Microsoft AZ-204 Online Practice Questions and Exam Preparation

Microsoft AZ-204 Online Questions & Answers

• Question 451:

  You need to grant access to the retail store location data for the inventory service development effort.

  What should you use?

  A. Azure AD access token
  B. Azure RBAC role
  C. Shared access signature (SAS) token
  D. Azure AD ID token
  E. Azure AD refresh token
  C. Shared access signature (SAS) token

  ---

  Explanation

  A shared access signature (SAS) provides secure delegated access to resources in your storage account. With a SAS, you have granular control over how a client can access your data. For example:

  What resources the client may access.

  What permissions they have to those resources.

  How long the SAS is valid.

  Note: Inventory services:

  The company has contracted a third-party to develop an API for inventory processing that requires access to a specific blob within the retail store storage account for three months to include read-only access to the data.

  https://docs.microsoft.com/en-us/azure/storage/common/storage-sas-overview

• Question 452:

  HOTSPOT

  You are developing an Azure Function app.

  All functions in the app meet the following requirements:

  1. Run until either a successful run or until 10 run attempts occur.

  2. Ensure that there are at least 20 seconds between attempts for up to 15 minutes.

  You need to configure the host.json file.

  How should you complete the code segment? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Box 1: retry

  Example:

  "retry":{

  "strategy":"exponentialBackoff", "maxRetryCount":6, "minimumInterval":"00:00:10", "maximumInterval":"00:05:00"

  Box 2: exponentialBackoff

  Box 3: maxRetryCount

  https://github.com/Azure/azure-webjobs-sdk/issues/2595

• Question 453:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You develop and deploy an Azure App Service API app to a Windows-hosted deployment slot named Development. You create additional deployment slots named Testing and Production. You enable auto swap on the Production deployment slot.

  You need to ensure that scripts run and resources are available before a swap operation occurs.

  Solution: Update the web.config file to include the applicationInitialization configuration element. Specify custom initialization actions to run the scripts.

  Does the solution meet the goal?

  A. No
  B. Yes
  B. Yes

  ---

  Explanation

  Specify custom warm-up.

  Some apps might require custom warm-up actions before the swap. The applicationInitialization configuration element in web.config lets you specify custom initialization actions. The swap operation waits for this custom warm-up to finish before swapping with the target slot. Here's a sample web.config fragment.

  <system.webServer>

  <applicationInitialization>

  <add initializationPage="/" hostName="[app hostname]" /> <add initializationPage="/Home/About" hostName="[app hostname]" /> </applicationInitialization> </system.webServer>

  https://docs.microsoft.com/en-us/azure/app-service/deploy-staging-slots#troubleshoot-swaps

• Question 454:

  HOTSPOT

  You plan to deploy a new application to a Linux virtual machine (VM) that is hosted in Azure.

  The entire VM must be secured at rest by using industry-standard encryption technology to address organizational security and compliance requirements.

  You need to configure Azure Disk Encryption for the VM.

  How should you complete the Azure CLI commands? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Box 1: keyvault

  Create an Azure Key Vault with az keyvault create and enable the Key Vault for use with disk encryption. Specify a unique Key Vault name for keyvault_name as follows:

  keyvault_name=myvaultname$RANDOM az keyvault create \

  --name $keyvault_name \

  --resource-group $resourcegroup \

  --location eastus \

  --enabled-for-disk-encryption True

  Box 2: keyvault key

  The Azure platform needs to be granted access to request the cryptographic keys when the VM boots to decrypt the virtual disks. Create a cryptographic key in your Key Vault with az keyvault key create. The following example creates a key named myKey:

  az keyvault key create \

  --vault-name $keyvault_name \

  --name myKey \

  --protection software Box 3: vm

  Create a VM with az vm create. Only certain marketplace images support disk encryption. The following example creates a VM named myVM using an Ubuntu 16.04 LTS image:

  az vm create \

  --resource-group $resourcegroup \

  --name myVM \

  --image Canonical:UbuntuServer:16.04-LTS:latest \

  --admin-username azureuser \

  --generate-ssh-keys \ Box 4: vm encryption

  Encrypt your VM with az vm encryption enable:

  az vm encryption enable \

  --resource-group $resourcegroup \

  --name myVM \

  --disk-encryption-keyvault $keyvault_name \

  --key-encryption-key myKey \

  --volume-type all Note: seems to an error in the question. Should have enable instead of create.

