacity, and current vehicle location coordinates. 2. Store delivery driver profile information in Azure Active Directory (Azure AD) by using an Azure Function called from the corporate website.
Inventory services
The company has contracted a third-party to develop an API for inventory processing that requires access to a specific blob within the retail store storage account for three months to include read-only access to the data.
Security
1. All Azure Functions must centralize management and distribution of configuration data for different environments and geographies, encrypted by using a company-provided RSA-HSM key. 2. Authentication and authorization must use Azure AD and services must use managed identities where possible.
Issues
Retail Store Locations
1. You must perform a point-in-time restoration of the retail store location data due to an unexpected and accidental deletion of data. 2. Azure Cosmos DB queries from the Azure Function exhibit high Request Unit (RU) usage and contain multiple, complex queries that exhibit high point read latency for large items as the function app is scaling.
QUESTION 37
HOTSPOT
You need to implement the Azure Function for delivery driver profile information.
Which configurations should you use? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Correct Answer:
Explanation
Explanation/Reference:
Box 1: Azure Identity library
Store delivery driver profile information in Azure Active Directory (Azure AD) by using an Azure Function called from the corporate website.
We recommend that you use a managed identity for applications deployed to Azure. The preceding authentication scenarios are supported by the Azure Identity client library and integrated with Key Vault SDKs.
Note: What is Managed Service Identity? Azure Key Vault avoids the need to store keys and secrets in application code or source control. However, in order to retrieve keys and secrets from Azure Key Vault, you need to authorize a user or application with Azure Key Vault, which in its turn needs another credential. Managed Service Identity avoids the need of storing credentials for Azure Key Vault in application or environment settings by creating a Service Principal for each application or cloud service on which Managed Service Identity is enabled. This Service Principal enables you to call a local MSI endpoint to get an access token from Azure AD using the credentials of the Service Principal. This token is then used to authenticate to an Azure Service, for example Azure Key Vault.
Box 2: Azure Key Vault Azure Key Vault allows you to securely access sensitive information from within your applications: * Keys, secrets, and certificates are protected without your having to write the code yourself, and you can easily use them from your applications.
Use Azure Key Vault to store only secrets for your application. Examples of secrets that should be stored in Key Vault include:
1. Enable developers to write the functions by using the Rust language. 2. Declaratively connect to an Azure Blob Storage account.
You need to implement the app.
Which Azure Function app features should you use? To answer, drag the appropriate features to the correct requirements. Each feature may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.
NOTE: Each correct selection is worth one point.
Correct Answer:
Explanation
Explanation/Reference:
Box 1: Custom handler Custom handlers can be used to create functions in any language or runtime by running an HTTP server process, for example Go or Rust.
Box 2: Trigger
Functions are invoked by a trigger and can have exactly one. In addition to invoking the function, certain triggers also serve as bindings. You may also define multiple bindings in addition to the trigger. Bindings provide a declarative way to connect data to your code.
Case Study 4
Case Study Questions
Background
City Power & Light company provides electrical infrastructure monitoring solutions for homes and businesses. The company is migrating solutions to Azure.
Current environment
Architecture overview
The company has a public website located at http://www.cpandl.com/. The site is a single-page web application that runs in Azure App Service on Linux. The website uses files stored in Azure Storage and cached in Azure Content Delivery Network (CDN) to serve static content.
API Management and Azure Function App functions are used to process and store data in Azure Database for PostgreSQL. API Management is used to broker communications to the Azure Function app functions for Logic app integration. Logic apps are used to orchestrate the data processing while Service Bus and Event Grid handle messaging and events.
The solution uses Application Insights, Azure Monitor, and Azure Key Vault.
Architecture diagram
The company has several applications and services that support their business. The company plans to implement serverless computing where possible. The overall architecture is shown below.
User authentication
The following steps detail the user authentication process:
1. The user selects Sign in in the website. 2. The browser redirects the user to the Azure Active Directory (Azure AD) sign in page. 3. The user signs in. 4. Azure AD redirects the user's session back to the web application. The URL includes an access token. 5. The web application calls an API and includes the access token in the authentication header. The application ID is sent as the audience ('aud') claim in the access token. 6. The back-end API validates the access token.
Requirements
Corporate website
1. Communications and content must be secured by using SSL. 2. Communications must use HTTPS. 3. Data must be replicated to a secondary region and three availability zones. 4. Data storage costs must be minimized.
Azure Database for PostgreSQL
The database connection string is stored in Azure Key Vault with the following attributes:
The connection information is updated frequently. The application must always use the latest information to connect to the database.
Azure Service Bus and Azure Event Grid
1. Azure Event Grid must use Azure Service Bus for queue-based load leveling.
2. Events in Azure Event Grid must be routed directly to Service Bus queues for use in buffering. 3. Events from Azure Service Bus and other Azure services must continue to be routed to Azure Event Grid for processing.
Security
1. All SSL certificates and credentials must be stored in Azure Key Vault. 2. File access must restrict access by IP, protocol, and Azure AD rights. 3. All user accounts and processes must receive only those privileges which are essential to perform their intended function.
Compliance
Auditing of the file updates and transfers must be enabled to comply with General Data Protection Regulation (GDPR). The file updates must be read-only, stored in the order in which they occurred, include only create, update, delete, and copy operations, and be retained for compliance reasons.
Issues
Corporate website
While testing the site, the following error message displays: CryptographicException: The system cannot find the file specified.
Function app
You perform local testing for the RequestUserApproval function. The following error message displays: 'Timeout value of 00:10:00 exceeded by function: RequestUserApproval'
The same error message displays when you test the function in an Azure development environment when you run the following Kusto query: FunctionAppLogs | where FunctionName = = "RequestUserApproval"
Logic app
You test the Logic app in a development environment. The following error message displays: '400 Bad Request' Troubleshooting of the error shows an HttpTrigger action to call the RequestUserApproval function.
Code
Corporate website
Security.cs:
Function app
RequestUserApproval.cs:
QUESTION 39
HOTSPOT
You need to correct the Azure Logic app error message.
Which configuration values should you use? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Correct Answer:
Explanation
Explanation/Reference:
Scenario: You test the Logic app in a development environment. The following error message displays: '400 Bad Request' Troubleshooting of the error shows an HttpTrigger action to call the RequestUserApproval function.
Note: If the inbound call's request body doesn't match your schema, the trigger returns an HTTP 400 Bad Request error.
Box 1: function If you have an Azure function where you want to use the system-assigned identity, first enable authentication for Azure functions.
Box 2: system-assigned Your logic app or individual connections can use either the system-assigned identity or a single user-assigned identity, which you can share across a group of logic apps, but not both.
You develop and deploy an ASP.NET Core application that connects to an Azure Database for MySQL instance.
Connections to the database appear to drop intermittently and the application code does not handle the connection failure.
You need to handle the transient connection errors in code by implementing retries.
What are three possible ways to achieve this goal? Each correct answer presents part of the solution.
NOTE: Each correct selection is worth one point.
A.
Increase connection repeat attempts exponentially up to 120 seconds.
B.
Close the database connection and immediately report an error.
C.
Wait five seconds before repeating the connection attempt to the database.
D.
Disable connection pooling and configure a second Azure Database for MySQL instance.
E.
Set a maximum number of connection attempts to 10 and report an error on subsequent connections.
Correct Answer: ACE
Explanation
Explanation/Reference:
A transient error is an error that will resolve itself. Transient errors can occur for example when hardware or network failure happens.
