Microsoft AZ-204 Online Practice Questions and Exam Preparation

Microsoft AZ-204 Online Questions & Answers

• Question 141:

  Your company is developing an Azure API hosted in Azure.

  You need to implement authentication for the Azure API to access other Azure resources. You have the following requirements:

  1. All API calls must be authenticated.

  2. Callers to the API must not send credentials to the API.

  Which authentication mechanism should you use?

  A. Basic
  B. Anonymous
  C. Managed identity
  D. Client certificate
  C. Managed identity

  ---

  Explanation

  Azure Active Directory Managed Service Identity (MSI) gives your code an automatically managed identity for authenticating to Azure services, so that you can keep credentials out of your code.

  Note: Use the authentication-managed-identity policy to authenticate with a backend service using the managed identity. This policy essentially uses the managed identity to obtain an access token from Azure Active Directory for accessing the specified resource. After successfully obtaining the token, the policy will set the value of the token in the Authorization header using the Bearer scheme.

  Incorrect Answers:

  A: Use the authentication-basic policy to authenticate with a backend service using Basic authentication. This policy effectively sets the HTTP Authorization header to the value corresponding to the credentials provided in the policy.

  B: Anonymous is no authentication at all.

  D: Your code needs credentials to authenticate to cloud services, but you want to limit the visibility of those credentials as much as possible. Ideally, they never appear on a developer's workstation or get checked-in to source control. Azure Key Vault can store credentials securely so they aren't in your code, but to retrieve them you need to authenticate to Azure Key Vault. To authenticate to Key Vault, you need a credential! A classic bootstrap problem.

  https://azure.microsoft.com/en-us/blog/keep-credentials-out-of-code-introducing-azure-ad-managed-service-identity/

  https://docs.microsoft.com/en-us/azure/api-management/api-management-authentication-policies

• Question 142:

  DRAG DROP

  You develop and deploy several APIs to Azure API Management.

  You create the following policy fragment named APICounts:

  

  The policy fragment must be reused across various scopes and APIs. The policy fragment must be applied to all APIs and run when a calling system invokes any API.

  You need to implement the policy fragment.

  How should you complete the policy segment? To answer, drag the appropriate XML elements to the correct targets. Each XML element may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.

  NOTE: Each correct selection is worth one point.

  Select and Place:

  

  

  ---

  Box 1: inbound

  Include a fragment in a policy definition

  Configure the include-fragment policy to insert a policy fragment in a policy definition.

  You may include a fragment at any scope and in any policy section, as long as the underlying policy or policies in the fragment support that usage.

  You may include multiple policy fragments in a policy definition.

  For example, insert the policy fragment named ForwardContext in the inbound policy section:

  <policies>

  <inbound>

  <include-fragment fragment-id="ForwardContext" /> <base /> </inbound> [...]

  Box 2: include-fragment

  Box 3: fragment-id

  Box 4: inbound

  https://learn.microsoft.com/en-us/azure/api-management/policy-fragments

• Question 143:

  You manage an Azure Key Vault named kv1 of Standard SKU.

  You plan to programmatically store in kv1 an asymmetric key pair and use the key pair for encryption and decryption.

  You must develop an application named app1 that will access the key pair in kv1.

  You need to configure an object to retrieve a key pair from kv1.

  Which object should you use?

  A. SecretClient
  B. KeyVaultSettingsClient
  C. CertificateClient
  D. KeyClient
  D. KeyClient

• Question 144:

  HOTSPOT

  You are developing an Azure Durable Function based application that processes a list of input values. The application is monitored using a console application that retrieves JSON data from an Azure Function diagnostic endpoint.

  During processing a single instance of invalid input does not cause the function to fail. Invalid input must be available to the monitoring application.

  You need to implement the Azure Durable Function and the monitoring console application.

  How should you complete the code segments? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Box 1: await context.CallEntityAsync(input[errindex],"error")

  Orchestration signals and calls an entity

  Orchestrator functions can access entities by using APIs on the orchestration trigger binding.

