All practice questions
972 questions
You are deploying a microservice named `order-service` to Azure Container Apps. The container image for the microservice is stored in a private Azure Container Registry (ACR) named `myregistry.azurecr.io`.
To ensure secure image retrieval, you must configure the Container App to pull the image using a user-assigned managed identity named `app-pull-identity`. The identity has already been granted the `AcrPull` role on the registry.
Which Bicep configuration block must you use to satisfy this requirement?
type: 'UserAssigned'
userAssignedIdentities: {
'/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/my-rg/providers/Microsoft.ManagedIdentity/userAssignedIdentities/app-pull-identity': {}
}
}
properties: {
configuration: {
registries: [
{
server: 'myregistry.azurecr.io'
identity: '/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/my-rg/providers/Microsoft.ManagedIdentity/userAssignedIdentities/app-pull-identity'
}
]
}
}
type: 'UserAssigned'
userAssignedIdentities: {
'/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/my-rg/providers/Microsoft.ManagedIdentity/userAssignedIdentities/app-pull-identity': {}
}
}
properties: {
configuration: {
registries: [
{
server: 'myregistry.azurecr.io'
identity: 'system'
}
]
}
}
type: 'UserAssigned'
userAssignedIdentities: {
'/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/my-rg/providers/Microsoft.ManagedIdentity/userAssignedIdentities/app-pull-identity': {}
}
}
properties: {
configuration: {
registries: [
{
server: 'myregistry.azurecr.io'
identity: 'app-pull-identity'
}
]
}
}
type: 'UserAssigned'
userAssignedIdentities: {
'/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/my-rg/providers/Microsoft.ManagedIdentity/userAssignedIdentities/app-pull-identity': {}
}
}
properties: {
configuration: {
registries: [
{
server: 'myregistry.azurecr.io'
username: 'app-pull-identity'
passwordSecretRef: 'acr-pull-secret'
}
]
}
}
You need to configure a local script to run nightly administrative tasks against Azure resources. The script must run non-interactively and authenticate using certificate-based authentication. Which sequence of steps must you perform to set up the authentication and test the connection?
Drag items to arrange them in the correct order
An organization is deploying three separate Azure Function apps that all retrieve configuration secrets from a shared Azure Key Vault and query data from a shared Azure SQL Database. You need to configure managed identities for the application authentication. The solution must minimize administrative overhead for managing access control and ensure that deleting any individual Function app does not affect the permissions or credentials of the remaining apps. Which two actions should you perform? (Choose two.)
Select all that apply
An enterprise Azure Function app is configured with a system-assigned managed identity. The application must perform envelope encryption on sensitive payloads before uploading them to Azure Blob Storage. A symmetric Data Encryption Key (DEK) is generated locally for each payload. The DEK must be wrapped (encrypted) using an HSM-backed RSA Key Encryption Key (KEK) named PayloadKEK stored in an Azure Key Vault named kv-prod. The Key Vault has Azure Role-Based Access Control (Azure RBAC) enabled as its permission model. You need to implement the solution using the latest Azure SDK for .NET. Which two of the following actions must you perform to configure permissions and wrap the DEK?
Select all that apply
You are deploying a web application to Azure App Service. You want to retrieve a database connection password stored in Azure Key Vault directly through the App Service application settings without modifying the application code.
Which of the following is the correct syntax to use as the value for the application setting to reference a secret named 'db-password' in a Key Vault named 'myvault'?
You are developing an ASP.NET Core web application that will be hosted in an Azure App Service. The application must retrieve configuration settings from an Azure App Configuration store. Several settings in the store are Key Vault references pointing to secrets in Azure Key Vault. You must secure access using a single user-assigned managed identity, adhering to the principle of least privilege.
Which of the following represents the correct sequence of steps to configure the Azure resources and the web application?
Drag items to arrange them in the correct order
An organization has deployed an Azure Container App named feedback-portal. You are tasked with configuring a custom domain named feedback.contoso.com for this Container App and securing it using an Azure Container Apps managed certificate. Which sequence of steps should you perform to complete the configuration?
Drag items to arrange them in the correct order
You are developing a C# application using the Azure.Storage.Blobs SDK (v12). The application needs to perform a concurrency-safe metadata update on an existing blob named config.json. You must acquire a lease, apply the metadata dictionary, and release the lease.
Which sequence of code actions should you perform to complete this operation? Arrange the actions in the correct order.
Drag items to arrange them in the correct order
You are developing a C# .NET console application that must retrieve a connection string stored as a secret in Azure Key Vault. The application will run locally during development and as a containerized app in Azure once deployed. You want to connect to the Key Vault using the modern Azure SDK. Which two components are required to successfully authenticate the client and retrieve the secret? (Select two.)