A best practice for designing and developing applications in the cloud is to expect transient errors. Assume they can happen in any component at any time and have the appropriate logic to handle these situations. Transient errors should be handled using retry logic. A good pattern to follow is:
Wait for 5 seconds before your first retry. For each following retry, the increase the wait exponentially, up to 60 seconds. Set a max number of retries at which point your application considers the operation failed.
You are building a traffic monitoring system that monitors traffic along six highways. The system produces time series analysis-based reports for each highway. Data from traffic sensors are stored in Azure Event Hub.
Traffic data is consumed by four departments. Each department has an Azure Web App that displays the time series-based reports and contains a WebJob that processes the incoming data from Event Hub. All Web Apps run on App Service Plans with three instances.
Data throughput must be maximized. Latency must be minimized.
You need to implement the Azure Event Hub.
Which settings should you use? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Correct Answer:
Explanation
Explanation/Reference:
Box 1: 6 The number of partitions is specified at creation and must be between 2 and 32. There are 6 highways.
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You are developing an Azure Service application that processes queue data when it receives a message from a mobile application. Messages may not be sent to the service consistently.
You have the following requirements:
1. Queue size must not grow larger than 80 gigabytes (GB). 2. Use first-in-first-out (FIFO) ordering of messages. 3. Minimize Azure costs.
You need to implement the messaging solution.
Solution: Use the .Net API to add a message to an Azure Storage Queue from the mobile application. Create an Azure VM that is triggered from Azure Storage Queue events.
Does the solution meet the goal?
A.
Yes
B.
No
Correct Answer: B
Explanation
Explanation/Reference:
Don't use a VM, instead create an Azure Function App that uses an Azure Service Bus Queue trigger.
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear on the review screen.
You are developing an application that needs to react to events from multiple Azure services, such as Azure Blob Storage and Azure Resource Manager, in near real time.
The application must meet the following requirements:
1. Handle a high volume of events without manual intervention. 2. Receive only specific events relevant to your application, based on event types or resource patterns. 3. Ensure that no events are missed, even if the processing application is temporarily unavailable. 4. Use Azure Functions for processing events without managing any infrastructure. 5. Minimize the amount of custom code required for event routing and handling.
You need to develop the solution.
Solution: Deploy an Azure Service Bus namespace. Configure the Azure services to send events to the Service Bus. Implement Azure Functions with Service Bus triggers to process the events. Use Service Bus sessions and message deferral to manage event ordering and reliability.
Does the solution meet the goal?
A.
Yes
B.
No
Correct Answer: B
QUESTION 45
You are developing a software solution for an autonomous transportation system. The solution uses large data sets and Azure Batch processing to simulate navigation sets for entire fleets of vehicles.
You need to create compute nodes for the solution on Azure Batch.
What should you do?
A.
In the Azure portal, create a Batch account.
B.
In a .NET method, call the method: BatchClient.PoolOperations.CreatePool
C.
In Python, implement the class: JobAddParameter
D.
In Python, implement the class: TaskAddParameter
Correct Answer: B
Explanation
Explanation/Reference:
A Batch job is a logical grouping of one or more tasks. A job includes settings common to the tasks, such as priority and the pool to run tasks on. The app uses the BatchClient.JobOperations.CreateJob method to create a job on your pool.
Incorrect Answers: C, D: To create a Batch pool in Python, the app uses the PoolAddParameter class to set the number of nodes, VM size, and a pool configuration.
You have developed a Web App for your company. The Web App provides services and must run in multiple regions.
You want to be notified whenever the Web App uses more than 85 percent of the available CPU cores over a 5 minute period. Your solution must minimize costs.
Which command should you use? To answer, select the appropriate settings to the answer area.
City Power & Light company provides electrical infrastructure monitoring solutions for homes and businesses. The company is migrating solutions to Azure.
Current environment
Architecture overview
The company has a public website located at http://www.cpandl.com/. The site is a single-page web application that runs in Azure App Service on Linux. The website uses files stored in Azure Storage and cached in Azure Content Delivery Network (CDN) to serve static content.
API Management and Azure Function App functions are used to process and store data in Azure Database for PostgreSQL. API Management is used to broker communications to the Azure Function app functions for Logic app integration. Logic apps are used to orchestrate the data processing while Service Bus and Event Grid handle messaging and events.
The solution uses Application Insights, Azure Monitor, and Azure Key Vault.
Architecture diagram
The company has several applications and services that support their business. The company plans to implement serverless computing where possible. The overall architecture is shown below.
User authentication
The following steps detail the user authentication process:
1. The user selects Sign in in the website. 2. The browser redirects the user to the Azure Active Directory (Azure AD) sign in page. 3. The user signs in. 4. Azure AD redirects the user's session back to the web application. The URL includes an access token. 5. The web application calls an API and includes the access token in the authentication header. The application ID is sent as the audience ('aud') claim in the access token. 6. The back-end API validates the access token.
Requirements
Corporate website
1. Communications and content must be secured by using SSL. 2. Communications must use HTTPS. 3. Data must be replicated to a secondary region and three availability zones. 4. Data storage costs must be minimized.
Azure Database for PostgreSQL
The database connection string is stored in Azure Key Vault with the following attributes:
The connection information is updated frequently. The application must always use the latest information to connect to the database.
Azure Service Bus and Azure Event Grid
1. Azure Event Grid must use Azure Service Bus for queue-based load leveling.
2. Events in Azure Event Grid must be routed directly to Service Bus queues for use in buffering. 3. Events from Azure Service Bus and other Azure services must continue to be routed to Azure Event Grid for processing.
Security
1. All SSL certificates and credentials must be stored in Azure Key Vault. 2. File access must restrict access by IP, protocol, and Azure AD rights. 3. All user accounts and processes must receive only those privileges which are essential to perform their intended function.
Compliance
Auditing of the file updates and transfers must be enabled to comply with General Data Protection Regulation (GDPR). The file updates must be read-only, stored in the order in which they occurred, include only create, update, delete, and copy operations, and be retained for compliance reasons.
Issues
Corporate website
While testing the site, the following error message displays: CryptographicException: The system cannot find the file specified.
Function app
You perform local testing for the RequestUserApproval function. The following error message displays: 'Timeout value of 00:10:00 exceeded by function: RequestUserApproval'
The same error message displays when you test the function in an Azure development environment when you run the following Kusto query: FunctionAppLogs | where FunctionName = = "RequestUserApproval"
Logic app
You test the Logic app in a development environment. The following error message displays: '400 Bad Request' Troubleshooting of the error shows an HttpTrigger action to call the RequestUserApproval function.
Code
Corporate website
Security.cs:
Function app
RequestUserApproval.cs:
QUESTION 47
HOTSPOT
You need to retrieve the database connection string.
Which values should you use? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Correct Answer:
Explanation
Explanation/Reference:
Azure database connection string retrieve REST API vault.azure.net/secrets/
Box 1: cpandlkeyvault We specify the key vault, cpandlkeyvault.
Scenario: The database connection string is stored in Azure Key Vault with the following attributes: Azure Key Vault name: cpandlkeyvault Secret name: PostgreSQLConn Id: 80df3e46ffcd4f1cb187f79905e9a1e8
Box 2: PostgreSQLConn We specify the secret, PostgreSQLConn
Example, sample request: https://myvault.vault.azure.net//secrets/mysecretname/4387e9f3d6e14c459867679a90fd0f79?api-version=7.1
You are developing a Java application that uses Cassandra to store key and value data. You plan to use a new Azure Cosmos DB resource and the Cassandra API in the application. You create an Azure Active Directory (Azure AD) group named Cosmos DB Creators to enable provisioning of Azure Cosmos accounts, databases, and containers.
