All practice questions
972 questions
You are designing the security architecture for a C# web application deployed to two distinct Azure App Service instances in different regions (East US and West US) to support active-active high availability. Both App Service instances must retrieve database connection strings from a shared Azure Key Vault and connect to a shared Azure SQL Database without storing credentials in code or configuration files.
The design must satisfy the following security and operational constraints:
- Minimize administrative overhead by avoiding the creation of separate database users and Key Vault access policies/RBAC roles for each regional App Service instance.
- Ensure that if one of the App Service instances is deleted, the identity used to authenticate to the Key Vault and Azure SQL Database remains intact and functional for the remaining instance.
- The application code must use the C# Azure.Identity SDK and instantiate DefaultAzureCredential to authenticate to both services.
Which configuration and code setup should you implement to meet these requirements?
An administrator is configuring a Microsoft Entra ID app registration for a background daemon service that runs nightly without any user interaction. The daemon service must read all user profiles in the tenant using the Microsoft Graph API.
Which of the following configuration steps are required to implement this? (Select TWO)
Select all that apply
You are configuring a custom domain `www.contoso.com` for an Azure App Service web app named `app-prod-west`. You must secure the custom domain by using a free App Service Managed Certificate. Which sequence of steps should you perform to complete the configuration?
Drag items to arrange them in the correct order
An organization requires a web application running on Azure App Service to query an Azure SQL Database. The security policy mandates the use of a user-assigned managed identity to eliminate hardcoded credentials. You must perform the configuration steps using the Azure CLI and SQL commands, and configure the .NET application code to connect securely. Which sequence of steps must you perform to provision, configure, and authenticate the application using the user-assigned managed identity?
Drag items to arrange them in the correct order
You are developing a C# background service that processes large video files stored in Azure Blob Storage using the Azure.Storage.Blobs SDK (v12). To prevent multiple instances of the service from processing the same video simultaneously, each instance first acquires an exclusive lease on the target blob. Once processing is complete, the service must perform the following tasks in a thread-safe manner that maintains the concurrency lock until all changes are committed:
1. Write a custom metadata tag to the blob with the key "Status" and the value "Processed".
2. Release the lease immediately afterward to allow other services to access the blob.
The helper method signature is defined as follows:
csharp
public async Task CompleteProcessingAsync(BlobClient blobClient, BlobLeaseClient leaseClient, string leaseId)
{
// Implementation
}
Which of the following code blocks should you use to implement this method?
var metadata = new Dictionary<string, string> { { "Status", "Processed" } };
await leaseClient.ReleaseAsync();
await blobClient.SetMetadataAsync(metadata);
var metadata = new Dictionary<string, string> { { "x-ms-meta-Status", "Processed" } };
var conditions = new BlobRequestConditions { LeaseId = leaseId };
await blobClient.SetMetadataAsync(metadata, conditions);
await leaseClient.ReleaseAsync();
var metadata = new Dictionary<string, string> { { "Status", "Processed" } };
var conditions = new BlobRequestConditions { LeaseId = leaseId };
await blobClient.SetMetadataAsync(metadata, conditions);
await leaseClient.ReleaseAsync();
var metadata = new Dictionary<string, string> { { "Status", "Processed" } };
await blobClient.SetMetadataAsync(metadata);
await leaseClient.ReleaseAsync();
An organization stores system logs in a Standard General Purpose v2 (GPv2) storage account. You are reviewing the following Azure Blob Storage lifecycle management policy:
{
"rules": [
{
"enabled": true,
"name": "log-retention-policy",
"type": "Lifecycle",
"definition": {
"actions": {
"baseBlob": {
"tierToCool": {
"daysAfterModificationGreaterThan": 30
},
"tierToArchive": {
"daysAfterModificationGreaterThan": 90
},
"delete": {
"daysAfterModificationGreaterThan": 180
}
}
},
"filters": {
"blobTypes": [ "blockBlob" ],
"prefixMatch": [ "logs/system-" ],
"blobIndexMatch": [
{
"name": "Environment",
"op": "==",
"value": "Production"
}
]
}
}
}
]
}
Which two of the following statements regarding the behavior and execution of this policy are true?