Select all that apply
You are developing a multi-tenant SaaS application that will be registered in Microsoft Entra ID. The application must allow users from any corporate Microsoft Entra ID tenant to sign in using their work or school accounts. However, users with personal Microsoft accounts (such as Outlook.com or Xbox Live) must be prevented from signing in. Which of the following configuration actions must you perform to meet these requirements? (Select TWO.)
Select all that apply
An organization deploys a web application named `InvoiceProcessorApp` to an Azure App Service. The application is hosted on a Basic () App Service plan. During monthly billing cycles, the application experiences brief but severe CPU utilization spikes, leading to slow response times for users. You need to implement a solution that automatically scales the application out by adding instances when CPU utilization exceeds and scales in when CPU utilization drops.
What should you do first?
You are configuring an Azure Event Grid subscription to route customer events to a third-party HTTP webhook endpoint that you do not control. Because the third-party endpoint cannot be modified to programmatically return the validation code synchronously, you must manually validate the subscription. You create the subscription, and its provisioning state is set to Pending. What must you do to complete the endpoint validation and activate the subscription?
You are investigating a brief spike in application errors that occurred within the last hour. You need to write a Kusto Query Language (KQL) query in Azure Application Insights to retrieve all recorded exceptions from the `exceptions` table. The query must be optimized to run quickly and avoid scanning historical data beyond the necessary timeframe.
Which KQL query should you use?
| where timestamp == ago(1h)
| where timestamp > ago(1h)
| where severityLevel > 3
You are developing a secure multi-tier application where the frontend web app is hosted on-premises and needs to authenticate to a backend API hosted in Azure. You register the frontend application in your Microsoft Entra ID tenant, which automatically creates an application object and a service principal in the tenant. Later, to comply with a security policy, you delete the application registration in the Azure portal. What is the immediate impact of deleting this application registration on the associated service principal in your tenant?
You are developing a client-side application that needs to upload temporary log files to a specific container named 'logs' in an Azure Blob Storage account. You need to generate a Shared Access Signature (SAS) token for the client. The solution must adhere to the principle of least privilege, allow access only from the IP address range 198.51.100.0/24, restrict communication to HTTPS, and expire in 2 hours. Which of the following configurations should you implement?
You are designing a long-running batch data processing workflow using Azure Durable Functions in C# (.NET Isolated). The workflow must retrieve a list of database servers, execute a schema migration process on each database in parallel, wait for all migrations to complete, and then send a status update. The schema migration on each database can take up to 45 minutes, and the total execution of the workflow can take several hours.
You need to select the hosting plan and implement the execution pattern.
Which of the following actions should you perform? (Select two.)
Select all that apply
You are configuring a Standard test in Azure Application Insights to monitor the public-facing endpoint of a secure retail portal (`https://portal.contoso.com`).
The requirements for the availability monitoring are:
- The test must verify that the HTTP status code returned is 200.
- The test must inspect the response body and fail if it does not contain the text `Welcome to Contoso`.
- The test must verify that the server's SSL certificate is valid and trigger a failure if the certificate is within 30 days of expiration.
Which two configuration settings must you specify in the availability test configuration? (Select two.)
Select all that apply
You are developing a C# service that processes patient health telemetry using the Azure Cosmos DB .NET SDK v3. The container's partition key is `/patientId`, and the database is configured with Session consistency.
You need to write code to create a patient profile and their first telemetry entry atomically in a single transaction. Then, a separate background processing service (instantiated as a different CosmosClient) must read the newly created profile with guaranteed read-your-writes consistency.
Which two of the following code segments must you implement to achieve this?
Select all that apply
.CreateItem<PatientProfile>(profile)
.CreateItem<TelemetryLog>(log)
.ExecuteAsync();
ItemRequestOptions options = new ItemRequestOptions { SessionToken = sessionToken };
ItemResponse<PatientProfile> readResponse = await backgroundContainer.ReadItemAsync<PatientProfile>(
profile.Id,
new PartitionKey(patientId),
options
);
.CreateItem<PatientProfile>(profile)
.CreateItem<TelemetryLog>(log)
.ExecuteAsync();
profile.Id,
new PartitionKey(patientId)
);
You are authoring an Azure Resource Manager (ARM) template to deploy an Azure App Service web app that needs to read secrets from an Azure Key Vault. During testing, developers will frequently delete and recreate the App Service web app. You must ensure that redeploying the web app does not require recreating Key Vault access policies or re-granting permissions.
Which configuration should you define in the resources section of the ARM template to enable the managed identity?
A developer is configuring a Shared Access Signature (SAS) token to allow an external application to download diagnostic reports from a specific Azure Blob Storage container. The token must be valid for 24 hours, enforce HTTPS-only access, and restrict operations to downloading blobs. Which two configurations should the developer apply to the SAS token to meet these requirements?
Select all that apply