Microsoft AZ-204 Online Practice Questions and Exam Preparation

Microsoft AZ-204 Online Questions & Answers

• Question 381:

  You deploy an Azure App Service web app. You create an app registration for the app in Azure Active Directory (Azure AD) and Twitter.

  The app must authenticate users and must use SSL for all communications. The app must use Twitter as the identity provider.

  You need to validate the Azure AD request in the app code.

  What should you validate?

  A. ID token header
  B. ID token signature
  C. HTTP response code
  D. Tenant ID
  A. ID token header

  ---

  Explanation

  https://docs.microsoft.com/en-us/azure/storage/common/storage-auth-aad-app?tabs=dotnet

• Question 382:

  HOTSPOT

  You are developing a data storage solution for a social networking app.

  The solution requires a mobile app that stores user information using Azure Table Storage.

  You need to develop code that can insert multiple sets of user information.

  How should you complete the code? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Box 1, Box 2: TableBatchOperation

  Create the batch operation.

  TableBatchOperation op = new TableBatchOperation();

  Box 3: ExecuteBatch

  / Execute the batch operation.

  table.ExecuteBatch(op); Note: You can insert a batch of entities into a table in one write operation. Some other notes on batch operations:

  You can perform updates, deletes, and inserts in the same single batch operation.

  A single batch operation can include up to 100 entities.

  All entities in a single batch operation must have the same partition key.

  While it is possible to perform a query as a batch operation, it must be the only operation in the batch.

  References:

  https://docs.microsoft.com/en-us/azure/cosmos-db/table-storage-how-to-use-dotnet

• Question 383:

  You are developing an Azure App Service REST API.

  The API must be called by an Azure App Service web app. The API must retrieve and update user profile information stored in Azure Active Directory (Azure AD).

  You need to configure the API to make the updates.

  Which two tools should you use? Each correct answer presents part of the solution

  NOTE: Each correct selection is worth one point.

  A. Microsoft Graph API
  B. Microsoft Authentication Library (MSAL)
  C. Azure API Management
  D. Microsoft Azure Security Center
  E. Microsoft Azure Key Vault SDK
  A. Microsoft Graph API
  C. Azure API Management

  ---

  Explanation

  A: You can use the Azure AD REST APIs in Microsoft Graph to create unique workflows between Azure AD resources and third-party services.

  Enterprise developers use Microsoft Graph to integrate Azure AD identity management and other services to automate administrative workflows, such as employee onboarding (and termination), profile maintenance, license deployment, and more.

  C: API Management (APIM) is a way to create consistent and modern API gateways for existing back-end services.

  API Management helps organizations publish APIs to external, partner, and internal developers to unlock the potential of their data and services.

  https://docs.microsoft.com/en-us/graph/azuread-identity-access-management-concept-overview

• Question 384:

  DRAG DROP

  You develop and deploy an Azure Logic App that calls an Azure Function app. The Azure Function App includes an OpenAPI (Swagger) definition and uses an Azure Blob storage account. All resources are secured by using Azure Active Directory (Azure AD).

  The Logic App must use Azure Monitor logs to record and store information about runtime data and events. The logs must be stored in the Azure Blob storage account.

  You need to set up Azure Monitor logs and collect diagnostics data for the Azure Logic App.

  Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

  Select and Place:

  

  

  ---

  Step 1: Create a Log Analytics workspace

  Before you start, you need a Log Analytics workspace.

  Step 2: Install the Logic Apps Management solution

  To set up logging for your logic app, you can enable Log Analytics when you create your logic app, or you can install the Logic Apps Management solution in your Log Analytics workspace for existing logic apps.

  Step 3: Add a diagnostic setting to the Azure Logic App

  Set up Azure Monitor logs

  In the Azure portal, find and select your logic app.

  On your logic app menu, under Monitoring, select Diagnostic settings > Add diagnostic setting.

  https://docs.microsoft.com/en-us/azure/logic-apps/monitor-logic-apps-log-analytics

• Question 385:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

  After you answer a question in this question, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You are developing a solution that will be deployed to an Azure Kubernetes Service (AKS) cluster. The solution will include a custom VNet, Azure Container Registry images, and an Azure Storage account.

  The solution must allow dynamic creation and management of all Azure resources within the AKS cluster.

  You need to configure an AKS cluster for use with the Azure APIs.

  Solution: Enable the Azure Policy Add-on for Kubernetes to connect the Azure Policy service to the GateKeeper admission controller for the AKS cluster. Apply a built-in policy to the cluster.

  Does the solution meet the goal?

  A. Yes
  B. No
  B. No

  ---

  Explanation

  Instead create an AKS cluster that supports network policy. Create and apply a network to allow traffic only from within a defined namespace

  References:

  https://docs.microsoft.com/en-us/azure/aks/use-network-policies

• Question 386:

  HOTSPOT

  You are developing a C+ + application that compiles to a native application named process.exe. The application accepts images as input and returns images in one of the following image formats: GIF, PNG, or JPEG.

  You must deploy the application as an Azure Function.

  You need to configure the function and host json files.

  How should you complete the json files? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Box 1: "type": "http"

  Box 2: "customHandler": { "description":{

  A custom handler is defined by configuring the host.json file with details on how to run the web server via the customHandler section.