The Azure AD group must not be able to access the keys that are required to access the data.
You need to restrict access to the Azure AD group.
Which role-based access control should you use?
A.
DocumentDB Accounts Contributor
B.
Cosmos Backup Operator
C.
Cosmos DB Operator
D.
Cosmos DB Account Reader
Correct Answer: C
Explanation
Explanation/Reference:
Azure Cosmos DB now provides a new RBAC role, Cosmos DB Operator. This new role lets you provision Azure Cosmos accounts, databases, and containers, but can't access the keys that are required to access the data. This role is intended for use in scenarios where the ability to grant access to Azure Active Directory service principals to manage deployment operations for Cosmos DB is needed, including the account, database, and containers.
You are developing a .NET Core model-view controller (MVC) application hosted on Azure for a health care system that allows providers access to their information. You develop the following code:
You define a role named SysAdmin. You need to ensure that the application meets the following authorization requirements: Allow the ProviderAdmin and SysAdmin roles access to the Partner controller regardless of whether the user holds an editor claim of partner. Limit access to the Manage action of the controller to users with an editor claim of partner who are also members of the SysAdmin role. How should you complete the code? To answer, drag the appropriate code segments to the correct locations. Each code segment may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content. NOTE: Each correct selection is worth one point.
Correct Answer:
Explanation
Explanation/Reference:
Box 1: Allow the ProviderAdmin and SysAdmin roles access to the Partner controller regardless of whether the user holds an editor claim of partner. Box 2: Limit access to the Manage action of the controller to users with an editor claim of partner who are also members of the SysAdmin role.
QUESTION 50
HOTSPOT
You have an Azure Web app that uses Azure Cosmos DB as a data store. You create a CosmosDB container by running the following PowerShell script:
You create the following queries that target the container:
SELECT * FROM c WHERE c.EmployeeId > '12345'
SELECT * FROM c WHERE c.UserID = '12345'
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Correct Answer:
Explanation
Explanation/Reference:
Box 1: No You set the highest, or maximum RU/s Tmax you don't want the system to exceed. The system automatically scales the throughput T such that 0.1* Tmax <= T <= Tmax. In this example we have autoscaleMaxThroughput = 5000, so the minimum throughput for the container is 500 R/Us.
Box 2: No
First query: SELECT * FROM c WHERE c.EmployeeId > '12345' Here's a query that has a range filter on the partition key and won't be scoped to a single physical partition. In order to be an in-partition query, the query must have an equality filter that includes the partition key: SELECT * FROM c WHERE c.DeviceId > 'XMS-0001'
Box 3: Yes Example of In-partition query: Consider the below query with an equality filter on DeviceId. If we run this query on a container partitioned on DeviceId, this query will filter to a single physical partition. SELECT * FROM c WHERE c.DeviceId = 'XMS-0001' References: https://docs.microsoft.com/en-us/azure/cosmos-db/how-to-choose-offer https://docs.microsoft.com/en-us/azure/cosmos-db/how-to-query-container
QUESTION 51
HOTSPOT
You are implementing a software as a service (SaaS) ASP.NET Core web service that will run as an Azure Web App. The web service will use an on-premises SQL Server database for storage. The web service also includes a WebJob that processes data updates. Four customers will use the web service.
1. Each instance of the WebJob processes data for a single customer and must run as a singleton instance. 2. Each deployment must be tested by using deployment slots prior to serving production data. 3. Azure costs must be minimized. 4. Azure resources must be located in an isolated network.
You need to configure the App Service plan for the Web App.
How should you configure the App Service plan? To answer, select the appropriate settings in the answer area.
NOTE: Each correct selection is worth one point.
Correct Answer:
Explanation
Explanation/Reference:
Number of VM instances: 4 You are not charged extra for deployment slots.
Pricing tier: Isolated
The App Service Environment (ASE) is a powerful feature offering of the Azure App Service that gives network isolation and improved scale capabilities. It is essentially a deployment of the Azure App Service into a subnet of a customer's Azure Virtual Network (VNet).
Munson's Pickles and Preserves Farm is an agricultural cooperative corporation based in Washington, US, with farms located across the United States. The company supports agricultural production resources by distributing seeds fertilizers, chemicals, fuel, and farm machinery to the farms.
Current Environment
The company is migrating all applications from an on-premises datacenter to Microsoft Azure. Applications support distributors, farmers, and internal company staff.
Corporate website
The company hosts a public website located at http://www.munsonspicklesandpreservesfarm.com. The site supports farmers and distributors who request agricultural production resources.
Farms
The company created a new customer tenant in the Microsoft Entra admin center to support authentication and authorization for applications.
Distributors
Distributors integrate their applications with data that is accessible by using APIs hosted at http://www.munsonspicklesandpreservesfarm.com/api to receive and update resource data.
Requirements
The application components must meet the following requirements:
Corporate website
1. The site must be migrated to Azure App Service. 2. Costs must be minimized when hosting in Azure. 3. Applications must automatically scale independent of the compute resources. 4. All code changes must be validated by internal staff before release to production.
5. File transfer speeds must improve, and webpage-load performance must increase. 6. All site settings must be centrally stored, secured without using secrets, and encrypted at rest and in transit. 7. A queue-based load leveling pattern must be implemented by using Azure Service Bus queues to support high volumes of website agricultural production resource requests.
Farms
Farmers must authenticate to applications by using Microsoft Entra ID.
Distributors
1. The company must track a custom telemetry value with each API call and monitor performance of all APIs. 2. API telemetry values must be charted to evaluate variations and trends for resource data.
Internal staff
1. App and API updates must be validated before release to production. 2. Staff must be able to select a link to direct them back to the production app when validating an app or API update. 3. Staff profile photos and email must be displayed on the website once they authenticate to applications by using their Microsoft Entra ID.
Security
1. All web communications must be secured by using TLS/HTTPS. 2. Web content must be restricted by country/region to support corporate compliance standards. 3. The principle of least privilege must be applied when providing any user rights or process access rights. 4. Managed identities for Azure resources must be used to authenticate services that support Microsoft Entra ID authentication.
Issues
Corporate website
1. Farmers report HTTP 503 errors at the same time as internal staff report that CPU and memory usage are high. 2. Distributors report HTTP 502 errors at the same time as internal staff report that average response times and networking traffic are high. 3. Internal staff report webpage load sizes are large and take a long time to load. 4. Developers receive authentication errors to Service Bus when they debug locally.
Distributors
Many API telemetry values are sent in a short period of time. Telemetry traffic, data costs, and storage costs must be reduced while preserving a statistically correct analysis of the data points sent by the APIs.
QUESTION 52
HOTSPOT
You need to resolve the authentication errors for developers.
Which Service Bus security configuration should you use? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Correct Answer:
QUESTION 53
HOTSPOT
You have an app that stores player scores for an online game. The app stores data in Azure tables using a class named PlayerScore as the table entity. The table is populated with 100,000 records.
You are reviewing the following section of code that is intended to retrieve 20 records where the player score exceeds 15,000. (Line numbers are included for reference only.)
You have the following code. (Line numbers are included for reference only.)
You store customer information in an Azure Cosmos database. The following data already exists in the database:
You develop the following code. (Line numbers are included for reference only.)
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Correct Answer:
QUESTION 54
You are creating a hazard notification system that has a single signaling server which triggers audio and visual alarms to start and stop.
You implement Azure Service Bus to publish alarms. Each alarm controller uses Azure Service Bus to
receive alarm signals as part of a transaction. Alarm events must be recorded for audit purposes. Each transaction record must include information about the alarm type that was activated.
