All practice questions

You are deploying a web application to Azure App Service. The application must retrieve a database connection string stored in Azure Key Vault named keyvault1. You need to configure an application setting named ConnectionString using a Key Vault reference that points to a secret named dbsecret. Which of the following represents the correct format to use as the value of the application setting?

You are configuring a Standard test in Azure Application Insights to monitor a public HTTP API endpoint. The endpoint requires a custom HTTP header named `X-Auth-Token` containing a static API key to authenticate requests, and it expects an HTTP POST request. You want to ensure the test runs from multiple geographic locations and alerts you if the endpoint becomes unavailable or returns an error status code.

Which of the following statements correctly describes a configuration capability or limitation when setting up this availability test?

You are developing a C# ASP.NET Core web application that will be hosted on an Azure App Service. The application must securely query data from an Azure SQL Database. You decide to use a user-assigned managed identity to authenticate the App Service to the database to ensure that database credentials are not hardcoded. Which sequence of steps should you perform to provision the identity, associate it with the App Service, and configure the database access permissions?

You are developing a background utility service that runs on an on-premises Windows server. The service must periodically retrieve diagnostic data from a secure custom web API protected by Microsoft Entra ID. You register the utility as an application in your Microsoft Entra ID tenant. The service must authenticate programmatically without user interaction using a certificate. Which two configuration steps should you perform? (Choose two.)

You are developing a C# console application using the Azure.Storage.Blobs SDK (v12). The application needs to update a blob named report.pdf. To prevent other processes from modifying the blob during the update, you must acquire a 30-second lease on the blob, upload the new content from a stream named contentStream, and then release the lease.

Which two code segments should you use to perform these operations? (Select two.)

You are developing a script to migrate application logs between two Azure Storage accounts. You need to copy all blobs from a source container named `logs-prod` in a storage account named `srcstorage` to a destination container named `logs-archive` in a storage account named `deststorage`.

You decide to use the Azure CLI for this task and generate a Shared Access Signature (SAS) token for the source container. You execute the following command:

bash
az storage blob copy start-batch \
--destination-container logs-archive \
--account-name deststorage \
--account-key <dest-account-key> \
--source-container logs-prod \
--source-account-name srcstorage \
--source-sas "?sv=2025-01-05&sr=c&sp=r&se=2026-08-01T00:00:00Z&sig=..."

The command fails with an authorization error (`AuthorizationPermissionMismatch`) and no blobs are copied.

Which modification to the source SAS token configuration will resolve the error?

You need to use the Azure CLI to create a new Azure Key Vault, store a database connection string as a secret, and then retrieve that secret. What is the correct sequence of Azure CLI commands to achieve this?

You are configuring permissions and consent in Microsoft Entra ID for an enterprise scheduling solution consisting of two applications:

1. SyncDaemon: A background service (daemon) that runs continuously without user interaction to synchronize user profile information from Microsoft Graph.
2. PlannerSPA: A client-side Single Page Application (SPA) that allows authenticated users to access a custom backend Web API named `TaskAPI` to manage their tasks. The backend API is registered with the App ID URI `api://taskapi.contoso.com`.

Which two of the following configuration actions must you perform to implement the correct permissions and consent flows? (Select two.)

You are developing a custom availability monitoring tool as a scheduled console application that runs on an Azure Virtual Machine (VM). The application monitors an internal HTTP service and uses the Azure Application Insights SDK to track availability using the `TrackAvailability()` method.

You write the following C# code to log the test results:

csharp
using Microsoft.ApplicationInsights;
using Microsoft.ApplicationInsights.DataContracts;
using Microsoft.ApplicationInsights.Extensibility;

var configuration = TelemetryConfiguration.CreateDefault();
var telemetryClient = new TelemetryClient(configuration);

var availability = new AvailabilityTelemetry
{
Name = "InternalServiceCheck",
RunLocation = "AzureVM-EastUS",
Success = true
};

telemetryClient.TrackAvailability(availability);
telemetryClient.Flush();

During testing, you notice that availability metrics are not appearing in Application Insights. The connection string for Application Insights is stored in an Azure Key Vault secret.

Which two of the following configuration steps should you perform to resolve this issue and ensure the availability telemetry is securely sent to Application Insights? (Select two)

You are configuring a custom availability monitoring tool that runs as a continuous background process on an internal server. The tool executes health checks and uses the Azure Application Insights SDK to report results. You use the following class to send telemetry:

csharp
using Microsoft.ApplicationInsights;
using Microsoft.ApplicationInsights.DataContracts;

public class HealthReporter
{
private static TelemetryClient telemetryClient = new TelemetryClient();

public static void SendResult(bool success)
{
var availability = new AvailabilityTelemetry
{
Name = "InternalApiTest",
Success = success,
RunLocation = "CorporateNetwork"
};
telemetryClient.TrackAvailability(availability);
}
}

Although the background process runs continuously and calls the `SendResult` method, no availability data appears in the Azure Portal, and no exceptions are logged locally.

