All practice questions
972 questions
An organization is implementing a multi-tier solution where a mobile client calls a secure Web API. The Web API must call Microsoft Graph to access the user's files. The security policy dictates that the Web API must execute this request using the identity of the signed-in user, rather than using the API's own application identity. The Web API must authenticate to Microsoft Entra ID using a client certificate. You are writing the MSAL.NET code within the Web API to acquire the required token.
Which two code actions must you perform to implement this authentication flow? (Select two.)
Select all that apply
An organization registry application built in Microsoft Entra ID needs to support authentication for business users from external directories. The registration must allow log-in capabilities exclusively for corporate credentials across any Microsoft Entra ID tenant, preventing personal email accounts (such as Hotmail or Outlook.com) from authenticating. To implement this restriction, which setting should be selected for the application registration's sign-in audience in the manifest?
You are developing a Python application that uses the `azure-storage-blob` (v12) SDK. The application must retrieve custom metadata from a blob named `financial_summary.xlsx` in a container named `archive`. The blob was previously uploaded with a custom metadata key-value pair of `Department: Finance`.
You write the following code:
python
from azure.storage.blob import BlobServiceClient
connection_string = "your_connection_string"
blob_service_client = BlobServiceClient.from_connection_string(connection_string)
blob_client = blob_service_client.get_blob_client(container="archive", blob="financial_summary.xlsx")
# Retrieve properties
properties = blob_client.get_blob_properties()
Which two of the following Python expressions will successfully retrieve the value of the department metadata ("Finance") from the `properties` object? (Choose two.)
Select all that apply
You are developing a web application that retrieves reports from Azure Blob Storage. You need to generate a Service Shared Access Signature (SAS) token to allow an external partner to download a specific report file. To meet security guidelines, you must restrict access to a specific client IP address and enforce the use of HTTPS. Which two configurations must you define in the SAS token to meet these requirements? (Select TWO.)
Select all that apply
You are developing a multi-tenant web application that must allow users from any Microsoft Entra ID tenant to sign in using their work or school accounts. Personal Microsoft accounts (such as outlook.com or xbox.com) must be prevented from signing in. Which two configurations must you implement to meet these requirements? (Select TWO)
Select all that apply
You are developing a C# (.NET Isolated process) Durable Function orchestrator named BillingReminderOrchestrator to implement a customer billing dunning process. If a credit card payment fails, the orchestrator must pause execution and wait exactly three days before invoking an activity function to retry the payment. Which code snippet should you use inside the orchestrator to implement this delay?
You are implementing a secure file-sharing module in a Python application using the `azure-storage-blob` (v12) SDK. A client application needs temporary, read-only access to a specific report blob named `q4_report.pdf` located in a container named `reports`. To adhere to the principle of least privilege, you must generate a Shared Access Signature (SAS) token that restricts access to only this single blob, allowing only read operations, and expiring in one hour. Which code segment should you use to generate the SAS token?
from azure.storage.blob import generate_blob_sas, BlobSasPermissions
sas_token = generate_blob_sas(
account_name="mystorage",
container_name="reports",
blob_name="q4_report.pdf",
account_key="mykey",
permission=BlobSasPermissions(read=True),
expiry=datetime.utcnow() + timedelta(hours=1)
)
from azure.storage.blob import generate_container_sas, ContainerSasPermissions
sas_token = generate_container_sas(
account_name="mystorage",
container_name="reports",
account_key="mykey",
permission=ContainerSasPermissions(read=True),
expiry=datetime.utcnow() + timedelta(hours=1)
)
from azure.storage.blob import generate_blob_sas, BlobSasPermissions
sas_token = generate_blob_sas(
account_name="mystorage",
container_name="reports",
blob_name="q4_report.pdf",
account_key="mykey",
permission=BlobSasPermissions(read=True, write=True, delete=True),
expiry=datetime.utcnow() + timedelta(hours=1)
)
from azure.storage.blob import generate_account_sas, AccountSasPermissions, ResourceTypes
sas_token = generate_account_sas(
account_name="mystorage",
account_key="mykey",
resource_types=ResourceTypes(object=True),
permission=AccountSasPermissions(read=True),
expiry=datetime.utcnow() + timedelta(hours=1)
)
An organization has deployed a web API to Azure API Management (APIM). The API must be secured so that it only accepts requests from client applications that present a valid JSON Web Token (JWT) issued by Microsoft Entra ID. The token must contain an audience (aud) claim of api://backend-api and a scope (scp) claim of API.Read. Invalid requests must be rejected immediately with a 401 HTTP status code before reaching the backend service.