You need to implement a reply trail auditing solution.
NOTE: Each correct selection is worth one point.
A.
Assign the value of the hazard message MessageId property to the DeliveryCount property.
B.
Assign the value of the hazard message SequenceNumber property to the DeliveryCount property.
C.
Assign the value of the hazard message MessageId property to the SequenceNumber property.
D.
Assign the value of the hazard message MessageId property to the CorrelationId property.
E.
Assign the value of the hazard message SessionID property to the SequenceNumber property..
F.
Assign the value of the hazard message SessionID property to the ReplyToSessionId property.
Correct Answer: DF
Explanation
Explanation/Reference:
D: CorrelationId: Enables an application to specify a context for the message for the purposes of correlation; for example, reflecting the MessageId of a message that is being replied to.
F: ReplyToSessionId: This value augments the ReplyTo information and specifies which SessionId should be set for the reply when sent to the reply entity.
Incorrect Answers: A, B: DeliveryCount Number of deliveries that have been attempted for this message. The count is incremented when a message lock expires, or the message is explicitly abandoned by the receiver. This property is read-only.
C, E: SequenceNumber The sequence number is a unique 64-bit integer assigned to a message as it is accepted and stored by the broker and functions as its true identifier. For partitioned entities, the topmost 16 bits reflect the partition identifier. Sequence numbers monotonically increase and are gapless. They roll over to 0 when the 48-64 bit range is exhausted. This property is read-only.
You are developing an Azure App Service hosted ASP.NET Core API app by using C#. The API app will allow users to authenticate by using Twitter and Azure Active Directory (Azure AD).
Users must be authenticated before calling API methods. You must log the user's name for each method call.
You need to configure the API method calls.
Which values should you use? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Correct Answer:
Explanation
Explanation/Reference:
Box 1: Authorize
Box 2: X-MS-CLIENT-PRINCIPAL-NAME
App Service passes user claims to your application by using special headers. External requests aren't allowed to set these headers, so they are present only if set by App Service. Some example headers include:
X-MS-CLIENT-PRINCIPAL-NAME X-MS-CLIENT-PRINCIPAL-ID Here's the set of headers you get from Easy Auth for a Twitter authenticated user:
You are building a web application that performs image analysis on user photos and returns metadata containing objects identified. The image is very costly in terms of time and compute resources. You are planning to use Azure Redis Cache so duplicate uploads do not need to be reprocessed.
In case of an Azure data center outage, metadata loss must be kept to a minimum. You need to configure the Azure Redis cache instance.
Which two actions should you perform?
A.
Configure Azure Redis with AOF persistence.
B.
Configure Azure Redis with RDB persistence.
C.
Configure second storage account for persistence.
D.
Set backup frequency to the minimum value.
Correct Answer: AC
Explanation
Explanation/Reference:
"RDB is NOT good if you need to minimize the chance of data loss in case Redis stops working". source: https://redis.io/docs/management/persistence/ since the question doesn't mention ZRS for Redis cache, we can use AOF with a 2nd storage to store replica cache data. check the config with AOF: https://learn.microsoft.com/en-us/azure/azure-cache-for-redis/cache-how-to-premium-persistence#set-up-data-persistence
Case Study 2
Case Study Questions
Current environment
Windows Server 2016 virtual machine
This virtual machine (VM) runs BizTalk Server 2016. The VM runs the following workflows:
1. Ocean Transport - This workflow gathers and validates container information including container contents and arrival notices at various shipping ports. 2. Inland Transport - This workflow gathers and validates trucking information including fuel usage, number of stops, and routes.
The VM supports the following REST API calls:
1. Container API - This API provides container information including weight, contents, and other attributes. 2. Location API - This API provides location information regarding shipping ports of call and trucking stops. 3. Shipping REST API - This API provides shipping information for use and display on the shipping website.
Shipping Data
The application uses MongoDB JSON document storage database for all container and transport information.
Shipping Web Site
The site displays shipping container tracking information and container contents. The site is located at http://shipping.wideworldimporters.com/
Proposed solution
The on-premises shipping application must be moved to Azure. The VM has been migrated to a new Standard_D16s_v3 Azure VM by using Azure Site Recovery and must remain running in Azure to complete the BizTalk component migrations. You create a Standard_D16s_v3 Azure VM to host BizTalk Server. The Azure architecture diagram for the proposed solution is shown below:
Requirements
Shipping Logic app
The Shipping Logic app must meet the following requirements:
1. Support the ocean transport and inland transport workflows by using a Logic App. 2. Support industry-standard protocol X12 message format for various messages including vessel content details and arrival notices. 3. Secure resources to the corporate VNet and use dedicated storage resources with a fixed costing model. 4. Maintain on-premises connectivity to support legacy applications and final BizTalk migrations.
Shipping Function app
Implement secure function endpoints by using app-level security and include Azure Active Directory (Azure AD).
REST APIs
The REST API's that support the solution must meet the following requirements:
1. Secure resources to the corporate VNet. 2. Allow deployment to a testing location within Azure while not incurring additional costs. 3. Automatically scale to double capacity during peak shipping times while not causing application downtime. 4. Minimize costs when selecting an Azure payment model.
Shipping data
Data migration from on-premises to Azure must minimize costs and downtime.
Shipping website
Use Azure Content Delivery Network (CDN) and ensure maximum performance for dynamic content while minimizing latency and costs.
Issues
Windows Server 2016 VM
The VM shows high network latency, jitter, and high CPU utilization. The VM is critical and has not been
backed up in the past. The VM must enable a quick restore from a 7-day snapshot to include in-place restore of disks in case of failure.
Shipping website and REST APIs
The following error message displays while you are testing the website:
Failed to load http://test-shippingapi.wideworldimporters.com/: No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'http://test.wideworldimporters.com/' is therefore not allowed access.
QUESTION 57
HOTSPOT
You need to configure Azure App Service to support the REST API requirements.
Which values should you use? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Correct Answer:
Explanation
Explanation/Reference:
Plan: Standard Standard support auto-scaling Instance Count: 10 Max instances for standard is 10.
Scenario: The REST API's that support the solution must meet the following requirements:
1. Allow deployment to a testing location within Azure while not incurring additional costs. 2. Automatically scale to double capacity during peak shipping times while not causing application downtime. 3. Minimize costs when selecting an Azure payment model
You are developing an application that use an Azure blob named data to store application data. The application creates blob snapshots to allow application state to be reverted to an earlier state. The Azure storage account has soft deleted enabled.
The system performs the following operations in order:
1. The blob is updated 2. Snapshot 1 is created. 3. Snapshot 2 is created. 4. Snapshot 1 is deleted.
A system error then deletes the data blob and all snapshots.
You need to determine which application states can be restored.
What is the restorability of the application data? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Correct Answer:
Explanation
Explanation/Reference:
Box 1: Can be restored. When enabled, soft delete enables you to save and recover your data when blobs or blob snapshots are deleted. This protection extends to blob data that is erased as the result of an overwrite.
You are developing an application to retrieve user profile information. The application will use the Microsoft Graph SDK.
The app must retrieve user profile information by using a Microsoft Graph API call.
You need to call the Microsoft Graph API from the application.
In which order should you perform the actions? To answer, move all actions from the list of actions to the answer area and arrange them in the correct order.
Correct Answer:
Explanation
Explanation/Reference:
Step 1: Register the application with the Microsoft identity platform. To authenticate with the Microsoft identity platform endpoint, you must first register your app at the Azure app registration portal
Step 2: Build a client by using the client app ID
Step 3: Create an authentication provider Create an authentication provider by passing in a client application and graph scopes.
