All practice questions

You are developing a document approval workflow using Azure Durable Functions in C# (.NET Isolated). The workflow must wait for an external approval event named `DocumentApproved` for up to $24$ hours. If the event is received within $24$ hours, the document is processed. If the $24$-hour limit is reached without receiving the event, the document must be marked as expired. You write the following orchestrator function code:

csharp
[Function("ApprovalOrchestrator")]
public static async Task Run(
[OrchestrationTrigger] TaskOrchestrationContext context)
{
var approvalTask = context.WaitForExternalEvent<bool>("DocumentApproved");
var timeoutTask = Task.Delay(TimeSpan.FromHours(24));

var completedTask = await Task.WhenAny(approvalTask, timeoutTask);
if (completedTask == approvalTask)
{
bool isApproved = approvalTask.Result;
await context.CallActivityAsync("ProcessDocument", isApproved);
}
else
{
await context.CallActivityAsync("ExpireDocument", null);
}
}

Which of the following describes the defect in this orchestrator code?

A backend API running on Azure Container Instances writes diagnostic log traces to Application Insights. You need to verify if any error-level logs have been recorded recently. Which Kusto Query Language (KQL) keywords complete the query to retrieve all traces with a severity level of 3 that occurred within the last 2 hours?

An organization is developing an ASP.NET Core Web App named ExpenseTracker. The application allows signed-in employees to submit business expenses. To support this, ExpenseTracker must perform the following actions:
1. Retrieve the profile details of the signed-in user from Microsoft Graph.
2. Retrieve a list of departments from a custom protected Web API named DepartmentService (App ID URI: api://departmentservice) on behalf of the signed-in user.

You need to configure the permissions in Microsoft Entra ID for the ExpenseTracker application registration while adhering to the principle of least privilege. Which of the following configuration steps should you perform? (Select TWO)

You are developing a C# daemon application that runs as a background service on an on-premises Windows server. The application must connect to Azure Blob Storage to process files and authenticate to the Microsoft Identity Platform to obtain access tokens. The solution must meet the following security requirements:
- The application must authenticate without user interaction.
- Credentials must not be stored in cleartext in the application files.
- The authentication mechanism must follow the principle of least privilege.

You need to configure the authentication for the application using MSAL.NET. Which two actions should you perform?

You are configuring diagnostics and telemetry for a .NET web application deployed to an Azure App Service that is currently hosted on a Basic (B1) App Service plan. You need to enable Application Insights Profiler to identify performance bottlenecks and hot paths. You also need to enable Snapshot Debugger to capture call stacks and local variables when unhandled exceptions occur. Developers must be able to view and download these debug snapshots in the Azure Portal. Which two actions must you perform? (Select two.)

An organization deploys a background processing application to an Azure App Service Plan in the East US region. The application processes tasks from an Azure Service Bus queue named `task-queue` in the same region.

To handle spikes in workload, you configure an autoscale setting on the App Service Plan with the following scale-out rule:
- Metric source: Service Bus Queue (`task-queue`)
- Metric name: `ActiveMessages`
- Time Grain (Frequency): $1$-minute
- Time Window: $10$-minutes
- Time Aggregation: `Total`
- Operator: `GreaterThan`
- Threshold: $500$
- Scale Action: Increase count by $2$

During a period of stable, low traffic, the queue maintains a steady backlog of approximately $60$ active messages. However, you observe that the App Service Plan unexpectedly scales out to its maximum instance count.

Which of the following is the root cause of this unexpected scaling behavior?

You have an Azure subscription with a Standard General Purpose v2 (GPv2) storage account named `medicalrecordsstore`. The container named `patients` contains the following block blobs:

* `patients/recordA.json`: Modified $120$ days ago. Tag: `ArchiveStatus` = `Ready`. No active lease.
* `patients/recordB.json`: Modified $110$ days ago. Tag: `archivestatus` = `Ready`. No active lease.
* `patients/recordC.json`: Modified $105$ days ago. Tag: `ArchiveStatus` = `Ready`. Has an active lease.

You implement the following lifecycle management policy:

{
"rules": [
{
"enabled": true,
"name": "archiveRule",
"type": "Lifecycle",
"definition": {
"actions": {
"baseBlob": {
"tierToArchive": {
"daysAfterModificationGreaterThan": 100
}
}
},
"filters": {
"blobTypes": ["blockBlob"],
"prefixMatch": ["patients/"],
"blobIndexMatch": [
{
"name": "ArchiveStatus",
"op": "==",
"value": "Ready"
}
]
}
}
}
]
}

After the policy runs, which blobs will be successfully transitioned to the Archive tier?

You are developing a C# ASP.NET Core web application hosted on an Azure App Service. The App Service is already configured with a system-assigned managed identity to access an Azure SQL Database. You need to configure the App Service to access secrets in an Azure Key Vault. The Key Vault uses Azure Role-Based Access Control (Azure RBAC) for its data plane authorization. To minimize the security blast radius, you must use a user-assigned managed identity for Key Vault access. You must implement the solution using the Azure.Identity SDK and the DefaultAzureCredential class without modifying the initialization parameters of DefaultAzureCredential in your application code. Which sequence of steps should you perform to successfully retrieve the secrets?

