All practice questions

You are developing a secure daemon service that runs on an on-premises Linux server. The service must authenticate with Microsoft Entra ID to retrieve secrets from an Azure Key Vault. Security policies prohibit the use of client secrets (passwords) for daemon services, requiring certificate-based authentication instead. You generate a self-signed certificate on the Linux server and register the application in Microsoft Entra ID under the name OnPremDaemon. Which configuration step must you perform in Microsoft Entra ID to enable the service to authenticate using this certificate?

You need to copy several files from a source blob container in one Azure Storage account to a destination blob container in a different Azure Storage account using the AzCopy command-line tool. Which two of the following security and access configuration steps are required to perform this copy operation? (Select two.)

You are developing a .NET application using the Azure.Storage.Blobs SDK to update the custom metadata of an existing block blob. To prevent concurrent writes and ensure that no existing metadata is lost, you must acquire an exclusive-write lease, retrieve the current metadata, append a new key-value pair, save the changes, and release the lease. Which sequence of steps should you perform to complete this process securely and without data loss?

You are deploying a web application to Azure App Service using an Azure Resource Manager (ARM) template. The application must retrieve database connection strings from Azure Key Vault. Security requirements specify that the managed identity used by the application must be decoupled from the App Service's lifecycle so it can be shared with an Azure Function in the future, and it must not be deleted if the App Service is removed. Which two of the following configuration steps must you perform to implement this security architecture? (Select TWO.)

You are troubleshooting a high-volume Azure web application that sends telemetry to Application Insights. You need to write a Kusto Query Language (KQL) query to retrieve all failed requests that occurred during the last 24 hours.

Which of the following queries is the most efficient and syntactically correct way to retrieve this data?

You are developing a local console application that runs on an on-premises developer workstation. The application must periodically upload application diagnostic logs to a specific container in an Azure Storage account. You plan to configure the application to authenticate using a Microsoft Entra ID service principal with a client secret, adhering to the principle of least privilege.

Which sequence of steps should you perform to configure the identity, permissions, and application code?

A company uses a Standard General Purpose v2 (GPv2) storage account to store temporary media processing files in a container named incoming-transcodes. You configure a lifecycle management policy to delete all blobs in this container 7 days after they are created. Some of these blobs are actively leased by processing worker roles, while others are accessed by external clients using Shared Access Signatures (SAS). Which of the following describes the execution behavior of the lifecycle management policy when it runs?

A developer is configuring a Microsoft Entra ID app registration for a web application named SalesReporter. The web application allows users to sign in and needs to access Microsoft Graph to read the signed-in user's profile and send emails on their behalf. Which two Microsoft Graph delegated permissions must be configured? Select two options.

An enterprise data ingestion workflow in C# uses the Azure.Storage.Blobs SDK (v12) to process telemetry payloads. To prevent concurrent write conflicts on a shared blob named `active_logs.json`, the workflow must acquire an exclusive 30-second write lock (lease), perform the upload, and subsequently update the blob's metadata. Consider the following code skeleton:

csharp
using Azure.Storage.Blobs;
using Azure.Storage.Blobs.Models;
using Azure.Storage.Blobs.Specialized;
using System;
using System.IO;
using System.Collections.Generic;
using System.Threading.Tasks;

public class LogProcessor
{ public static async Task UploadLogWithLeaseAsync(BlobClient blobClient, Stream logStream)
{
BlobLeaseClient leaseClient = blobClient.GetBlobLeaseClient();
BlobLease lease = await leaseClient.AcquireAsync(TimeSpan.FromSeconds(30));

// Configure upload options
BlobUploadOptions uploadOptions = new BlobUploadOptions();

// Execute upload
await blobClient.UploadAsync(logStream, uploadOptions);

// Update metadata
var metadata = new Dictionary<string, string>
{ { "Status", "Processed" }
};

await blobClient.SetMetadataAsync(metadata);
}
}

If you execute this code, the write operations will fail because the active lease ID is not supplied to the operations. Which of the following changes must you implement to ensure both the upload and metadata update operations succeed under the active lease? (Select TWO options.)

An organization is deploying a C# .NET 8 application to an Azure App Service. The application must perform the following tasks:

1. Retrieve configuration secrets from an Azure Key Vault. The Key Vault is shared across several independent applications, and the credentials used to access it must persist even if this App Service instance is deleted.
2. Read messages from an Azure Service Bus queue. The credentials used for the queue must be exclusively tied to this App Service instance's lifecycle and automatically cleaned up if the App Service is deleted.

The application uses the `Azure.Identity` library and `DefaultAzureCredential` to connect to Azure resources.