Which of the following is the most likely cause of this issue?

You are deploying an Azure App Service web app that must retrieve a database connection string from an Azure Key Vault using a user-assigned managed identity for compliance reasons. The Key Vault uses Azure Role-Based Access Control (RBAC) for authorization.

The user-assigned managed identity has been assigned the 'Key Vault Secrets User' role on the Key Vault. You use the following Bicep template snippet to deploy the web app:

bicep
resource webApp 'Microsoft.Web/sites@2022-03-01' = {
name: webAppName
location: location
identity: {
type: 'UserAssigned'
userAssignedIdentities: {
'${userAssignedIdentityId}': {}
}
}
properties: {
siteConfig: {
appSettings: [
{
name: 'ConnectionStrings__Default'
value: '@Microsoft.KeyVault(SecretUri=https://kv-prod-01.vault.azure.net/secrets/DbConn)'
}
]
}
}
}

During deployment validation, the application fails to start, and the logs indicate that the application setting `ConnectionStrings__Default` cannot resolve the Key Vault reference.

Which configuration change must you apply to the Bicep template to ensure the web app can resolve the connection string?

You are authoring a Bicep template to deploy an Azure App Service web app that requires access to a shared Azure Key Vault. The web app must use a user-assigned managed identity named `app-identity` that is defined in the same template.

You declare the user-assigned managed identity resource as follows:

bicep
resource appIdentity 'Microsoft.ManagedIdentity/userAssignedIdentities@2023-01-31' = {
name: 'app-identity'
location: location
}

You need to define the `identity` property of the App Service web app resource to assign this managed identity.

Which Bicep block should you include in the App Service resource definition?

You are developing a C# console application that retrieves a specific product configuration document from an Azure Cosmos DB container by using the .NET SDK v3. You need to write the code that performs a point read of the item. Which sequence of actions should you perform to complete this operation? To answer, arrange the actions in the correct order.

An Azure App Service web app uses a system-assigned managed identity to load configuration from an Azure App Configuration store. The App Configuration store contains a Key Vault reference that points to a secret stored in Azure Key Vault. While the web app successfully retrieves standard key-value settings, it fails to resolve the Key Vault reference at runtime. Which configuration change is required to allow the web app to resolve the Key Vault reference?

You are writing a C# console application using the Azure.Storage.Blobs SDK (version 12.x) to migrate archive data from a source Azure Storage account to a destination storage account. The source container is private, and you want to perform the transfer asynchronously while monitoring the process. Arrange the following steps in the correct sequence to copy the blob and determine when the operation finishes.

You are deploying an Azure App Service web application that needs to retrieve a database connection string from an Azure Key Vault named my-keyvault. The connection string is stored as a secret named db-conn-string. You decide to use a Key Vault reference in the App Service application settings to retrieve the secret. Which of the following values represents the correct syntax format to reference this secret?

You are developing a Python background utility to safely update a shared configuration file stored in Azure Blob Storage. The application uses the azure-storage-blob SDK (v12).

To prevent concurrent writes, the application first acquires a lease on the blob using the following code:

python
from azure.storage.blob import BlobServiceClient, BlobLeaseClient

connection_string = "UseDevelopmentStorage=true"
blob_service_client = BlobServiceClient.from_connection_string(connection_string)
blob_client = blob_service_client.get_blob_client(container="configs", blob="appsettings.json")

# Acquire a 30-second lease on the blob
lease_client = BlobLeaseClient(blob_client)
lease_client.acquire(lease_duration=30)

# Modify the configuration data
updated_config_data = b'{"status": "ready", "version": "2.0"}'

Which of the following code statements must you use to upload the updated configuration to the leased blob?

An organization is deploying a multi-tenant web application named App1 to Azure App Service. App1 needs to authenticate users from any Microsoft Entra ID tenant but must restrict access to corporate (work or school) accounts only, preventing personal Microsoft accounts from signing in. You are configuring the application registration manifest and the authentication authority endpoint in the application code.

Which of the following configurations should you apply to satisfy these requirements?

A developer uploads a blob to Azure Blob Storage and configures its metadata using the Azure.Storage.Blobs SDK (v12) for C# with the following code:

csharp
var metadata = new Dictionary<string, string>
{
{ "Department", "Finance" }
};
await blobClient.SetMetadataAsync(metadata);

Later, the developer retrieves the properties of the blob using the following code:

csharp
BlobProperties properties = await blobClient.GetPropertiesAsync();

Which code segment should the developer use to successfully retrieve the metadata value "Finance"?

You manage an Azure App Service Web App named RetailCartService that is currently hosted on a Free (F1) App Service plan. You need to implement and test CPU-based autoscaling for the application. You must ensure the application scales out to multiple instances under high load and scales back in when load decreases.

Which of the following represents the correct sequence of steps to configure and verify this autoscale behavior?