  The customHandler section points to a target as defined by the defaultExecutablePath.

  Example:

  "customHandler": {

  "description": {

  "defaultExecutablePath": "handler.exe"

  Box 3: "enableForwardingHttpRequest": false

  Incorrect:

  For HTTP-triggered functions with no additional bindings or outputs, you may want your handler to work directly with the HTTP request and response instead of the custom handler request and response payloads. This behavior can be configured in host.json using the enableForwardingHttpRequest setting.

  At the root of the app, the host.json file is configured to run handler.exe and enableForwardingHttpRequest is set to true.

  https://docs.microsoft.com/en-us/azure/azure-functions/functions-custom-handlers

• Question 387:

  An organization deploys Azure Cosmos DB.

  You need to ensure that the index is updated as items are created, updated, or deleted.

  What should you do?

  A. Set the indexing mode to Lazy.
  B. Set the value of the automatic property of the indexing policy to False.
  C. Set the value of the EnableScanInQuery option to True.
  D. Set the indexing mode to Consistent.
  D. Set the indexing mode to Consistent.

  ---

  Explanation

  Azure Cosmos DB supports two indexing modes:

  Consistent: The index is updated synchronously as you create, update or delete items. This means that the consistency of your read queries will be the consistency configured for the account.

  None: Indexing is disabled on the container.

  https://docs.microsoft.com/en-us/azure/cosmos-db/index-policy

• Question 388:

  HOTSPOT

  You are a developer building a web site using a web app. The web site stores configuration data in Azure App Configuration.

  Access to Azure App Configuration has been configured to use the identity of the web app for authentication. Security requirements specify that no other authentication systems must be used.

  You need to load configuration data from Azure App Configuration.

  How should you complete the code? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Box 1: AddAzureAppConfiguration

  Load data from App Configuration, code example:

  public static IHostBuilder CreateHostBuilder(string[] args) =>

  Host.CreateDefaultBuilder(args)

  .ConfigureWebHostDefaults(webBuilder =>

  webBuilder.ConfigureAppConfiguration((hostingContext, config) =>

  {

  var settings = config.Build();

  config.AddAzureAppConfiguration(options =>

  {

  Etc.

  Box 2: ManagedIdentityCredential

  Use managed identities to access App Configuration

  If you want to use a user-assigned managed identity, be sure to specify the clientId when creating the ManagedIdentityCredential.

  config.AddAzureAppConfiguration(options =>

  { options.Connect(new Uri(settings["AppConfig:Endpoint"]), new ManagedIdentityCredential("<your_clientId>"))

  }); Full code sample:

  public static IHostBuilder CreateHostBuilder(string[] args) =>

  Host.CreateDefaultBuilder(args)

  .ConfigureWebHostDefaults(webBuilder =>

  webBuilder.ConfigureAppConfiguration((hostingContext, config) =>

  {

  var settings = config.Build();

  config.AddAzureAppConfiguration(options => options.Connect(new Uri(settings["AppConfig:Endpoint"]), new ManagedIdentityCredential()));

  })

  .UseStartup<Startup>()); Reference:

  https://docs.microsoft.com/en-us/azure/azure-app-configuration/howto-integrate-azure-managed-service-identity?tabs=core5x&pivots=framework-dotnet

• Question 389:

  You provide an Azure API Management managed web service to clients. The back-end web service implements HTTP Strict Transport Security (HSTS).

  Every request to the backend service must include a valid HTTP authorization header.

  You need to configure the Azure API Management instance with an authentication policy.

  Which two policies can you use? Each correct answer presents a complete solution.

  NOTE: Each correct selection is worth one point.

  A. Basic Authentication
  B. Digest Authentication
  C. Certificate Authentication
  D. OAuth Client Credential Grant
  C. Certificate Authentication
  D. OAuth Client Credential Grant

• Question 390:

  DRAG DROP

  You need to ensure disaster recovery requirements are met.

  What code should you add at line PC16?

  To answer, drag the appropriate code fragments to the correct locations. Each code fragment may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.

  NOTE: Each correct selection is worth one point.

  Select and Place:

  

  

  ---

  Scenario: Disaster recovery. Regional outage must not impact application availability. All DR operations must not be dependent on application running and must ensure that data in the DR region is up to date.

  Box 1: DirectoryTransferContext We transfer all files in the directory.

  Note: The TransferContext object comes in two forms: SingleTransferContext and DirectoryTransferContext. The former is for transferring a single file and the latter is for transferring a directory of files.

  Box 2: ShouldTransferCallbackAsync

  The DirectoryTransferContext.ShouldTransferCallbackAsync delegate callback is invoked to tell whether a transfer should be done.

  Box 3: False

  If you want to use the retry policy in Copy, and want the copy can be resume if break in the middle, you can use SyncCopy (isServiceCopy = false).

  Note that if you choose to use service side copy ('isServiceCopy' set to true), Azure (currently) doesn't provide SLA for that. Setting 'isServiceCopy' to false will download the source blob loca

  https://docs.microsoft.com/en-us/azure/storage/common/storage-use-data-movement-library

  https://docs.microsoft.com/en-us/dotnet/api/microsoft.windowsazure.storage.datamovement.directorytransfercontext.shouldtransfercallbackasync?view=azure-dotnet