Code example: DeviceCodeProvider authProvider = new DeviceCodeProvider(publicClientApplication, graphScopes); // Create a new instance of GraphServiceClient with the authentication provider. GraphServiceClient graphClient = new GraphServiceClient(authProvider);
Step 4: Create a new instance of the GraphServiceClient
Step 5: Invoke the request to the Microsoft Graph API
You need to design network connectivity for a subnet in an Azure virtual network. The subnet will contain 30 virtual machines. The virtual machines will establish outbound connections to internet hosts by using the same a pool of four public IP addresses, inbound connections to the virtual machines will be prevented.
What should include in the design?
A.
Azure Private Link
B.
NAT Gateway
C.
User Defined Routes
D.
Azure Virtual WAN
Correct Answer: D
QUESTION 61
You develop Azure solutions.
A .NET application needs to receive a message each time an Azure virtual machine finishes processing data. The messages must NOT persist after being processed by the receiving application.
You need to implement the .NET object that will receive the messages.
Which object should you use?
A.
QueueClient
B.
SubscriptionClient
C.
TopicClient
D.
CloudQueueClient
Correct Answer: A
Explanation
Explanation/Reference:
A queue allows processing of a message by a single consumer. Need a CloudQueueClient to access the Azure VM.
Incorrect Answers: B, C: In contrast to queues, topics and subscriptions provide a one-to-many form of communication in a publish and subscribe pattern. It's useful for scaling to large numbers of recipients.
The solution must receive and store messages until they can be processed. You create an Azure Service Bus instance by providing a name, pricing tier, subscription, resource group, and location.
You need to complete the configuration.
Which Azure CLI or PowerShell command should you run?
Fourth Coffee is a global coffeehouse chain and coffee company recognized as one of the world's most influential coffee brands. The company is renowned for its specialty coffee beverages, including a wide range of espresso-based dnnks, teas, and other beverages. Fourth Coffee operates thousands of stores worldwide. The company is developing cloud-native applications hosted in Azure.
Corporate website The company hosts a public website located at http://www.fourthcoffee.com/. The website is used to place orders as well as view and update inventory items.
Inventory items In addition to its core coffee offerings, Fourth Coffee recently expanded its menu to include inventory items such as lunch items, snacks, and merchandise. Corporate team members constantly update inventory. Users can customize items. Corporate team members configure inventory items and associated images on the website.
Orders Associates in the store serve customized beverages and items to customers. Orders are placed on the website for pickup. The application components process data as follows: 1. Azure Traffic Manager routes a user order request to the corporate website hosted in Azure App Service. 2. Azure Content Delivery Network serves static images and content to the user. 3. The user signs in to the application through a Microsoft Entra ID for customers tenant. 4. Users search for items and place an order on the website as item images are pulled from Azure Blob Storage 5. Item customizations are placed in an Azure Service Bus queue message. 6. Azure Functions processes item customizations and saves the customized items to Azure Cosmos DB. 7. The website saves order details to Azure SQL Database. 8. SQL Database query results are cached in Azure Cache for Redis to improve performance.
The application consists of the following Azure services:
Requirements
The application components must meet the following requirements: 1. Azure Cosmos DB development must use a native API that receives the latest updates and stores data in a document format. 2. Costs must be minimized for all Azure services. 3. Developers must test Azure Blob Storage integrations locally before deployment to Azure Testing must support the latest versions of the Azure Storage APIs.
Corporate website 1. User authentication and authorization must allow one-time passcode sign-in methods and social identity providers (Google or Facebook). 2. Static web content must be stored closest to end users to reduce network latency.
Inventory items 1. Customized items read from Azure Cosmos DB must maximize throughput while ensuring data is
accurate for the current user on the website. 2. Processing of inventory item updates must automatically scale and enable updates across an entire Azure Cosmos DB container. 3. Inventory items must be processed in the order they were placed in the queue. 4. Inventory item images must be stored as JPEG files in their native format to include exchangeable image file format (data) stored with the blob data upon upload of the image file. 5. The Inventory Items API must securely access the Azure Cosmos DB data.
Orders Orders must receive inventory item changes automatically after inventory items are updated or saved.
Issues 1. Developers are storing the Azure Cosmos DB credentials in an insecure clear text manner within the Inventory Items API code. 2. Production Azure Cache for Redis maintenance has negatively affected application performance.
QUESTION 63
HOTSPOT
You need to save customized items to Azure Cosmos DB.
Which Azure Cosmos DB configuration should you use? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Correct Answer:
QUESTION 64
You develop a Python application for image rendering that uses GPU resources to optimize rendering processes. You deploy the application to an Azure Container Instances (ACI) Linux container.
The application requires a secret value to be passed when the container is started. The value must only be accessed from within the container.
You need to pass the secret value.
What are two possible ways to achieve this goal? Each correct answer presents a complete solution.
NOTE: Each correct selection is worth one point.
A.
Create an environment variable Set the secureValue property to the secret value.
B.
Add the secret value to the container image. Use a managed identity.
C.
Add the secret value to the application code Set the container startup command.
D.
Add the secret value to an Azure Blob storage account. Generate a SAS token.
E.
Mount a secret volume containing the secret value in a secrets file.
Correct Answer: AE
Explanation
Explanation/Reference:
A: Secure environment variables - Another method (another than a secret volume) for providing sensitive information to containers (including Windows containers) is through the use of secure environment variables. E: Use a secret volume to supply sensitive information to the containers in a container group. The secret volume stores your secrets in files within the volume, accessible by the containers in the container group. By storing secrets in a secret volume, you can avoid adding sensitive data like SSH keys or database credentials to your application code. References: https://docs.microsoft.com/en-us/azure/container-instances/container-instances-volume-secret
QUESTION 65
DRAG DROP
You are developing several microservices to run on Azure Container Apps.
The microservices must allow HTTPS access by using a custom domain.
You need to configure the custom domain in Azure Container Apps.
In which order should you perform the actions? To answer, move all actions from the list of actions to the answer area and arrange them in the correct order.
Correct Answer:
Explanation
Explanation/Reference:
Step 1: Enable ingress
Step 2: Add the custom domain name
Step 3: Validate the custom domain name
Step 4: Bind certificate
Step 5: Add DNS records to the domain
Custom domain names and bring your own certificates in Azure Container Apps Add a custom domain and certificate 1. Navigate to your container app in the Azure portal 2. Verify that your app has ingress enabled by selecting Ingress in the Settings section. If ingress is not enabled, enable it. (Step 1) 3. Under the Settings section, select Custom domains. 4. Select the Add custom domain button. (Step 2) 5. In the Add custom domain and certificate window, in TLS/SSL certificate, select Bring your own certificate. (Step 3) 6. In domain, enter the domain you want to add. 7. Select Add a certificate. 8. In the Add certificate window, in Certificate name, enter a name for this certificate. (Step 4)
9. In Certificate file section, browse for the certificate file you want to upload. 10. Select Validate. 11. Once validation succeeds, select Add. 12. In the Add custom domain and certificate window, in Certificate, select the certificate you just added. 13. Select the Hostname record type based on the type of your domain. 14. Using the DNS provider that is hosting your domain, create DNS records based on the Hostname record type you selected using the values shown in the Domain validation section. The records point the domain to your container app and verify that you own it. (Step 5) 15. Select the Validate button. 16. Once validation succeeds, select the Add button. 17. Once the operation is complete, you see your domain name in the list of custom domains with a status of Secured. Navigate to your domain to verify that it's accessible.
