Microsoft AZ-204 Online Practice Questions and Exam Preparation

Microsoft AZ-204 Online Questions & Answers

• Question 61:

  You are implementing an application by using Azure Event Grid to push near-real-time information to customers.

  You have the following requirements: You must send events to thousands of customers that include hundreds of various event types.

  The events must be filtered by event type before processing.

  Authentication and authorization must be handled by using Microsoft Entra ID.

  The events must be published to a single endpoint.

  You need to implement Azure Event Grid.

  Solution: Enable ingress, create a TCP scale rule, and apply the rule to the container app.

  Does the solution meet the goal?

  A. Yes
  B. No
  B. No

  ---

  Explanation

  Correct Solution: Publish events to a partner topic. Create an event subscription for each customer.

  Partner Events overview for customers - Azure Event Grid

  Azure Event Grid's Partner Events allows customers to subscribe to events that originate in a registered system using the same mechanism they would use for any other event source on Azure, such as an Azure service. Those registered systems integrate with Event Grid are known as "partners".

  This feature also enables customers to send events to partner systems that support receiving and routing events to customer's solutions/endpoints in their platform.

  Note: Partners

  A partner is a kind of publisher that sends events from its system to make them available to Azure customers. A partner is typically a SaaS or ERP provider that integrates with Azure Event Grid to help customers realize event-driven use cases across platforms. Partners not only can publish events to Azure Event Grid, but they can also receive events from it. These capabilities are enabled through the Partner Events feature.

  Note 2: Why should I use Partner Events?

  You may want to use the Partner Events feature if you've one or more of the following requirements.

  You want to subscribe to events that originate in a partner system and route them to event handlers on Azure or to any application or service with a public endpoint.

  You want to take advantage of the rich set Event Grid's destinations/event handlers that react to events from partners.

  *-> You want to forward events raised by your custom application on Azure, an Azure service, or a Microsoft service to your application or service hosted by the partner system. For example, you may want to send Microsoft Entra ID, Teams, SharePoint, or Azure Storage events to a partner system on which you're a tenant for processing.

  You need a resilient push delivery mechanism with send-retry support and at-least once semantics.

  You want to use Cloud Events 1.0 schema for your events.

  Note 3: Partner topic

  Receive events from a partner

  You receive events from a partner in a partner topic that's' created on your behalf by a partner. Here are the high-level steps to subscribe to events from a partner.

  1. Authorize partner to create a partner topic in a resource group you designate. Authorizations are stored in partner configurations (Azure resources).

  2. Request partner to forward your events from its service to your partner topic. Partner provisions a partner topic in the specified resource group of your Azure subscription.

  3. After the partner creates a partner topic in your Azure subscription and resource group, activate your partner topic.

  4. Subscribe to events by creating one or more event subscriptions on the partner topic.

  https://learn.microsoft.com/en-us/azure/event-grid/concepts

  https://learn.microsoft.com/en-us/azure/event-grid/partner-events-overview

• Question 62:

  HOTSPOT

  You are developing an application to store and retrieve data in Azure Blob storage. The application will be hosted in an on-premises virtual machine (VM). The VM is connected to Azure by using a Site-to-Site VPN gateway connection.

  The application is secured by using Azure Active Directory (Azure AD) credentials.

  The application must be granted access to the Azure Blob storage account with a start time, expiry time, and read permissions. The Azure Blob storage account access must use the Azure AD credentials of the application to secure data access. Data access must be able to be revoked if the client application security is breached.

  You need to secure the application access to Azure Blob storage.

  Which security features should you use? To answer select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Box 1: Shared access signature (SAS) token

  When your application design requires shared access signatures for access to Blob storage, use Azure AD credentials to create a user delegation SAS when possible for superior security.

  Box 2: Stored access policy

  Stored access policies give you the option to revoke permissions for a service SAS without having to regenerate the storage account keys.

  A shared access signature can take one of the following two forms:

  1. Service SAS with stored access policy. A stored access policy is defined on a resource container, which can be a blob container, table, queue, or file share. The stored access policy can be used to manage constraints for one or more service shared access signatures. When you associate a service SAS with a stored access policy, the SAS inherits the constraints - the start time, expiry time, and permissions - defined for the stored access policy.

  2. Ad hoc SAS.

  https://docs.microsoft.com/en-us/azure/storage/common/storage-sas-overview

• Question 63:

  You are developing an Azure Function App that generates end of day reports (or retail stores. All stores dose at 11 PM each day. Reports must be run one hour after dosing. You configure the function to use a Timer trigger that runs at midnight Customers in the Western United States Pacific Time zone (UTC - 8) report that the Azure Function runs before the stores dose. You need to ensure that the Azure Function runs at midnight in the Pacific Time zone.

  What should you do?

  A. Configure the Azure Function to run in the West US region.
  B. Add an app setting named WEBSITE_TIME_ZONE that uses the value Pacific Standard Time
  C. Change the Timer trigger to run at 7 AM
  D. Update the Azure Function to a Premium plan.
  A. Configure the Azure Function to run in the West US region.

• Question 64:

  DRAG DROP

  You have an application that provides weather forecasting data to external partners. You use Azure API Management to publish APIs.

  You must change the behavior of the API to meet the following requirements:

  1. Support alternative input parameters.

  2. Remove formatting text from responses.

  3. Provide additional context to back-end services.

  Which types of policies should you implement? To answer, drag the policy types to the correct scenarios. Each policy type may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content

  NOTE: Each correct selection is worth one point.