  Example:

  [FunctionName("CounterOrchestration")] public static async Task Run(

  [OrchestrationTrigger] IDurableOrchestrationContext context)

  { var entityId = new EntityId(nameof(Counter), "myCounter");

  // Two-way call to the entity which returns a value - awaits the response int currentValue = await context.CallEntityAsync<int>(entityId, "Get");

  Box 2: Failed

  During processing a single instance of invalid input does not cause the function to fail.

  Note:

  RuntimeStatus: One of the following values:

  Failed: The instance failed with an error.

  Completed: The instance has completed normally.

  Terminated: The instance was stopped abruptly.

  Pending: The instance has been scheduled but has not yet started running.

  Running: The instance has started running.

  ContinuedAsNew: The instance has restarted itself with a new history. This state is a transient state.

  Box 3: Input

  Invalid input must be available to the monitoring application.

  https://docs.microsoft.com/en-us/azure/azure-functions/durable/durable-functions-entities

  https://docs.microsoft.com/en-us/azure/azure-functions/durable/durable-functions-instance-management

• Question 145:

  You are developing several Azure API Management (APIM) hosted APIs.

  The APIs have the following requirements:

  Require a subscription key to access all APIs.

  Include terms of use that subscribers must accept to use the APIs.

  Administrators must review and accept or reject subscription attempts.

  Limit the count of multiple simultaneous subscriptions.

  You need to implement the APIs.

  What should you do?

  A. Configure and apply header-based versioning.
  B. Create and publish a product.
  C. Configure and apply query string-based versioning.
  D. Add a new revision to all APIs. Make the revisions current and add a change log entry.
  C. Configure and apply query string-based versioning.

  ---

  Explanation

  Versions in Azure API Management

  Versions allow you to present groups of related APIs to your developers. You can use versions to handle breaking changes in your API safely. Clients can choose to use your new API version when they're ready, while existing clients continue to use an older version. Versions are differentiated through a version identifier (which is any string value you choose), and a versioning scheme allows clients to identify which version of an API they want to use.

  For most purposes, each API version can be considered its own independent API. Two different API versions might have different sets of operations and different policies.

  With versions you can:

  Publish multiple versions of your API at the same time.

  Use a path, query string, or header to differentiate between versions.

  Use any string value you wish to identify your version, which could be a number, a date, or a name.

  Show your API versions grouped together on the developer portal.

  Take an existing (non-versioned) API, and create a new version of it without breaking existing clients.

  Query string-based versioning

  When the query string versioning scheme is used, the version identifier needs to be included in a query string parameter for any API requests. You can specify the name of the query string parameter.

  The format of an API request URL when using query string-based versioning is:

  https://{yourDomain}/{apiName}/{operationId}?{queryStringParameterName}={versionIdentifier}.

  For example,

  https://apis.contoso.com/products?api-version=v1

  and

  https://apis.contoso.com/products?api-version=v2

  could refer to the same products API but to versions v1 and v2 respectively.

  Note: Use a subscription key

  A subscriber can use an API Management subscription key in one of two ways:

  Add the Ocp-Apim-Subscription-Key HTTP header to the request, passing the value of a valid subscription key.

  Include the subscription-key query parameter and a valid value in the URL. The query parameter is checked only if the header isn't present.

  Note: In Azure API Management, subscriptions are the most common way for API consumers to access APIs published through an API Management instance.

  What are subscriptions?

  By publishing APIs through API Management, you can easily secure API access using subscription keys. Developers who need to consume the published APIs must include a valid subscription key in HTTP requests when calling those APIs.

  Without a valid subscription key, the calls are:

  Rejected immediately by the API Management gateway.

  Not forwarded to the back-end services.

  To access APIs, developers need a subscription and a subscription key. A subscription is a named container for a pair of subscription keys.

  In addition, Developers can get subscriptions without needing approval from API publishers.

  API publishers can create subscriptions directly for API consumer

  https://learn.microsoft.com/en-us/azure/api-management/api-management-versions

• Question 146:

  HOTSPOT

  You develop and deploy a web app to Azure App service. The web app allows users to authenticate by using social identity providers through the Azure B2C service. All user profile information is stored in Azure B2C.