  Box 5: all

  Encrypt both data and operating system.

  References:

  https://docs.microsoft.com/bs-latn-ba/azure/virtual-machines/linux/encrypt-disks

• Question 455:

  You have an Azure App Services Web App Azure SQL Database instance Azure Storage Account, and an Azure Redis Cache instance in a resource group.

  A developer must be able to publish code to the web app. You must grant the developer the Contribute role to the web app.

  You need to grant the role.

  Which two commands can you use? Each correct answer presents a complete solution.

  NOTE: Each correct selection is worth one point.

  A. az role assignment create
  B. az role definition create
  C. New-AzureRmRoleAssignment
  D. New-AzureRmRoleDefinition
  A. az role assignment create
  C. New-AzureRmRoleAssignment

  ---

  Explanation

  A: The az role assignment create command creates a new role assignment for a user, group, or service principal.

  Example: Create role assignment for an assignee. az role assignment create --assignee sp_name --role a_role

  C: The New-AzureRmRoleAssignment command assigns the specified RBAC role to the specified principal, at the specified scope.

  Incorrect Answers:

  B, D: Creates a custom role in Azure RBAC.

  References:

  https://docs.microsoft.com/en-us/cli/azure/role/assignment?view=azure-cli-latest#az-role-assignment-create

  https://docs.microsoft.com/en-us/powershell/module/azurerm.resources/new-azurermroleassignment?view=azurermps-6.13.0

• Question 456:

  HOTSPOT

  You have an Azure Application Insights resource named Al1. AM monitors an Azure App Service web app named App1.

  You plan to regularly analyze the usage of specific pages of Appl by a subset of users.

  The subset will consist of users who access specific Appl pages five or more times in a given month.

  You must be able to filter sessions and events based on that subset when viewing All in the Azure portal.

  You need to configure AI1 to facilitate your analysis.

  What should you configure for Al1? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection Is worth one point.

  

  

• Question 457:

  You are developing a web app that is protected by Azure Web Application Firewall (WAF). All traffic to the web app is routed through an Azure Application Gateway instance that is used by multiple web apps. The web app address is contoso.azurewebsites.net.

  All traffic must be secured with SSL. The Azure Application Gateway instance is used by multiple web apps.

  You need to configure the Azure Application Gateway for the app.

  Which two actions should you perform? Each correct answer presents part of the solution.

  NOTE: Each correct selection is worth one point.

  A. In the Azure Application Gateway's HTTP setting, enable the Use for App service setting.
  B. Convert the web app to run in an Azure App service environment (ASE).
  C. Add an authentication certificate for contoso.azurewebsites.net to the Azure Application gateway.
  D. In the Azure Application Gateway's HTTP setting, set the value of the Override backend path option to contoso22.azurewebsites.net.
  A. In the Azure Application Gateway's HTTP setting, enable the Use for App service setting.
  D. In the Azure Application Gateway's HTTP setting, set the value of the Override backend path option to contoso22.azurewebsites.net.

  ---

  Explanation

  D: The ability to specify a host override is defined in the HTTP settings and can be applied to any back-end pool during rule creation. The ability to derive the host name from the IP or FQDN of the back-end pool members. HTTP settings also provide an option to dynamically pick the host name from a back-end pool member's FQDN if configured with the option to derive host name from an individual back-end pool member.

  A (not C): SSL termination and end to end SSL with multi-tenant services.