  Select and Place:

  

  

• Question 65:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear on the review screen.

  You are developing an application that needs to react to events from multiple Azure services, such as Azure Blob Storage and Azure Resource Manager, in near real time.

  The application must meet the following requirements:

  1. Handle a high volume of events without manual intervention.

  2. Receive only specific events relevant to your application, based on event types or resource patterns.

  3. Ensure that no events are missed, even if the processing application is temporarily unavailable.

  4. Use Azure Functions for processing events without managing any infrastructure.

  5. Minimize the amount of custom code required for event routing and handling.

  You need to develop the solution.

  Solution: Deploy an Azure Service Bus namespace. Configure the Azure services to send events to the Service Bus. Implement Azure Functions with Service Bus triggers to process the events. Use Service Bus sessions and message deferral to manage event ordering and reliability.

  Does the solution meet the goal?

  A. Yes
  B. No
  B. No

• Question 66:

  HOTSPOT

  You need to add code at line PC26 of Processing.cs to ensure that security policies are met.

  How should you complete the code that you will add at line PC26? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Box 1: var key = await Resolver.ResolveKeyAsyn(keyBundle,KeyIdentifier.CancellationToken.None); Box 2: var x = new BlobEncryptionPolicy(key,resolver);

  Example:

  // We begin with cloudKey1, and a resolver capable of resolving and caching Key Vault secrets.

  BlobEncryptionPolicy encryptionPolicy = new BlobEncryptionPolicy(cloudKey1, cachingResolver);

  client.DefaultRequestOptions.EncryptionPolicy = encryptionPolicy;

  Box 3: cloudblobClient. DefaultRequestOptions.EncryptionPolicy = x; Reference:

  https://github.com/Azure/azure-storage-net/blob/master/Samples/GettingStarted/EncryptionSamples/KeyRotation/Program.cs

• Question 67:

  You manage a data processing application that receives requests from an Azure Storage queue.

  You need to manage access to the queue. You have the following requirements:

  1. Provide other applications access to the Azure queue.

  2. Ensure that you can revoke access to the queue without having to regenerate the storage account keys.

  3. Specify access at the queue level and not at the storage account level.

  Which type of shared access signature (SAS) should you use?

  A. Service SAS with a stored access policy
  B. Account SAS
  C. User Delegation SAS
  D. Service SAS with ad hoc SAS
  A. Service SAS with a stored access policy

  ---

  Explanation

  A service SAS is secured with the storage account key. A service SAS delegates access to a resource in only one of the Azure Storage services: Blob storage, Queue storage, Table storage, or Azure Files.

  Stored access policies give you the option to revoke permissions for a service SAS without having to regenerate the storage account keys.

  Incorrect Answers:

  Account SAS: Account SAS is specified at the account level. It is secured with the storage account key.

  User Delegation SAS: A user delegation SAS applies to Blob storage only.

  https://docs.microsoft.com/en-us/azure/storage/common/storage-sas-overview

• Question 68:

  DRAG DROP

  You manage an Azure Cosmos DB for a NoSQL API account named account1.

  You configure account1 with the default consistency level. An application named app1 must access containers in account1 to perform read and write operations.

  The connections from app1 to account1 must be established by using the direct mode.

  You plan to configure app1 to override the default consistency level by using the Azure Cosmos DB SDK client.

  You need to set the maximum consistency level for app1 to use for read and write operations.

  Which consistency level should you set? To answer, move the appropriate maximum consistency levels to the correct operation types.

  You may use each maximum consistency level once, more than once, or not at all. You may need to move the split bar between panes or scroll to view content.

  Select and Place:

  

  

• Question 69:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear on the review screen.

  You have an Azure App Service web app named WebApp1 and an Azure Functions app named Function1. WebApp1 is associated with an Application Insights instance named appinsights1.

  You configure a web test and a corresponding alert for WebApp1 in appinsights1. Each alert triggers a delivery of email to your mailbox.

  You need to ensure that each alert also triggers execution of Function1.

  Solution: Configure an Azure Monitor Insights workbook.

  Does the solution meet the goal?

  A. Yes
  B. No
  B. No

• Question 70:

  HOTSPOT

  You are developing an ASP.NET Core app that includes feature flags which are managed by Azure App Configuration. You create an Azure App Configuration store named AppFeatureFlagStore that contains a feature flag named Export.

  You need to update the app to meet the following requirements:

  1. Use the Export feature in the app without requiring a restart of the app.

  2. Validate users before users are allowed access to secure resources.

  3. Permit users to access secure resources.

  How should you complete the code segment? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Box 1: UseAuthentication

  Need to validate users before users are allowed access to secure resources.

  UseAuthentication adds the AuthenticationMiddleware to the specified IApplicationBuilder, which enables authentication capabilities.

  Box 2: UseAuthorization

  Need to permit users to access secure resources.

  UseAuthorization adds the AuthorizationMiddleware to the specified IApplicationBuilder, which enables authorization capabilities.

  Box 3: UseStaticFiles

  Need to use the Export feature in the app without requiring a restart of the app.

  UseStaticFiles enables static file serving for the current request path

  https://docs.microsoft.com/en-us/dotnet/api/microsoft.aspnetcore.builder.iapplicationbuilder?view=aspnetcore-5.0