Which policy configuration should you apply?
<base />
<validate-jwt header-name="Authorization" failed-validation-httpcode="401" require-scheme="Bearer">
<issuer-signing-keys>
<key>{{keyvault-signing-key}}</key>
</issuer-signing-keys>
<audiences>
<audience>api://backend-api</audience>
</audiences>
<required-claims>
<claim name="scp" match="any">
<value>API.Read</value>
</claim>
</required-claims>
</validate-jwt>
</inbound>
<base />
<validate-jwt header-name="Authorization" failed-validation-httpcode="401" require-scheme="Bearer">
<openid-config url="https://login.microsoftonline.com/common/v2.0/.well-known/openid-configuration" />
<audiences>
<audience>api://backend-api</audience>
</audiences>
<required-claims>
<claim name="scp" match="any">
<value>API.Read</value>
</claim>
</required-claims>
</validate-jwt>
</outbound>
<base />
<validate-jwt header-name="Authorization" failed-validation-httpcode="401" require-scheme="Bearer">
<openid-config url="https://login.microsoftonline.com/common/v2.0/.well-known/openid-configuration" />
<audiences>
<audience>api://backend-api</audience>
</audiences>
<required-claims>
<claim name="scp" match="any">
<value>API.Read</value>
</claim>
</required-claims>
</validate-jwt>
</inbound>
<base />
<authentication-managed-identity resource="api://backend-api" />
</inbound>
You are deploying a Java-based web application to Azure App Service. The application is integrated with Application Insights for monitoring. During testing, you want to use Application Insights Profiler to identify code-level bottlenecks and analyze performance hot paths. The application is currently running on an App Service plan configured with the Free (F1) pricing tier, and it retrieves its telemetry settings from Azure Key Vault using a managed identity. Which of the following actions must you take to enable the Application Insights Profiler?
You are developing a batch telemetry processing service in C# that consumes messages from an Azure Queue Storage queue named telemetry-ingest. The service must retrieve up to 32 messages at a time and prevent other instances from processing these messages for 5 minutes while they are being processed. Once a message is successfully processed, it must be permanently removed from the queue. Complete the C# code snippet by filling in the blanks with the correct Azure Storage Queues SDK for .NET method names.
Fill in the blanks below
using System.Threading.Tasks;
using Azure.Storage.Queues;
using Azure.Storage.Queues.Models;
public async Task ProcessTelemetryBatchAsync(QueueClient queueClient)
{
var response = await queueClient.(
maxMessages: 32,
visibilityTimeout: TimeSpan.FromMinutes(5)
);
foreach (var message in response.Value)
{
try
{
ProcessTelemetry(message.Body.ToString());
await queueClient.(message.MessageId, message.PopReceipt);
}
catch (Exception ex)
{
// Log error
}
}
}
You manage a web application named LogiRoute that runs on a Standard (S2) App Service plan. The plan currently has 2 instances. You configure an autoscale scale-out rule to increase the instance count by 1 when the average CPU percentage exceeds . During a peak period, the average CPU utilization across the 2 instances reaches , triggering a scale-out event. You need to configure a scale-in rule to decrease the instance count by 1 when the load decreases, ensuring that the scale-in action does not immediately trigger another scale-out (preventing autoscale flapping). Assuming the total workload remains constant immediately after scaling, what is the maximum CPU percentage threshold you should set for the scale-in rule?
A multi-tenant SaaS application stores tenant-specific documents in a single Azure Cosmos DB container using the .NET SDK v3. The container is configured with a partition key path of `/TenantId`, and the database account uses the default Session consistency level. Separate instances of the client application run on different virtual machines, each initializing its own `CosmosClient` instance.
You need to ensure that reads and writes performed by separate client instances achieve read-your-writes consistency while maintaining optimal write/read partition distribution and meeting SDK design standards.
Which of the following actions should you perform to implement this correctly? (Select TWO)
Select all that apply
You are developing an Azure-hosted application that processes large batch PDF generation requests. Each request contains user preferences and a raw list of data records to include. The size of the request payload ranges from 10 KB to 500 KB. You plan to use Azure Queue Storage to process these requests asynchronously using a background worker. You need to design the solution to handle the request payloads while minimizing costs and ensuring reliability. Which approach should you implement to handle the request payloads?
