Microsoft AZ-204 Online Practice Questions and Exam Preparation

Microsoft AZ-204 Online Questions & Answers

• Question 581:

  You are developing a web application that uses Azure Cache for Redis. You anticipate that the cache will frequently fill and that you will need to evict keys.

  You must configure Azure Cache for Redis based on the following predicted usage pattern: A small subset of elements will be accessed much more often than the rest.

  You need to configure the Azure Cache for Redis to optimize performance for the predicted usage pattern.

  Which two eviction policies will achieve the goal?

  NOTE: Each correct selection is worth one point.

  A. noeviction
  B. allkeys-lru
  C. volatile-lru
  D. allkeys-random
  E. volatile-ttl
  F. volatile-random
  B. allkeys-lru
  D. allkeys-random

  ---

  Explanation

  B: The allkeys-lru policy evict keys by trying to remove the less recently used (LRU) keys first, in order to make space for the new data added. Use the allkeys-lru policy when you expect a power-law distribution in the popularity of your requests, that is, you expect that a subset of elements will be accessed far more often than the rest.

  C: volatile-lru: evict keys by trying to remove the less recently used (LRU) keys first, but only among keys that have an expire set, in order to make space for the new data added.

  Note: The allkeys-lru policy is more memory efficient since there is no need to set an expire for the key to be evicted under memory pressure.

  https://redis.io/topics/lru-cache

• Question 582:

  HOTSPOT

  You need to reliably identify the delivery driver profile information.

  How should you configure the system? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Box 1: ID

  Scenario: Store delivery driver profile information in Azure Active Directory (Azure AD) by using an Azure Function called from the corporate website.

  ID token - A JWT that contains claims that you can use to identify users in your application. This token is securely sent in HTTP requests for communication between two components of the same application or service. You can use the claims in an ID token as you see fit. They're commonly used to display account information or to make access control decisions in an application. ID tokens are signed, but the're not encrypted. When your application or API receives an ID token, it must validate the signature to prove that the token is authentic. Your application or API must also validate a few claims in the token to prove that it's valid. Depending on the scenario requirements, the claims validated by an application can vary, but your application must perform some common claim validations in every scenario.

  Box 2: Oid

  Oid - The immutable identifier for the "principal" of the request - the user or service principal whose identity has been verified. In ID tokens and app+user tokens, this is the object ID of the user. In app-only tokens, this is the object ID of the calling service principal. It can also be used to perform authorization checks safely and as a key in database tables. This ID uniquely identifies the principal across applications - two different applications signing in the same user will receive the same value in the oid claim.

  Incorrect:

  Aud - Identifies the intended recipient of the token. For Azure AD B2C, the audience is the application ID. Your application should validate this value and reject the token if it doesn't match. Audience is synonymous with resource.

  Idp - Records the identity provider that authenticated the subject of the token. This value is identical to the value of the Issuer claim unless the user account not in the same tenant as the issuer - guests, for instance. If the claim isn't present, it means that the value of iss can be used instead. For personal accounts being used in an organizational context (for instance, a personal account invited to an Azure AD tenant), the idp claim may be 'live.com' or an STS URI containing the Microsoft account tenant.

  https://docs.microsoft.com/en-us/azure/active-directory-b2c/tokens-overview

  https://docs.microsoft.com/en-us/azure/active-directory/develop/access-tokens

• Question 583:

  You need to secure the Shipping Logic App.

  What should you use?

  A. Azure App Service Environment (ASE)
  B. Integration Service Environment (ISE)
  C. VNet service endpoint
  D. Azure AD B2B integration
  B. Integration Service Environment (ISE)

  ---

  Explanation

  Scenario: The Shipping Logic App requires secure resources to the corporate VNet and use dedicated storage resources with a fixed costing model.

  You can access to Azure Virtual Network resources from Azure Logic Apps by using integration service environments (ISEs).

  Sometimes, your logic apps and integration accounts need access to secured resources, such as virtual machines (VMs) and other systems or services, that are inside an Azure virtual network. To set up this access, you can create an integration service environment (ISE) where you can run your logic apps and create your integration accounts.

  https://docs.microsoft.com/en-us/azure/logic-apps/connect-virtual-network-vnet-isolated-environment-overview

• Question 584:

  DRAG DROP

  You are developing a software solution for an autonomous transportation system. The solution uses large data sets and Azure Batch processing to simulate navigation sets for entire fleets of vehicles.

  You need to create compute nodes for the solution on Azure Batch.

  What should you do?

  Put the actions in the correct order.

  Select and Place:

  

  

  ---

  With the Azure CLI: Step 1: In the Azure CLI, run the command: az batch account create First we create a batch account.

  Step 2: In Azure CLI, run the command: az batch pool create

  Now that you have a Batch account, create a sample pool of Linux compute nodes using the az batch pool create command.

  Step 3: In Azure CLI, run the command: az batch job create

  Now that you have a pool, create a job to run on it. A Batch job is a logical group for one or more tasks. A job includes settings common to the tasks, such as priority and the pool to run tasks on. Create a Batch job by using the az batch job create command.

