All practice questions
972 questions
You are configuring policies in Azure API Management (APIM) to expose an internal backend REST service hosted on Azure App Service. The backend service requires Microsoft Entra ID authentication and expects a token with the audience https://api.contoso.com.
The API gateway must satisfy the following requirements:
1. Authenticate to the backend App Service using the APIM instance's system-assigned managed identity.
2. Limit the incoming request rate to no more than 100 calls per 60 seconds per individual client IP address to prevent denial-of-service attempts.
Which of the following policy configurations correctly meets these requirements?
<inbound>
<base />
<rate-limit-by-key calls="100" renewal-period="60" counter-key="@(context.Request.IpAddress)" />
<authentication-managed-identity resource="https://api.contoso.com" />
</inbound>
<backend>
<base />
</backend>
<outbound>
<base />
</outbound>
<on-error>
<base />
</on-error>
</policies>
<inbound>
<base />
<rate-limit calls="100" renewal-period="60" />
<authentication-managed-identity resource="https://api.contoso.com" client-id="3f2504e0-4f89-11d3-9a0c-0305e82c3301" />
</inbound>
<backend>
<base />
</backend>
<outbound>
<base />
</outbound>
<on-error>
<base />
</on-error>
</policies>
<inbound>
<base />
<rate-limit-by-key calls="100" renewal-period="60" counter-key="@(context.Request.IpAddress)" />
</inbound>
<backend>
<base />
</backend>
<outbound>
<base />
<authentication-managed-identity resource="https://api.contoso.com" />
</outbound>
<on-error>
<base />
</on-error>
</policies>
<inbound>
<base />
<authentication-managed-identity resource="https://api.contoso.com" />
</inbound>
<backend>
<base />
</backend>
<outbound>
<base />
<rate-limit-by-key calls="100" renewal-period="60" counter-key="@(context.Request.IpAddress)" />
</outbound>
<on-error>
<base />
</on-error>
</policies>
An organization is designing several applications that will use Azure Cosmos DB API for NoSQL. You must select the appropriate default consistency level for each application based on its specific requirements.
Match each application requirement on the left to its optimal Azure Cosmos DB consistency level on the right.
Click a left item, then click its matching right item
Items
Matches
You are developing a C# backend service for a smart home energy monitoring application that stores device configurations in Azure Cosmos DB using the NoSQL API. You need to implement Optimistic Concurrency Control (OCC) using the Azure Cosmos DB .NET SDK v3 to ensure that updates to a device configuration are not overwritten by concurrent processes.
Which sequence of actions should you perform to complete the update?
Drag items to arrange them in the correct order
An enterprise inventory application uses Azure Service Bus to coordinate message routing. A developer is implementing a transaction-based message processing flow in C# using the Azure.Messaging.ServiceBus SDK. The application must receive a message from an input queue named orders-input, send a related message to an output queue named orders-output (within the same namespace), and then complete the original message. The entire sequence must occur inside a single atomic transaction.
The developer writes the following implementation:
csharp
using System.Transactions;
using Azure.Messaging.ServiceBus;
// ... client initialization ...
var options = new ServiceBusReceiverOptions
{
ReceiveMode = // [Configuration here]
};
ServiceBusReceiver receiver = client.CreateReceiver("orders-input", options);
ServiceBusSender sender = client.CreateSender("orders-output");
using (var ts = new TransactionScope(TransactionScopeAsyncFlowOption.Enabled))
{
ServiceBusReceivedMessage message = await receiver.ReceiveMessageAsync();
// processing logic...
var response = new ServiceBusMessage("Order Processed");
await sender.SendMessageAsync(response);
await receiver.CompleteMessageAsync(message);
ts.Complete();
}
Which of the following configurations is required to ensure that if the send or complete operation fails, the transaction rolls back and the original message remains in the input queue?
You are developing a command-line interface (CLI) application that will run on Linux servers without a graphical user interface or local web browser. The application must authenticate individual users against Microsoft Entra ID before executing commands. Which MSAL.NET method should you use to perform the authentication?
You are developing a V4 Azure Function App. A function within the app is triggered by messages from an Azure Queue Storage queue named incoming-orders. The function is configured with a connection property value of OrderStorageConnection.
You want to configure the Function App to use its system-assigned managed identity to connect to the queue in a storage account named orderstore instead of using a connection string.
Which application setting should you add to the Function App?
An organization is setting up a secure containerized API in Azure Container Apps. The container image is stored in a private Azure Container Registry (ACR). When deploying the Container App for the first time using a Bicep template, the deployment fails during the container creation phase because the registry authentication is not established. You need to configure the Bicep template to successfully authenticate to the private registry during this initial deployment using a managed identity. Which configuration strategy should you implement to ensure the initial deployment succeeds?
You manage a .NET web application that is hosted on Azure App Service. The application is configured to send telemetry to an Application Insights instance.
You regularly receive email notifications from Application Insights regarding 'Dependency Latency Degradation' anomalies. You verify that these latency spikes are expected because they occur during a third-party database's scheduled daily maintenance window. You want to stop receiving these specific proactive email notifications without stopping the collection of dependency response time telemetry or affecting other anomaly detection rules.
Which action should you perform to meet this requirement?
You manage an inventory synchronization service named InventoryProcessor that runs on an Azure App Service Web App. The web app currently uses a Basic (B1) App Service plan.
The application experiences intermittent CPU spikes during inventory updates. You must configure the application to automatically scale out when CPU utilization exceeds , and scale in when CPU utilization drops. You must also ensure that the autoscale configuration does not cause rapid, repeated scale-out and scale-in actions (flapping).
Which two actions should you perform to meet these requirements?