You are creating an app that uses Event Grid to connect with other services. Your app's event data will be sent to a serverless function that checks compliance. This function is maintained by your company.
You write a new event subscription at the scope of your resource. The event must be invalidated after 3
specific period of time. You need to configure Event Grid to ensure security.
What should you implement? To answer, select the appropriate options in the answer area;
NOTE: Each correct selection is worth one point
Correct Answer:
Explanation
Explanation/Reference:
Box 1: SAS tokens Custom topics use either Shared Access Signature (SAS) or key authentication.
Microsoft recommends SAS, but key authentication provides simple programming, and is compatible with many existing webhook publishers. In this case we need the expiration time provided by SAS tokens. Box 2: ValidationCode handshake Event Grid supports two ways of validating the subscription: ValidationCode handshake (programmatic) and ValidationURL handshake (manual). If you control the source code for your endpoint, this method is recommended. Incorrect Answers: ValidationURL handshake (manual): In certain cases, you can't access the source code of the endpoint to implement the ValidationCode handshake. For example, if you use a third-party service (like Zapier or IFTTT), you can't programmatically respond with the validation code. References: https://docs.microsoft.com/en-us/azure/event-grid/security-authentication
QUESTION 67
You develop Azure solutions.
You must connect to a No-SQL globally-distributed database by using the .NET API.
You need to create an object to configure and execute requests in the database.
Which code segment should you use?
A.
new Container(EndpointUri, PrimaryKey);
B.
new Database(Endpoint, PrimaryKey);
C.
new CosmosClient(EndpointUri, PrimaryKey);
Correct Answer: C
Explanation
Explanation/Reference:
Example: // Create a new instance of the Cosmos Client this.cosmosClient = new CosmosClient(EndpointUri, PrimaryKey)
//ADD THIS PART TO YOUR CODE await this.CreateDatabaseAsync();
You develop a web application that sells access to last-minute openings for child camps that run on the weekends. The application uses Azure Application Insights for all alerting and monitoring.
The application must alert operators when a technical issue is preventing sales to camps.
You need to build an alert to detect technical issues.
Which alert type should you use?
A.
Metric alert using multiple time series
B.
Metric alert using dynamic thresholds
C.
Log alert using multiple time series
D.
Log alert using dynamic thresholds
Correct Answer: B
Explanation
Explanation/Reference:
Availability alerts Application Insights availability tests send web requests to your application at regular intervals from points around the world. You can receive alerts if your application isn't responding or if it responds too slowly.
Create a custom alert rule If you need advanced capabilities, you can create a custom alert rule on the Alerts tab. Select Create > Alert rule. Choose Metrics for Signal type to show all available signals and select Availability.
In the Alert logic section: * Threshold Select if the threshold should be evaluated based on a static value or a dynamic value. A static threshold evaluates the rule by using the threshold value that you configure. Dynamic thresholds use machine learning algorithms to continuously learn the metric behavior patterns and calculate the appropriate thresholds for unexpected behavior.
You are developing an Azure-hosted application that must use an on-premises hardware security module (HSM) key.
The key must be transferred to your existing Azure Key Vault by using the Bring Your Own Key (BYOK) process.
You need to securely transfer the key to Azure Key Vault.
Which four actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.
Correct Answer:
Explanation
Explanation/Reference:
To perform a key transfer, a user performs following steps: 1. Generate KEK. 2. Retrieve the public key of the KEK. 3. Using HSM vendor provided BYOK tool - Import the KEK into the target HSM and exports the Target Key protected by the KEK. 4. Import the protected Target Key to Azure Key Vault.
Step 1: Generate a Key Exchange Key (KEK).
Step 2: Retrieve the Key Exchange Key (KEK) public key.
Step 3: Generate a key transfer blob file by using the HSM vendor-provided tool. Generate key transfer blob using HSM vendor provided BYOK tool
Step 4: Run the az keyvault key import command Upload key transfer blob to import HSM-key. Customer will transfer the Key Transfer Blob (".byok" file) to an online workstation and then run a az keyvault key import command to import this blob as a new HSM-backed key into Key Vault.
To import an RSA key use this command: az keyvault key import
You need to test the availability of the corporate website.
Which two test types can you use?
A.
Custom testing using the TrackAvailability API method
B.
Standard
C.
URL Ping
D.
Multi-step
Correct Answer: AB
QUESTION 71
Note: The question is included in a number of questions that depicts the identical set-up. However, every question has a distinctive result. Establish if the solution satisfies the requirements.
You are developing a solution for a public facing API.
The API back end is hosted in an Azure App Service instance. You have implemented a RESTful service for the API back end.
You must configure back-end authentication for the API Management service instance.
Solution: You configure Basic gateway credentials for the Azure resource.
Does the solution meet the goal?
A.
Yes
B.
No
Correct Answer: B
Explanation
Explanation/Reference:
API Management allows to secure access to the back-end service of an API using client certificates.
You are developing an application that uses Azure Blob storage.
The application must read the transaction logs of all the changes that occur to the blobs and the blob metadata in the storage account for auditing purposes. The changes must be in the order in which they occurred, include only create, update, delete, and copy operations and be retained for compliance reasons.
You need to process the transaction logs asynchronously.
What should you do?
A.
Process all Azure Blob storage events by using Azure Event Grid with a subscriber Azure Function app.
B.
Enable the change feed on the storage account and process all changes for available events.
C.
Process all Azure Storage Analytics logs for successful blob events.
D.
Use the Azure Monitor HTTP Data Collector API and scan the request body for successful blob events.
Correct Answer: B
Explanation
Explanation/Reference:
Change feed support in Azure Blob Storage The purpose of the change feed is to provide transaction logs of all the changes that occur to the blobs and the blob metadata in your storage account. The change feed provides ordered, guaranteed, durable, immutable, read-only log of these changes. Client applications can read these logs at any time, either in streaming or in batch mode. The change feed enables you to build efficient and scalable solutions that process change events that occur in your Blob Storage account at a low cost.
You have downloaded an Azure Resource Manager template to deploy numerous virtual machines. The template is based on a current virtual machine, but must be adapted to reference an administrative password.
You need to make sure that the password is not stored in plain text.
You are preparing to create the necessary components to achieve your goal.
Which of the following should you create to achieve your goal? Answer by dragging the correct option from the list to the answer area.
Correct Answer:
QUESTION 74
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You are developing a medical records document management website. The website is used to store
scanned copies of patient intake forms.
If the stored intake forms are downloaded from storage by a third party, the contents of the forms must not be compromised.
You need to store the intake forms according to the requirements.
Solution: 1. Create an Azure Cosmos DB database with Storage Service Encryption enabled. 2. Store the intake forms in the Azure Cosmos DB database.
Does the solution meet the goal?
A.
Yes
B.
No
Correct Answer: B
Explanation
Explanation/Reference:
Instead use an Azure Key vault and public key encryption. Store the encrypted from in Azure Storage Blob storage.
QUESTION 75
DRAG DROP
You manage several existing Logic Apps.
You need to change definitions, add new logic, and optimize these apps on a regular basis.
What should you use? To answer, drag the appropriate tools to the correct functionalities. Each tool may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.
NOTE: Each correct selection is worth one point.
Correct Answer:
Explanation
Explanation/Reference:
Box 1: Enterprise Integration Pack For business-to-business (B2B) solutions and seamless communication between organizations, you can build automated scalable enterprise integration workflows by using the Enterprise Integration Pack (EIP) with Azure Logic Apps.