  Step 4: In Azure CLI, run the command: az batch task create

  Now use the az batch task create command to create some tasks to run in the job.

  References:

  https://docs.microsoft.com/en-us/azure/batch/quick-create-cli

• Question 585:

  You develop Azure Web Apps for a commercial diving company. Regulations require that all divers fill out a health questionnaire every 15 days after each diving job starts.

  You need to configure the Azure Web Apps so that the instance count scales up when divers are filling out the questionnaire and scales down after they are complete.

  You need to configure autoscaling.

  What are two possible auto scaling configurations to achieve this goal? Each correct answer presents a complete solution.

  NOTE: Each correct selection is worth one point.

  A. Recurrence profile
  B. CPU usage-based autoscaling
  C. Fixed date profile
  D. Predictive autoscaling
  B. CPU usage-based autoscaling
  D. Predictive autoscaling

  ---

  Explanation

  B. CPU usage-based autoscaling

  D. Predictive autoscaling

  A. Recurrence profile is used to schedule the scaling of resources at specific times or dates, but it does not meet the requirement to scale up when divers are filling out the questionnaire and scale down after they are complete. It only triggers scaling based on a set schedule, not based on actual usage.

  C. Fixed date profile is used to specify the number of instances at a specific date and time, but it also does not meet the requirement to dynamically scale based on actual usage. It only sets a fixed number of instances and does not adjust based on changing workloads.

• Question 586:

  HOTSPOT

  You need to ensure that network security policies are met.

  How should you configure network security? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Box 1: Valid root certificate

  Scenario: All websites and services must use SSL from a valid root certificate authority.

  Box 2: Azure Application Gateway

  Scenario:

  Any web service accessible over the Internet must be protected from cross site scripting attacks.

  All Internal services must only be accessible from Internal Virtual Networks (VNets) All parts of the system must support inbound and outbound traffic restrictions.

  Azure Web Application Firewall (WAF) on Azure Application Gateway provides centralized protection of your web applications from common exploits and vulnerabilities. Web applications are increasingly targeted by malicious attacks that exploit commonly known vulnerabilities. SQL injection and cross-site scripting are among the most common attacks.

  Application Gateway supports autoscaling, SSL offloading, and end-to-end SSL, a web application firewall (WAF), cookie-based session affinity, URL path-based routing, multisite hosting, redirection, rewrite HTTP headers and other features.

  Note: Both Nginx and Azure Application Gateway act as a reverse proxy with Layer 7 load-balancing features plus a WAF to ensure strong protection against common web vulnerabilities and exploits.

  You can modify Nginx web server configuration/SSL for X-XSS protection. This helps to prevent cross-site scripting exploits by forcing the injection of HTTP headers with X-XSS protection.

  https://docs.microsoft.com/en-us/azure/web-application-firewall/ag/ag-overview

  https://www.upguard.com/articles/10-tips-for-securing-your-nginx-deployment

• Question 587:

  You are developing a .NET Core MVC application that allows customers to research independent holiday accommodation providers.

  You want to implement Azure Search to allow the application to search the index by using various criteria to locate documents related to accommodation.

  You want the application to allow customers to search the index by using regular expressions.

  What should you do?

  A. Configure the SearchMode property of the SearchParameters class.
  B. Configure the QueryType property of the SearchParameters class.
  C. Configure the Facets property of the SearchParameters class.
  D. Configure the Filter property of the SearchParameters class.
  B. Configure the QueryType property of the SearchParameters class.

  ---

  Explanation

  The SearchParameters.QueryType Property gets or sets a value that specifies the syntax of the search query. The default is 'simple'. Use 'full' if your query uses the Lucene query syntax.

  You can write queries against Azure Search based on the rich Lucene Query Parser syntax for specialized query forms: wildcard, fuzzy search, proximity search, regular expressions are a few examples.

  https://docs.microsoft.com/en-us/dotnet/api/microsoft.azure.search.models.searchparameters

  https://docs.microsoft.com/en-us/dotnet/api/microsoft.azure.search.models.searchparameters.querytype

• Question 588:

  You are implementing an Azure API app that uses built-in authentication and authorization functionality.

  All app actions must be associated with information about the current user.

  You need to retrieve the information about the current user.

  What are two ways to achieve the goal? Each correct answer presents a complete solution.

  NOTE: Each correct selection is worth one point.

  A. HTTP headers
  B. environment variables
  C. /.auth/me HTTP endpoint
  D. /.auth/login endpoint
  A. HTTP headers
  C. /.auth/me HTTP endpoint

  ---

  Explanation

  A: After App Service Authentication has been configured, users trying to access your API are prompted to sign in with their organizational account that belongs to the same Azure AD as the Azure AD application used to secure the API. After signing in, you are able to access the information about the current user through the HttpContext.Current.User property.

  C: While the server code has access to request headers, client code can access GET /.auth/me to get the same access tokens ( References:

  https://docs.microsoft.com/en-us/azure/app-service/app-service-web-tutorial-auth-aad

  https://docs.microsoft.com/en-us/sharepoint/dev/spfx/web-parts/guidance/connect-to-api-secured-with-aad