Select all that apply
You are developing a microservice using the Azure Cosmos DB .NET SDK v3. You need to configure a Change Feed Processor to process document updates from a monitored container and coordinate state using a lease container. Which sequence of steps must you perform to initialize and run the Change Feed Processor?
Drag items to arrange them in the correct order
An organization is deploying a set of APIs as .NET-based Azure Functions. They want to implement both Application Insights Profiler to identify performance bottlenecks and Snapshot Debugger to analyze unhandled exceptions in production. Which of the following requirements must be met to ensure that both services are supported and that developers can inspect the diagnostic data? (Select TWO).
Select all that apply
An organization is designing a V4 Azure Function App to process large datasets. The functions have the following requirements:
* Individual function executions can take up to minutes to complete.
* The functions must connect securely to an Azure SQL Database using a private endpoint within an Azure Virtual Network (VNet).
* The hosting configuration must support scale-out to handle high-demand periods.
Which hosting plans can you use to meet these requirements? (Select all that apply.)
Select all that apply
A developer is deploying a Java-based API using Azure Functions. The API occasionally experiences intermittent latency spikes during high-load periods. The developer wants to capture detailed CPU and memory allocation profiles using Application Insights Profiler to identify the hot code paths. Currently, the Function App is hosted on a Consumption plan. Which of the following actions must the developer perform first to enable the Profiler?
You need to secure the connection between an Azure API Management (APIM) instance and a backend API hosted on Azure App Service. The backend API requires Azure Active Directory (Azure AD) authentication. You want to use a user-assigned managed identity named apim-backend-identity to authenticate the APIM instance against the backend API. Which of the following configuration steps should you perform? Select two.
Select all that apply
You are developing a C# background service that processes flight ticket booking transactions from an Azure Service Bus queue. Each booking transaction involves multiple external API calls to airlines and payment gateways, which takes up to 90 seconds to complete under peak load. If the service crashes or loses connectivity while processing a booking, the transaction message must not be lost and must be made available for reprocessing by another service instance. You need to configure the `ServiceBusProcessor` using the C# Azure SDK (`Azure.Messaging.ServiceBus`). Which configuration settings must you apply to meet these requirements?
A developer is writing a .NET background worker using the `Azure.Storage.Blobs` SDK (version 12) to process medical images. During the image upload process, a custom metadata key named `PatientID` was successfully set on each blob. The developer writes the following C# code to retrieve this metadata value:
csharp
BlobClient blobClient = blobContainerClient.GetBlobClient("image1.jpg");
BlobProperties properties = await blobClient.GetPropertiesAsync();
string patientId = properties.Metadata["PatientID"];
At runtime, this code throws a `KeyNotFoundException` when attempting to read the dictionary value, even though the metadata exists on the blob.
Which of the following describes the root cause of this exception and the correct resolution?
You are configuring security for an API hosted on an Azure API Management (APIM) gateway. The business requirement states that all incoming client requests must be authenticated using client certificates (mutual TLS). The allowed certificate thumbprints must be stored securely in an Azure Key Vault rather than hardcoded in the policy. The APIM instance has a system-assigned managed identity enabled.
Which two of the following configuration steps must you perform to meet these requirements?
Select all that apply
Your company is developing a custom availability monitoring solution for an internal microservice that is not accessible from the public internet. You create an Azure Function App with a Timer trigger configured to run every 5 minutes. The function must execute a health check against the microservice and send the availability results to Application Insights so that they appear in the Availability dashboard.
You need to implement the monitoring solution.
Which two actions should you perform? Select two.
Select all that apply
You are developing a secure background daemon application in C# that runs as an on-premises scheduled task. The application must periodically retrieve records from a secured downstream Azure Web API. The organization's security policy strictly prohibits the use of client secrets (passwords) for authentication. Instead, you must authenticate using a client certificate. You have already registered the daemon application in Microsoft Entra ID.
Which two of the following actions must you perform to configure the application registration and implement the authentication flow using MSAL.NET? (Select two.)
Select all that apply
You are designing a telemetry archival pipeline in C# using the `Azure.Storage.Blobs` SDK. The pipeline processes log files that have an active write lease. You need to transition a specific block blob named `logs_2026.csv` to the Cool access tier and update its custom metadata with a tag of `Status` set to `Archived`. The active lease must not be broken or released during these operations. Which code snippet should you use to successfully update the access tier and metadata of the leased blob?
string leaseId = "d5b9f935-862a-436f-87be-23e5124dbf4d";
var metadata = new Dictionary<string, string>
{
{ "Status", "Archived" },
{ "x-ms-lease-id", leaseId }
};
await blobClient.SetAccessTierAsync(AccessTier.Cool);
await blobClient.SetMetadataAsync(metadata);
string leaseId = "d5b9f935-862a-436f-87be-23e5124dbf4d";
var metadata = new Dictionary<string, string> { { "x-ms-meta-Status", "Archived" } };
await blobClient.SetAccessTierAsync(AccessTier.Cool, leaseId: leaseId);
var conditions = new BlobRequestConditions { LeaseId = leaseId };
await blobClient.SetMetadataAsync(metadata, conditions);
string leaseId = "d5b9f935-862a-436f-87be-23e5124dbf4d";
var metadata = new Dictionary<string, string> { { "Status", "Archived" } };
await blobClient.SetAccessTierAsync(AccessTier.Cool, leaseId: leaseId);
var conditions = new BlobRequestConditions { LeaseId = leaseId };
await blobClient.SetMetadataAsync(metadata, conditions);
string sasToken = GetOverPermissionedSasToken(blobClient);
BlobClient sasBlobClient = new BlobClient(blobClient.Uri, new AzureSasCredential(sasToken));
await sasBlobClient.SetAccessTierAsync(AccessTier.Cool);
await sasBlobClient.SetMetadataAsync(new Dictionary<string, string> { { "Status", "Archived" } });