All practice questions
972 questions
A developer registers a multitenant web application in their organization's Microsoft Entra ID tenant. When a user from a different organization consents to use the application, which object is automatically created in that user's tenant to represent the application instance and manage its local permissions?
You deploy a Java application to a Linux-based Azure App Service. You must configure a diagnostic logging solution that meets the following requirements:
- Capture the stdout and stderr streams of the container and save them to an Azure Storage account for long-term archiving.
- View the logs in real-time from your local terminal during troubleshooting sessions.
Which two actions should you perform? (Choose two.)
Select all that apply
You are developing a Single Page Application (SPA) in React. The application runs in the user's web browser, authenticates users via Microsoft Entra ID, and reads their calendar events from Microsoft Graph on their behalf. You are creating the app registration in Microsoft Entra ID. Which two configurations should you implement to support this scenario?
Select all that apply
You host a containerized ASP.NET Core web application on a Linux-based Azure App Service. You must implement a diagnostic logging solution that routes all runtime standard output (stdout) and standard error (stderr) logs to an Azure Storage account. The logs must be retained permanently for compliance auditing, and the logging mechanism must not automatically deactivate over time. Which configuration should you implement?
A software-as-a-service (SaaS) provider registers a multi-tenant web application in their home Microsoft Entra ID tenant (Tenant A). An enterprise customer (Tenant B) successfully consents to the application, allowing their users to log in. The SaaS provider now needs to grant this application read access to an Azure SQL Database located in Tenant B. Which identity object in Tenant B must be assigned the database permissions?
You are developing a web application that will be hosted on Azure App Service. The application must retrieve secrets from an Azure Key Vault. You decide to use a user-assigned managed identity for authentication. The application code uses the DefaultAzureCredential class from the Azure.Identity library.
You need to configure the Azure resources and the web application to enable secure access.
Which four actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.
Drag items to arrange them in the correct order
An e-commerce platform uses a Standard General Purpose v2 (GPv2) storage account to store shopping cart session states as block blobs. You configure the following lifecycle management policy to automatically delete abandoned shopping carts after 7 days:
{
"rules": [
{
"enabled": true,
"name": "delete-abandoned-sessions",
"type": "Lifecycle",
"definition": {
"actions": {
"baseBlob": {
"delete": {
"daysAfterModificationGreaterThan": 7
}
}
},
"filters": {
"blobTypes": [
"blockBlob"
],
"blobIndexMatch": [
{
"name": "CartStatus",
"op": "==",
"value": "abandoned"
}
]
}
}
}
]
}
Several block blobs last modified 10 days ago have not been deleted. You confirm the lifecycle policy executed successfully within the last 24 hours. Which of the following is the most likely reason these blobs were not deleted?
An enterprise ASP.NET Core application is hosted on an Azure Virtual Machine. The virtual machine has been assigned two user-assigned managed identities: IdentityA (authorized to read secrets from Azure Key Vault) and IdentityB (authorized to write to Azure Storage). To retrieve secrets, the application uses the following C# code:
csharp
var client = new SecretClient(
new Uri("https://myvault.vault.azure.net/"),
new DefaultAzureCredential()
);
When execution occurs on the virtual machine, authentication fails with a CredentialUnavailableException.
Which action must you perform to resolve the authentication failure?
You need to deploy a containerized API gateway to Azure Container Instances (ACI). The container must be integrated into a new subnet within an existing virtual network to access private back-end services. In which order should you perform the steps to configure and deploy the container group?
Drag items to arrange them in the correct order
You are configuring a web app named `app-payments` on Azure App Service to retrieve database credentials from Azure Key Vault. You have created a user-assigned managed identity named `id-payments` and granted it GET permissions on the Key Vault secrets. You have also assigned `id-payments` to `app-payments` and added the app setting `DbConnectionString` with the value `@Microsoft.KeyVault(SecretUri=https://myvault.vault.azure.net/secrets/dbconn/)`. However, the web app fails to resolve the Key Vault reference at runtime.
Which configuration must you apply to resolve this issue?
You are developing an Azure Function App (V4 runtime) that must retrieve a database connection string from an Azure Key Vault using Key Vault references. You enable a system-assigned managed identity for the Function App. You then add the following environment variable to the Function App configuration:
DbConnectionString = @Microsoft.KeyVault(SecretUri=https://mykeyvault.vault.azure.net/secrets/db-conn/)
When the function executes, it fails to connect to the database. Upon inspection, you find that the function is retrieving the raw reference string @Microsoft.KeyVault(...) instead of the secret value.
Which of the following is the most likely cause of this behavior?
You are developing a backend synchronization service in C# using the Azure.Storage.Blobs SDK (v12). The service needs to update the metadata of a critical blob. However, another worker instance crashed while holding an active lease on the blob, blocking updates. To recover, your service must immediately break the existing lease, secure a new lease to prevent other instances from writing, update the blob's metadata, and clean up. Arrange the steps in the correct order to perform this workflow.