Select all that apply
An enterprise architecture requires implementing two new applications integrated with Microsoft Entra ID:
1. SyncDaemon: A background service that runs without user interaction to synchronize user profile information across all users in the tenant.
2. UserPortal: A single-page application (SPA) using the OAuth 2.0 authorization code flow with PKCE, allowing signed-in users to view their own profile and access a custom secure web API.
You need to configure the permissions, scopes, and consent for both applications following the principle of least privilege.
Which two configurations should you implement?
Select all that apply
You have an existing Azure Function App (V4 runtime) that uses a standard connection string for the host storage account configuration (AzureWebJobsStorage). To comply with security policies, you must migrate the Function App to use an identity-based connection instead of connection secrets.
Which sequence of steps should you perform to configure the Function App to use a system-assigned managed identity for its host storage?
Drag items to arrange them in the correct order
You are developing a .NET application to move log files between two different Azure Storage accounts. You write the following code using the Azure.Storage.Blobs SDK to copy a blob:
csharp
// Source blob client and destination blob client are initialized.
var sourceBlobClient = sourceContainerClient.GetBlobClient("logs/app.log");
var destBlobClient = destContainerClient.GetBlobClient("archive/app.log");
// Generate source URI with a SAS token.
Uri sourceUri = GetSourceUriWithSas(sourceBlobClient);
// Start the copy operation.
CopyFromUriOperation operation = await destBlobClient.StartCopyFromUriAsync(sourceUri);
// Poll for completion.
await operation.WaitForCompletionAsync();
Which configuration or behavior is correct regarding the SAS token permissions and blob properties for this operation?
A company is deploying a background synchronization service on an external cloud provider's virtual machine. The service requires access to Azure resources. You register the service as an application in Microsoft Entra ID. To comply with corporate security policies, the service must authenticate using a certificate instead of a client secret. Which configuration step must you perform in Microsoft Entra ID to enable this authentication?
You are developing a C# application using the Azure.Storage.Blobs SDK (v12) to process documents in Azure Blob Storage. The application must retrieve a custom metadata property named ComplianceStatus from a blob, update its value to Approved, and save it back to the blob while preserving all other existing metadata.
You write the following method:
csharp
public static async Task UpdateComplianceStatusAsync(BlobClient blobClient)
{
BlobProperties properties = await blobClient.GetPropertiesAsync();
// Retrieve the existing compliance status
string currentStatus = [CODE_BLOCK_1];
if (currentStatus != "Approved")
{
// Update the compliance status
[CODE_BLOCK_2]
}
}
Which combination of code segments should you use to complete the method?
[CODE_BLOCK_2]:
properties.Metadata["x-ms-meta-ComplianceStatus"] = "Approved";
await blobClient.SetMetadataAsync(properties.Metadata);
[CODE_BLOCK_2]:
properties.Metadata["ComplianceStatus"] = "Approved";
await blobClient.SetMetadataAsync(properties.Metadata);
[CODE_BLOCK_2]:
var metadata = new Dictionary<string, string> { { "ComplianceStatus", "Approved" } };
await blobClient.SetMetadataAsync(metadata);
[CODE_BLOCK_2]:
var metadata = new Dictionary<string, string> { { "x-ms-meta-ComplianceStatus", "Approved" } };
await blobClient.SetMetadataAsync(metadata);
An organization is deploying a globally distributed discussion forum application. The database is hosted on an Azure Cosmos DB API for NoSQL account configured with a single write region in East US and a read region in West US. To prevent hot partitions, the development team has configured a high-cardinality partition key on the container. The application requires that users reading posts in West US must always see updates in the exact chronological order in which they were written. Additionally, the database must minimize Request Unit (RU) costs, ensuring read operations consume only 1 RU. Which two consistency levels should you select to meet these requirements? (Select two.)
Select all that apply
You are developing a web application where users must log in using their corporate accounts. After logging in, the application needs to read the profile details of the currently signed-in user from Microsoft Graph. Which type of permission should you configure for the Microsoft Graph API in the Microsoft Entra ID application registration?