  You must update the web app to display common user properties from Azure B2C to include the following information:

  1. Email address

  2. Job title

  3. First name

  4. Last name

  5. Office location

  You need to implement the user properties in the web app.

  Which code library and API should you use? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Box 1: Microsoft Graph

  Microsoft Graph allows you to manage resources in your Azure AD B2C directory. Microsoft Graph API operations are supported for the management of Azure AD B2C resources, including users, identity providers, user flows, custom policies, and policy keys

  Box 2: Microsoft Authentication Library (MSAL) MSAL.js supports authentication with social (Microsoft, Google, Facebook etc.), enterprise (ADFS, Salesforce etc.) and local (stored in the Azure AD B2C directory) identities using Azure AD B2C (B2C for short).

  https://learn.microsoft.com/en-us/azure/active-directory-b2c/microsoft-graph-operations

  https://github.com/AzureAD/microsoft-authentication-library-for-js/blob/dev/lib/msal-browser/docs/working-with-b2c.md

• Question 147:

  You are developing a complex workflow by using Azure Durable Functions.

  During testing you observe that the results of the workflow differ based on how many instances of the Azure Function are running.

  You need to resolve the issue.

  What should you do?

  A. Ensure that all Orchestrator code is deterministic.
  B. Read all state data from the durable function context
  C. Configure the Azure Our able f unction to run on an App Service Plan with one instance.
  D. Implement the monitor pattern within the workflow.
  A. Ensure that all Orchestrator code is deterministic.

• Question 148:

  DRAG DROP

  A company has multiple warehouse. Each warehouse contains IoT temperature devices which deliver temperature data to an Azure Service Bus queue.

  You need to send email alerts to facility supervisors immediately if the temperature at a warehouse goes above or below specified threshold temperatures.

  Which five actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

  Select and Place:

  

  

  ---

  Step 1: Create a blank Logic app.

  Create and configure a Logic App.

  Step 2: Add a logical app trigger that fires when one or more messages arrive in the queue.

  Configure the logic app trigger.

  Under Triggers, select.

  When one or more messages arrive in a queue (auto-complete).

  Step 3: Add an action that reads IoT temperature data from the Service Bus queue

  Step 4: Add a condition that compares the temperature against the upper and lower thresholds.

  Step 5: Add an action that sends an email to specified personnel if the temperature is outside of those thresholds

  https://docs.microsoft.com/en-us/azure/iot-hub/iot-hub-monitoring-notifications-with-azure-logic-apps

• Question 149:

  You are developing an Azure function that connects to an Azure SQL Database instance. The function is triggered by an Azure Storage queue.

  You receive reports of numerous System.InvalidOperationExceptions with the following message:

  "Timeout expired. The timeout period elapsed prior to obtaining a connection from the pool. This may have occurred because all pooled connections were in use and max pool size was reached."

  You need to prevent the exception.

  What should you do?

  A. In the host.json file, decrease the value of the batchSize option
  B. Convert the trigger to Azure Event Hub
  C. Convert the Azure Function to the Premium plan
  D. In the function.json file, change the value of the type option to queueScaling
  A. In the host.json file, decrease the value of the batchSize option

  ---

  Explanation

  With the Premium plan the max outbound connections per instance is unbounded compared to the 600 active (1200 total) in a Consumption plan.

  Note: The number of available connections is limited partly because a function app runs in a sandbox environment. One of the restrictions that the sandbox imposes on your code is a limit on the number of outbound connections, which is currently 600 active (1,200 total) connections per instance. When you reach this limit, the functions runtime writes the following message to the logs: Host thresholds exceeded: Connections.

  https://docs.microsoft.com/en-us/azure/azure-functions/manage-connections

  https://docs.microsoft.com/en-us/azure/azure-functions/functions-scale#service-limits

• Question 150:

  HOTSPOT

  You need to provide internal staff access to the production site after a validation.

  How should you complete the code segment? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  https://learn.microsoft.com/en-us/azure/app-service/deploy-staging-slots?tabs=portal

  "The string x-ms-routing-name=self specifies the production slot. After the client browser accesses the link, it's redirected to the production slot. Every subsequent request has the x-ms-routing-name=self cookie that pins the session to the production slot."