Box 2: Code View Editor Edit JSON - Azure portal 1. Sign in to the Azure portal. 2. From the left menu, choose All services. In the search box, find "logic apps", and then from the results, select your logic app. 3. On your logic app's menu, under Development Tools, select Logic App Code View. 4. The Code View editor opens and shows your logic app definition in JSON format.
The Azure Functions app has the following requirements:
Must be triggered by a message placed in an Azure Storage queue. Must use the queue name set by an app setting named input_queue. Must create an Azure Blob Storage named the same as the content of the message.
You need to identify how to reference the queue and blob name in the function.json file of the Azure Functions app.
How should you reference the names? To answer, select the appropriate values in the answer area.
NOTE: Each correct selection is worth one point.
Correct Answer:
Explanation
Explanation/Reference:
Box 1: {input_queue} Queue name Must be triggered by a message placed in an Azure Storage queue. Must use the queue name set by an app setting named input_queue.
Most expressions are identified by wrapping them in curly braces.
Box 2: {queueTrigger} Blob name Must create an Azure Blob Storage named the same as the content of the message.
Most expressions are identified by wrapping them in curly braces. For example, in a queue trigger function, {queueTrigger} resolves to the queue message text. If the path property for a blob output binding is container/{queueTrigger} and the function is triggered by a queue message HelloWorld, a blob named HelloWorld is created.
You are developing a microservice to run on Azure Container Apps for a company. External HTTP ingress traffic has been enabled.
The company requires that updates to the microservice must not cause downtime.
You need to deploy an update to the microservices.
What should you do?
A.
Enable single revision mode.
B.
Use multiple environments for each container.
C.
Use a private container registry and single image for all containers.
D.
Use a single environment for all containers.
E.
Enable multiple revision mode.
Correct Answer: A
Explanation
Explanation/Reference:
Update As a container app is updated with a revision scope-change, a new revision is created. You can choose whether to automatically deactivate old revisions (single revision mode), or allow them to remain available (multiple revision mode).
When in single revision mode, Container Apps handles the automatic switch between revisions to support zero downtime deployment.
You are a developer for Contoso, Ltd. The company has a social networking website that is developed as a Single Page Application (SPA). The main web application for the social networking website loads user uploaded content from blob storage.
You are developing a solution to monitor uploaded data for inappropriate content. The following process occurs when users upload content by using the SPA:
1. Messages are sent to ContentUploadService. 2. Content is processed by ContentAnalysisService. 3. After processing is complete, the content is posted to the social network or a rejection message is posted in its place.
The ContentAnalysisService is deployed with Azure Container Instances from a private Azure Container Registry named contosoimages.
The solution will use eight CPU cores.
Azure Active Directory
Contoso, Ltd. uses Azure Active Directory (Azure AD) for both internal and guest accounts.
Requirements
ContentAnalysisService
The company's data science group built ContentAnalysisService which accepts user generated content as a string and returns a probable value for inappropriate content. Any values over a specific threshold must be reviewed by an employee of Contoso, Ltd.
You must create an Azure Function named CheckUserContent to perform the content checks.
Costs
You must minimize costs for all Azure services.
Manual review
To review content, the user must authenticate to the website portion of the ContentAnalysisService using their Azure AD credentials. The website is built using React and all pages and API endpoints require authentication. In order to review content a user must be part of a ContentReviewer role. All completed reviews must include the reviewer's email address for auditing purposes.
High availability
All services must run in multiple regions. The failure of any service in a region must not impact overall application availability.
Monitoring
An alert must be raised if the ContentUploadService uses more than 80 percent of available CPU cores.
Security
You have the following security requirements: 1. Any web service accessible over the Internet must be protected from cross site scripting attacks. 2. All websites and services must use SSL from a valid root certificate authority. 3. Azure Storage access keys must only be stored in memory and must be available only to the service. 4. All Internal services must only be accessible from internal Virtual Networks (VNets). 5. All parts of the system must support inbound and outbound traffic restrictions. 6. All service calls must be authenticated by using Azure AD.
User agreements
When a user submits content, they must agree to a user agreement. The agreement allows employees of Contoso, Ltd. to review content, store cookies on user devices, and track user's IP addresses.
Information regarding agreements is used by multiple divisions within Contoso, Ltd.
User responses must not be lost and must be available to all parties regardless of individual service uptime. The volume of agreements is expected to be in the millions per hour.
Validation testing
When a new version of the ContentAnalysisService is available the previous seven days of content must be processed with the new version to verify that the new version does not significantly deviate from the old version.
Issues
Users of the ContentUploadService report that they occasionally see HTTP 502 responses on specific pages.
Code
ContentUploadService
QUESTION 78
You need to deploy the CheckUserContent Azure Function. The solution must meet the security and cost requirements.
Which hosting model should you use?
A.
Premium plan
B.
App Service plan
C.
Consumption plan
Correct Answer: B
Explanation
Explanation/Reference:
Scenario: You must minimize costs for all Azure services. All Internal services must only be accessible from internal Virtual Networks (VNets).
Best for long-running scenarios where Durable Functions can't be used. Consider an App Service plan in the following situations: 1. You have existing, underutilized VMs that are already running other App Service instances. 2. You want to provide a custom image on which to run your functions. 3. Predictive scaling and costs are required.
Note: When you create a function app in Azure, you must choose a hosting plan for your app. There are three basic hosting plans available for Azure Functions: Consumption plan, Premium plan, and Dedicated (App Service) plan.
Incorrect Answers: A: A Premium plan would be more costly. C: Need the VNET functionality.
Note: This question is part of a series of questions that present the same scenario. Each question in the
series contains a unique solution. Determine whether the solution meets the stated goals.
You are developing and deploying several ASP.Net web applications to Azure App Service. You plan to save session state information and HTML output. You must use a storage mechanism with the following requirements:
1. Share session state across all ASP.NET web applications 2. Support controlled, concurrent access to the same session state data for multiple readers and a single writer 3. Save full HTTP responses for concurrent requests
You need to store the information.
Proposed Solution: Add the web applications to Docker containers. Deploy the containers. Deploy the containers to Azure Kubernetes Service (AKS).
Does the solution meet the goal?
A.
Yes
B.
No
Correct Answer: B
Explanation
Explanation/Reference:
Instead use Azure Cache for Redis.
Note: Azure Cache for Redis provides a session state provider that you can use to store your session state in-memory with Azure Cache for Redis instead of a SQL Server database. To use the caching session state provider, first configure your cache, and then configure your ASP.NET application for cache using the Azure Cache for Redis Session State NuGet package.
You are developing a ticket reservation system for an airline.
The storage solution for the application must meet the following requirements:
Ensure at least 99/99% availability and provide low latency. Accept reservations even in network outages or other unforseen failures Process reservations in the exact sequence as reservation are submitted to minimize overbooking or selling the same seat to multiple travelers. Allow simultaneous and out-of-order reservations with a maximum five-second tolerance window.
You provision a resource group named airlineResourceGroup in the Azure South-Central US region.
You need to provision a SQL API Cosmos DB account to support the app.
How should you complete the Azure CLI commands? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Correct Answer:
Explanation
Explanation/Reference:
Box 1: Strong Strong consistency offers a linearizability guarantee. The reads are guaranteed to return the most recent committed version of an item. A client never sees an uncommitted or partial write. Users are always guaranteed to read the latest committed write.
" Process reservations in the exact sequence as reservation are submitted to minimize overbooking or selling the same seat to multiple travelers."
Box 2: Enable-automatic-failover For multi-region Cosmos accounts that are configured with a single-write region, enable automatic-failover by using Azure CLI or Azure portal. After you enable automatic failover, whenever there is a regional disaster, Cosmos DB will automatically failover your account.