You are configuring an Azure Event Grid system topic to route system events to an Azure Function. To prevent event loss, you must configure dead-lettering to a secured Azure Storage account. The storage account has its firewall enabled, restricting access to virtual networks and trusted Microsoft services. Which configuration must you implement to authorize Event Grid to write the dead-letter events?

You are developing a background daemon service named DataArchiver that runs on a schedule to back up documents from all user OneDrive libraries to an Azure Blob Storage container. The service must authenticate silently without any user interaction.

You register DataArchiver in Microsoft Entra ID. You need to configure the permissions for Microsoft Graph to allow the service to read the files.

Which configuration should you apply to the application registration to meet the requirements while adhering to the principle of least privilege?

You are designing a monitoring solution for a message-processing application. The application processes messages from an Azure Service Bus queue named orders-queue. You must configure Azure Monitor to trigger an alert when the number of active messages in orders-queue exceeds 1,000. When the alert is triggered, it must perform the following actions:

1. Send an email notification to the operations manager.
2. Execute an Azure Function named ScaleProcessor to increase processing capacity.

Which two configurations are required to implement this solution? (Select TWO.)

You are developing a web application named DocPortal. The application must perform the following security actions:
1. Allow users to sign in and view files stored in their personal OneDrive folders.
2. Allow a scheduled background service within the application to read group memberships across the tenant without a signed-in user.

You need to configure the Microsoft Graph permissions for the application registration. The solution must adhere to the principle of least privilege.

Which two permissions should you configure? (Select two.)

You are developing a web application named ComplianceHub and a backend Web API named AuditAPI. Both applications are registered in Microsoft Entra ID. The applications must meet the following security requirements:

1. ComplianceHub must allow signed-in users to read their own audit reports from AuditAPI.
2. A background archiving service must run nightly to read all audit logs from AuditAPI without user interaction.

You need to configure the permissions and scopes for the application registrations. Which two configurations should you perform? (Select two.)

You are designing autoscale rules for various Azure workloads. Match each workload requirement on the left to the correct Azure Monitor Autoscale configuration pattern on the right to optimize resource scaling and prevent flapping.

You are developing a C# background service that consumes events from an Azure Event Hub. The service must use the EventProcessorClient class from the Azure.Messaging.EventHubs.Processor library and utilize Azure Blob Storage for checkpointing and load balancing.

Which sequence of actions must you perform in your C# code to properly configure, run, and cleanly terminate the event processor?

A background data synchronization service runs on an Azure App Service plan (Standard S2 tier) that is currently scaled to $3$ instances. You need to configure autoscale rules for the App Service plan based on the CPU percentage metric. You define the following rules:

* Scale-out rule: Increase the instance count by $3$ when the average CPU percentage is greater than $75\%$ for 10 minutes.
* Scale-in rule: Decrease the instance count by $3$ when the average CPU percentage is less than a target threshold for 10 minutes.

Under a constant workload, you must prevent the autoscale engine from flapping (repeatedly scaling out and scaling in).

Which of the following configurations should you implement?

You are developing a Single Page Application (SPA) using React and MSAL.js to authenticate users and obtain tokens for a downstream Web API. During the application registration in Microsoft Entra ID, you configured the redirect URI as http://localhost:3000/callback. When testing the authentication flow, the user can successfully sign in and the application receives an authorization code. However, when MSAL.js attempts to exchange the authorization code for an access token by sending a POST request to the token endpoint, the browser blocks the request with a Cross-Origin Resource Sharing (CORS) error. Which of the following describes the cause of this issue and the correct action to resolve it?

A company implements an auditing application that processes financial messages. The application uses an Azure Cache for Redis instance to store temporary transaction states. It is critical that no cached transaction states are evicted under memory pressure, as this would cause auditing mismatches. Instead, if the cache memory limit is reached, the application must receive errors so it can temporarily throttle ingestion. Which eviction policy should you configure for the Azure Cache for Redis instance?

You are developing a C# application that must send a batch of telemetry messages to an Azure Service Bus topic. You are using the Azure.Messaging.ServiceBus SDK. To ensure efficient network usage, you decide to send the messages in a single batch. Move the steps required to initialize the client, construct the batch, send the messages, and clean up resources into the correct chronological order.

You are configuring policies in Azure API Management (APIM) for a secure backend API. You must configure the policy to meet the following requirements:

1. Obtain an Entra ID token using the APIM instance's system-assigned managed identity for the database resource https://database.windows.net/ and use it to authenticate to the backend.
2. Retrieve an API key from Azure Key Vault using an APIM named value named kv-backend-key and send it to the backend in an HTTP header named X-API-Key.

Which two of the following XML snippets represent correct policy configurations that must be placed in the policy file to meet these requirements?