You are developing an Azure App Service web app that needs to retrieve a database connection string stored as a secret in Azure Key Vault. You want to authenticate the web app using a system-assigned managed identity.
Which two actions should you perform to configure the required access? (Select two.)
Select all that apply
You are developing a multi-tenant web application named App1 that will be registered in Microsoft Entra ID under Tenant A. Users from other Microsoft Entra ID tenants, such as Tenant B, must be able to sign in to App1 and grant the application permissions to read their profile data.
You need to understand how the identity objects are represented in the directory structure when a user from Tenant B consents to App1.
Which of the following describes the resource creation behavior in Tenant B?
An engineer is designing a background daemon service that synchronizes directory metadata across several external corporate Microsoft Entra ID tenants using the Microsoft Graph API. The service must operate with application-only permissions (`User.Read.All`), prevent consumer accounts (such as Outlook.com) from registering, and allow external tenant administrators to grant consent and run the sync process without user interaction.
Which configuration combination must be used to meet these requirements?
You are developing a secure Web App named InventoryManager that runs on Azure App Service. The application must perform two main tasks:
1. Allow signed-in users to view their own profile details and manage their calendar events in Microsoft 365.
2. Run a scheduled background job every night to retrieve a list of all office groups in the tenant to update local access lists. This background job runs without a signed-in user.
You need to configure the app registration in Microsoft Entra ID.
Which of the following configurations must you apply to meet these requirements while adhering to the principle of least privilege? (Select TWO)
Select all that apply
You are developing a telemetry processing workflow using Azure Durable Functions in Node.js. The orchestrator function must process incoming data, wait for 5 minutes, and then run an aggregation activity. You write the following orchestrator function code:
javascript
const df = require("durable-functions");
module.exports = df.orchestrator(function* (context) {
const input = context.df.getInput();
// Generate a unique identifier for the execution run
const runId = context.df.newGuid();
// Get the current date and time
const timestamp = new Date();
// Perform processing by calling an activity function
const processedData = yield context.df.callActivity("ProcessSensorData", input);
// Delay execution for 5 minutes
yield context.df.createTimer(new Date(Date.now() + 5 * 60 * 1000));
// Run the aggregation activity
yield context.df.callActivity("AggregateSensorData", { runId, timestamp, processedData });
});
During testing, you notice that the orchestrator behaves non-deterministically. Which two changes should you make to ensure the orchestrator complies with Durable Functions determinism constraints? Select two.
Select all that apply
An application named PromoCampaignPortal is currently hosted on a Basic () App Service plan. During marketing campaigns, the application experiences significant memory spikes. You want to implement autoscaling to automatically handle this demand, while ensuring that the scaling behavior remains stable and does not cause rapid, repeated scaling actions (flapping).
Which two of the following actions must you perform to meet these requirements?
Select all that apply
You are developing a workflow to process monthly customer billing reports using Azure Durable Functions in a C# (.NET Isolated process) environment. You need to write an HTTP-triggered function that starts a new instance of the orchestrator function named BillingReportOrchestrator and returns a standard HTTP 202 response containing the status check URI. Which code segment should you use?
public static async Task<HttpResponseData> Run(
[HttpTrigger(AuthorizationLevel.Function, "post")] HttpRequestData req,
[DurableClient] DurableTaskClient client)
{
string instanceId = await client.ScheduleNewOrchestratorInstanceAsync("BillingReportOrchestrator");
return client.CreateCheckStatusResponse(req, instanceId);
}
public static async Task<HttpResponseMessage> Run(
[HttpTrigger(AuthorizationLevel.Function, "post")] HttpRequestMessage req,
[DurableClient] IDurableOrchestrationClient client)
{
string instanceId = await client.StartNewAsync("BillingReportOrchestrator");
return client.CreateCheckStatusResponse(req, instanceId);
}
public static async Task<HttpResponseData> Run(
[HttpTrigger(AuthorizationLevel.Function, "post")] HttpRequestData req,
[DurableClient] DurableTaskClient client)
{
string instanceId = await client.StartNewAsync("BillingReportOrchestrator");
return client.CreateCheckStatusResponse(req, instanceId);
}
public static async Task<HttpResponseData> Run(
[HttpTrigger(AuthorizationLevel.Function, "post")] HttpRequestData req,
[OrchestrationClient] DurableTaskClient client)
{
string instanceId = await client.ScheduleNewOrchestratorInstanceAsync("BillingReportOrchestrator");
return client.CreateCheckStatusResponse(req, instanceId);
}