" Accept reservations even in network outages or other unforseen failures"
Box 3: southcentralus " You provision a resource group named airlineResourceGroup in the Azure South-Central US region."
The API must be called by an Azure App Service web app. The API must retrieve and update user profile information stored in Azure Active Directory (Azure AD).
You need to configure the API to make the updates.
Which two tools should you use? Each correct answer presents part of the solution
NOTE: Each correct selection is worth one point.
A.
Microsoft Graph API
B.
Microsoft Authentication Library (MSAL)
C.
Azure API Management
D.
Microsoft Azure Security Center
E.
Microsoft Azure Key Vault SDK
Correct Answer: AC
Explanation
Explanation/Reference:
A: You can use the Azure AD REST APIs in Microsoft Graph to create unique workflows between Azure AD resources and third-party services.
Enterprise developers use Microsoft Graph to integrate Azure AD identity management and other services to automate administrative workflows, such as employee onboarding (and termination), profile maintenance, license deployment, and more.
C: API Management (APIM) is a way to create consistent and modern API gateways for existing back-end services.
API Management helps organizations publish APIs to external, partner, and internal developers to unlock the potential of their data and services.
You have an application that includes an Azure Web app and several Azure Function apps. Application secrets including connection strings and certificates are stored in Azure Key Vault.
Secrets must not be stored in the application or application runtime environment. Changes to Azure Active Directory (Azure AD) must be minimized.
You need to design the approach to loading application secrets.
What should you do?
A.
Create a single user-assigned Managed Identity with permission to access Key Vault and configure each App Service to use that Managed Identity.
B.
Create a single Azure AD Service Principal with permission to access Key Vault and use a client secret from within the App Services to access Key Vault.
C.
Create a system assigned Managed Identity in each App Service with permission to access Key Vault.
D.
Create an Azure AD Service Principal with Permissions to access Key Vault for each App Service and use a certificate from within the App Services to access Key Vault.
Correct Answer: C
Explanation
Explanation/Reference:
Use Key Vault references for App Service and Azure Functions. Key Vault references currently only support system-assigned managed identities. User-assigned identities cannot be used.
You are developing a software solution for an autonomous transportation system. The solution uses large data sets and Azure Batch processing to simulate navigation sets for entire fleets of vehicles.
You need to create compute nodes for the solution on Azure Batch.
What should you do?
A.
In the Azure portal, add a Job to a Batch account.
B.
In a .NET method, call the method: BatchClient.PoolOperations.CreateJob
C.
In Python, implement the class: JobAddParameter
D.
In Azure CLI, run the command: az batch pool create
Correct Answer: B
Explanation
Explanation/Reference:
A Batch job is a logical grouping of one or more tasks. A job includes settings common to the tasks, such as priority and the pool to run tasks on. The app uses the BatchClient.JobOperations.CreateJob method to create a job on your pool.
Note: Step 1: Create a pool of compute nodes. When you create a pool, you specify the number of compute nodes for the pool, their size, and the operating system. When each task in your job runs, it's assigned to execute on one of the nodes in your pool. Step 2 : Create a job. A job manages a collection of tasks. You associate each job to a specific pool where that job's tasks will run. Step 3: Add tasks to the job. Each task runs the application or script that you uploaded to process the data files it downloads from your Storage account. As each task completes, it can upload its output to Azure Storage.
Incorrect Answers: C: To create a Batch pool in Python, the app uses the PoolAddParameter class to set the number of nodes, VM size, and a pool configuration.
You are building a traffic monitoring system that monitors traffic along six highways. The system produces time series analysis-based reports for each highway. Data from traffic sensors are stored in Azure Event Hub.
Traffic data is consumed by four departments. Each department has an Azure Web App that displays the time-series-based reports and contains a WebJob that processes the incoming data from Event Hub. All Web Apps run on App Service Plans with three instances.
Data throughout must be maximized. Latency must be minimized.
You need to implement the Azure Event Hub.
Which settings should you use? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Correct Answer:
Explanation
Explanation/Reference:
Box 1: 6 The number of partitions is specified at creation and must be between 2 and 32. There are 6 highways.
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You develop and deploy an Azure App Service API app to a Windows-hosted deployment slot named Development. You create additional deployment slots named Testing and Production. You enable auto swap on the Production deployment slot.
You need to ensure that scripts run and resources are available before a swap operation occurs.
Solution: Enable auto swap for the Testing slot. Deploy the app to the Testing slot.
Does the solution meet the goal?
A.
No
B.
Yes
Correct Answer: B
Explanation
Explanation/Reference:
Instead update the web.config file to include the applicationInitialization configuration element. Specify custom initialization actions to run the scripts.
Note: Some apps might require custom warm-up actions before the swap. The applicationInitialization configuration element in web.config lets you specify custom initialization actions. The swap operation waits for this custom warm-up to finish before swapping with the target slot. Here's a sample web.config fragment.
You are developing a service where customers can report news events from a browser using Azure Web PubSub. The service is implemented as an Azure Function App that uses the JSON WebSocket
subprotocol to receive news events.
You need to implement the bindings for the Azure Function App.
How should you configure the binding? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Correct Answer:
Explanation
Explanation/Reference:
Box 1: webPubSubTrigger WebPubSubTrigger is used when you need to handle requests from service side.
Box 2: user eventType - Required - the value must be set as the event type of messages for the function to be triggered. The value should be either user or system.
You develop and deploy an Azure App Service web app that connects to Azure Cache for Redis as a content cache. All resources have been deployed to the East US 2 region.
The security team requires the following audit information from Azure Cache for Redis:
1. The number of Redis client connections from an associated IP address. 2. Redis operations completed on the content cache. 3. The location (region) in which the Azure Cach3e for Redis instance was accessed.
The audit information must be captured and analyzed by a security team application deployed to the Central US region.
You need to log information on all client connections to the cache.
Which configuration values should you use? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Correct Answer:
Explanation
Explanation/Reference:
Box 1: Log Analytics workspace The regions are different so we must the Log Analytics workspace as Log Destinations
Note: Log Destinations You can turn on diagnostic settings for Azure Cache for Redis instances and send resource logs to the following destinations:
Log Analytics workspace - doesn't need to be in the same region as the resource being monitored.
Storage account - must be in the same region as the cache.
Event hub - diagnostic settings can't access event hub resources when virtual networks are enabled. The event hub must be in the same region as the cache.
Box 2: Diagnostic settings Monitor Azure Cache for Redis data using diagnostic settings Diagnostic settings in Azure are used to collect resource logs. An Azure resource emits resource logs and provides rich, frequent data about the operation of that resource. These logs are captured per request and are also referred to as "data plane logs".
You are developing a medical records document management website. The website is used to store scanned copies of patient intake forms. If the stored intake forms are downloaded from storage by a third party, the content of the forms must not be compromised.
You need to store the intake forms according to the requirements.
Solution: uk.co.certification.simulator.questionpool.PList@1898d9c0 Does the solution meet the goal?
A.
Yes
B.
No
Correct Answer: B
Explanation
Explanation/Reference:
Instead use an Azure Key vault and public key encryption. Store the encrypted from in Azure Storage Blob storage.
QUESTION 89
Note: The question is included in a number of questions that depicts the identical set-up. However, every question has a distinctive result. Establish if the solution satisfies the requirements.
You are configuring a web app that delivers streaming video to users. The application makes use of continuous integration and deployment.
You need to ensure that the application is highly available and that the users' streaming experience is constant. You also want to configure the application to store data in a geographic location that is nearest to the user.
Solution: You include the use of a Storage Area Network (SAN) in your design.