  In case of end to end SSL, trusted Azure services such as Azure App service web apps do not require whitelisting the backends in the application gateway. Therefore, there is no need to add any authentication certificates.

  

  https://docs.microsoft.com/en-us/azure/application-gateway/application-gateway-web-app-overview

• Question 458:

  DRAG DROP

  You develop and deploy a Java application to Azure. The application has been instrumented by using the Application Insights SDK.

  The telemetry data must be enriched and processed before it is sent to the Application Insights service.

  You need to modify the telemetry data.

  Which Application Insights SDK features should you use? To answer, drag the appropriate features to the correct requirements. Each feature may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.

  NOTE: Each correct selection is worth one point.

  Select and Place:

  

  

  ---

  Box 1: Sampling

  Sampling reduces the volume of telemetry without affecting your statistics. It keeps together related data points so that you can navigate between them when you diagnose a problem. In the portal, the total counts are multiplied to compensate for the sampling.

  Box 2: Telemetry initializer

  Telemetry initializers add or modify properties to any telemetry sent from your app, which includes telemetry from the standard modules. For example, you could add calculated values or version numbers by which to filter the data in the portal.

  Box 3: Telemetry processor

  Filtering with telemetry processors lets you filter out telemetry in the SDK before it's sent to the server. For example, you could reduce the volume of telemetry by excluding requests from robots. Filtering is a more basic approach to reducing traffic than sampling. It allows you more control over what's transmitted, but it affects your statistics. For example, you might filter out all successful requests.

  Incorrect:

  * Telemetry channels are responsible for buffering telemetry items and sending them to the Application Insights service, where they're stored for querying and analysis.

  https://learn.microsoft.com/en-us/azure/azure-monitor/app/api-filtering-sampling

• Question 459:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

  After you answer a question in this question, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  Margie's Travel is an international travel and bookings management service. The company is expanding into restaurant bookings. You are tasked with implementing Azure Search for the restaurants listed in their solution.

  You create the index in Azure Search.

  You need to import the restaurant data into the Azure Search service by using the Azure Search .NET SDK.

  Solution:

  1. Create a SearchServiceClient object to connect to the search index.

  2. Create a DataContainer that contains the documents which must be added.

  3. Create a DataSource instance and set its Container property to the DataContainer.

  4. Call the Documents.Suggest method of the SearchIndexClient and pass the DataSource.

  Does the solution meet the goal?

  A. Yes
  B. No
  B. No

  ---

  Explanation

  Use the following method:

  1. - Create a SearchIndexClient object to connect to the search index 2. - Create an IndexBatch that contains the documents which must be added.

  3. - Call the Documents.Index method of the SearchIndexClient and pass the IndexBatch.

  References:

  https://docs.microsoft.com/en-us/azure/search/search-howto-dotnet-sdk

• Question 460:

  HOTSPOT

  You are implementing a software as a service (SaaS) ASP.NET Core web service that will run as an Azure Web App. The web service will use an on-premises SQL Server database for storage. The web service also includes a WebJob that processes data updates. Four customers will use the web service.

  1. Each instance of the WebJob processes data for a single customer and must run as a singleton instance.

  2. Each deployment must be tested by using deployment slots prior to serving production data.

  3. Azure costs must be minimized.

  4. Azure resources must be located in an isolated network.

  You need to configure the App Service plan for the Web App.

  How should you configure the App Service plan? To answer, select the appropriate settings in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Number of VM instances: 4

  You are not charged extra for deployment slots.

  Pricing tier: Isolated

  The App Service Environment (ASE) is a powerful feature offering of the Azure App Service that gives network isolation and improved scale capabilities. It is essentially a deployment of the Azure App Service into a subnet of a customer's Azure Virtual Network (VNet).

  References:

  https://azure.microsoft.com/sv-se/blog/announcing-app-service-isolated-more-power-scale-and-ease-of-use/