Drag items to arrange them in the correct order
Your company has developed a multi-tenant software-as-a-service (SaaS) application registered in Microsoft Entra Tenant A. Several client organizations, including Tenant B, have consented to the application, which created a service principal for the application in each customer tenant. The application runs as a background daemon service and uses the client credentials flow with a client secret to access APIs in each customer's tenant. You need to rotate the client secret without causing service interruption or requiring the customers' administrators to perform any actions. Which of the following is the correct way to rotate the secret?
A company is developing a globally distributed retail catalog application. The database is hosted on an Azure Cosmos DB API for NoSQL account with a single write region in East US and a read-only replica in West US. The application requires that multiple independent client applications reading from the West US region must observe updates in the exact sequence they were committed in East US. To optimize performance and reduce request unit (RU) consumption, the consistency level must offer the lowest latency and resource cost possible while still guaranteeing ordered reads. Which consistency level should you configure for the Azure Cosmos DB account?
You are developing a background daemon service that will run on an on-premises server. The service must periodically scan all user mailboxes in your organization's Microsoft Entra ID tenant and archive email attachments to Azure Blob Storage. The service will run in the background without any user interaction or sign-in.
You register the application in Microsoft Entra ID. You need to configure the API permissions and authentication requirements.
Which two actions should you perform to configure the application registration and permissions? (Select two.)
Select all that apply
You are developing an ASP.NET Core web application hosted on Azure App Service that retrieves database connection strings from Azure Key Vault. The application uses the DefaultAzureCredential class from the Azure.Identity library to authenticate. To meet security requirements, the managed identity must be exclusive to this App Service instance, and its lifecycle must be bound directly to the App Service. You run the command 'az webapp identity assign --name MyWebApp --resource-group MyResourceGroup' to configure the App Service. However, when the web application starts up and attempts to retrieve a secret, a credential retrieval error occurs. Which of the following actions should you perform to resolve this issue?
You are configuring security for an Azure Function App that needs to read files from an Azure Storage account. You want to use a managed identity to authenticate. You must determine the characteristics of system-assigned and user-assigned managed identities to choose the best option.
Which of the following statements about these managed identity types are correct? (Select TWO)
Select all that apply
You are deploying a single Azure App Service web app that needs to retrieve database credentials securely. You want to enable a managed identity for the web app to access Azure Key Vault. The identity must share the lifecycle of the App Service resource, meaning that if the App Service is deleted, the identity is automatically cleaned up. Which identity type or configuration should you implement for the App Service?
A backend service is being updated to coordinate access to a shared log file stored in Azure Blob Storage. To ensure thread safety when modifying metadata, the service must obtain a write lease, perform the metadata update, and clean up the lease. What is the correct sequence of operations to complete this task using the Azure.Storage.Blobs namespace?
Drag items to arrange them in the correct order
An enterprise microservice architecture uses an Azure Cosmos DB SQL API container to store user profiles. The container's partition key path is set to `/userId`, and the database account uses Session consistency. Each user profile is managed by independent client applications running on different host nodes.
A write operation executed by one client node updates a user profile. Immediately following this write, a second client node needs to retrieve the updated profile. To achieve read-your-writes consistency across these separate client nodes, you must retrieve the write operation's session state and apply it to the read request.
Which C# code segment using the Cosmos DB .NET SDK v3 correctly implements this consistency requirement?
await container.UpsertItemAsync<UserProfile>(profile, new PartitionKey(profile.UserId));
// App Service B
ItemResponse<UserProfile> response = await container.ReadItemAsync<UserProfile>(userId, new PartitionKey(userId));
ItemResponse<UserProfile> response = await container.UpsertItemAsync<UserProfile>(profile, new PartitionKey(profile.UserId));
string sessionToken = response.Headers.Session;
// App Service B
ItemRequestOptions options = new ItemRequestOptions { SessionToken = sessionToken };
ItemResponse<UserProfile> response = await container.ReadItemAsync<UserProfile>(userId, new PartitionKey(userId), options);
ItemResponse<UserProfile> response = await container.UpsertItemAsync<UserProfile>(profile, new PartitionKey(profile.Status));
string sessionToken = response.Headers.Session;
// App Service B
ItemRequestOptions options = new ItemRequestOptions { SessionToken = sessionToken };
ItemResponse<UserProfile> response = await container.ReadItemAsync<UserProfile>(userId, new PartitionKey(profile.Status), options);
ItemResponse<UserProfile> response = await container.UpsertItemAsync<UserProfile>(profile, new PartitionKey(profile.UserId));
string sessionToken = response.Headers.Session;
// App Service B
CosmosClientOptions clientOptions = new CosmosClientOptions { ApplicationName = sessionToken };
CosmosClient client = new CosmosClient(connectionString, clientOptions);
Container container = client.GetContainer(dbId, containerId);
ItemResponse<UserProfile> response = await container.ReadItemAsync<UserProfile>(userId, new PartitionKey(userId));