You are developing a C# backend service for a multi-tenant logistics application using the Azure Cosmos DB .NET SDK v3. The database contains a Shipments container configured with a partition key path of `/tenantId`.
You need to implement a method to update a shipment's delivery status with the lowest latency and cost. The method must prevent dirty writes if another thread or client instance updates the shipment concurrently.
Which of the following C# code segments should you implement to perform this update operation?
shipment,
shipment.Id,
new PartitionKey(shipment.TenantId),
new ItemRequestOptions { IfMatchEtag = shipment.ETag }
);
shipment,
shipment.Id,
new PartitionKey(shipment.Status),
new ItemRequestOptions { IfMatchEtag = shipment.ETag }
);
shipment,
shipment.Id,
new PartitionKey(shipment.TenantId),
new ItemRequestOptions { SessionToken = shipment.SessionToken }
);
shipment,
shipment.Id,
requestOptions: new ItemRequestOptions { IfMatchEtag = shipment.ETag }
);
You are developing a Python application using the azure-storage-blob (v12) SDK to audit media uploads in an Azure Blob Storage container named 'images'. The application must retrieve a blob's properties and inspect its custom metadata for a key named 'ApproverEmail'. If this key exists, the application must append a new custom metadata key-value pair of 'Status: Approved' to the blob, while preserving all other existing metadata. Which of the following code segments should you use to retrieve the email and update the metadata?
if approver:
metadata = properties.metadata
metadata["status"] = "Approved"
blob_client.set_blob_metadata(metadata)
if approver:
metadata = properties.metadata
metadata["Status"] = "Approved"
blob_client.set_blob_metadata(metadata)
if approver:
metadata = properties.metadata
metadata["x-ms-meta-status"] = "Approved"
blob_client.set_blob_metadata(metadata)
if approver:
blob_client.set_blob_metadata(metadata={"status": "Approved"})
An administrator deletes an Azure App Service instance that was configured to access an Azure Key Vault. The App Service used a system-assigned managed identity for authentication. What happens to the associated managed identity in Microsoft Entra ID after the App Service is deleted?
You are deploying a C# ASP.NET Core web application to an Azure App Service. The application must retrieve secrets from two distinct Azure Key Vaults:
1. `kv-finance`: Contains highly sensitive financial credentials and must only be accessible by this specific App Service instance. Access must be automatically revoked if the App Service is deleted.
2. `kv-shared`: Contains shared configuration data and is accessed by multiple App Service instances across the resource group.
You have created a user-assigned managed identity named `id-shared` for shared resource access. You need to configure the identities and implement the authentication code using the `Azure.Identity` SDK and `DefaultAzureCredential` class.
Which two configuration steps should you implement to satisfy the requirements? (Select two.)
Select all that apply
You are developing an ASP.NET Core web application that will be hosted on two Azure App Service instances: web-app-primary and web-app-secondary. Both web apps must retrieve database connection strings from a shared Azure Key Vault named kv-shared. You decide to use a user-assigned managed identity named id-app-reader to access the Key Vault, ensuring that the identity's lifecycle is independent of the App Service instances. The application code uses the following C# code to authenticate:
csharp
var client = new SecretClient(new Uri("https://kv-shared.vault.azure.net/"), new DefaultAzureCredential());
To implement this security architecture, you assign id-app-reader to both App Service instances and configure the Key Vault access policy. Which of the following configuration steps must you also perform on each App Service instance to ensure that the application successfully authenticates?
You manage an Azure App Service web app named app-orders that includes a production slot and a deployment slot named staging. You configure a system-assigned managed identity for the production slot and grant it access to a production database. You also configure a system-assigned managed identity for the staging slot and grant it access to a test database. You swap the staging slot with the production slot. Which statement describes the managed identity behavior after the swap is completed?
You are deploying a set of Azure Virtual Machines (VMs) that need to read configuration files from a shared Azure Storage account. To simplify access control, you want to create a managed identity as a standalone Azure resource that is shared across all the VMs and persists even if all the VMs are deleted. Which value should you specify for the type property in the identity section of the VM's Azure Resource Manager (ARM) template?