Which two actions should you perform to implement this configuration?

You are configuring a deployment to Azure Container Instances (ACI). The container must pull its image from a private Azure Container Registry (ACR) and retrieve its database connection strings from Azure Key Vault during startup. You need to configure the authentication and access policies to ensure secure and successful deployment. Which two configurations are required to meet these requirements? (Choose two.)

An organization is developing a secure reporting system consisting of three components:

1. WebPortal: An Angular Single Page Application (SPA) that allows employees to view their personalized dashboard.
2. ReportAPI: A secured ASP.NET Core Web API (https://api.contoso.com) that retrieves data from a backend database.
3. DataSync: A background daemon service that runs on an on-premises server to upload bulk logs to ReportAPI nightly.

You have the following requirements:
- WebPortal must acquire an access token to call ReportAPI. When a user logs in, ReportAPI must read the user's manager's details from Microsoft Graph on behalf of the signed-in user using the on-behalf-of (OBO) flow.
- DataSync must authenticate using client credentials (client secrets) to POST logs directly to ReportAPI.
- The configuration must follow the principle of least privilege.
- Standard user logins must not be blocked by consent prompts during authentication.

Which configuration correctly implements the permissions, scopes, and token acquisition requests to meet these requirements?

You are developing a C# ASP.NET Core web application deployed to Azure App Service. The application is deployed as two regional instances: app-us-east and app-us-west. Both instances must retrieve shared secrets from a central Azure Key Vault named kv-shared. Additionally, app-us-east must write data to a regional Azure Storage account named sa-east-logs, while app-us-west must write data to sa-west-logs. To configure the managed identities, you perform the following steps:

1. Create a single user-assigned managed identity named uami-shared and assign it to both App Services, granting it Get and List secrets permissions on kv-shared.
2. Enable a system-assigned managed identity on both app-us-east and app-us-west, and grant each regional identity Contributor access to its corresponding regional storage account (sa-east-logs or sa-west-logs).

In your C# code, you instantiate the SDK clients as follows:

csharp
// Accessing the shared Key Vault
var kvClient = new SecretClient(
new Uri("https://kv-shared.vault.azure.net/"),
new DefaultAzureCredential()
);

// Accessing the regional storage account
var blobClient = new BlobServiceClient(
new Uri("https://sa-east-logs.blob.core.windows.net/"),
new DefaultAzureCredential()
);

What is the authentication outcome when the app-us-east instance attempts to run this code and connect to both services?

An organization is developing a stateless API service and a separate background processing worker, both interacting with an Azure Cosmos DB API for NoSQL account. The Cosmos DB account is configured with the default Session consistency and is replicated across East US (write region) and West US (read replica). The API service in East US updates a customer's order status document and receives a write confirmation. Immediately after, the background worker in West US needs to read the updated order document to process a notification. Which action must you perform to guarantee that the background worker reads the updated order status?

You are analyzing application performance issues in Azure Application Insights. You need to write a Kusto Query Language (KQL) query to retrieve the timestamp, name, and duration for all requests that took longer than 2 seconds (2000 milliseconds). How should you complete the KQL query?

You are developing a web application hosted on an Azure App Service. The application must retrieve database connection strings securely from an Azure Key Vault using a system-assigned managed identity.

Which three actions should you perform in sequence to configure this security access? To answer, drag the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

You are developing a Single Page Application (SPA) using React that allows employees to view their own profile information from Microsoft Graph after signing in. Which permission type must you configure in the Microsoft Entra ID application registration to ensure that the application accesses the API on behalf of the signed-in user?

You are developing a .NET application using the Azure.Storage.Blobs SDK. You need to copy a blob from a source URI to a destination container using the following code:

csharp
// destinationClient is a BlobClient pointing to the target blob path
// sourceUri is the Uri of the source blob
await destinationClient._______(sourceUri);

Which method should you use to fill the blank to initiate the copy operation asynchronously?

You are developing a multi-tenant daemon application that will run on-premises and read calendar data from multiple customer organizations using Microsoft Graph. The application does not have a user interface and must run without user interaction.

You need to register the application, establish consent in a customer's tenant, and acquire an access token to access their data.

In which order should you perform the steps? To answer, move all actions from the list of actions to the answer area and arrange them in the correct order.

You are developing a background daemon application that runs on an on-premises Windows server. The application must run unattended to process files and upload them to an Azure Blob Storage container. You need to configure authentication and authorization for the application, ensuring that it uses Microsoft Entra ID and adheres to the principle of least privilege.

Which of the following authentication and authorization configurations should you implement?