All practice questions

You are developing a secure C# application using the `Azure.Storage.Blobs` SDK. The application must generate a Shared Access Signature (SAS) token that allows external clients to upload a single PDF file named `confidential.pdf` to a container named `secure-docs` in an Azure Storage account named `corpdata`.

Your application must comply with the following security and operational constraints:
- Authentication: Storage account access keys must not be used, stored, or referenced by the application. You must authenticate using the application's system-assigned managed identity.
- Permissions: The token must grant only write permissions to the specific blob. No read, delete, or list permissions should be granted.
- Protocol: Connections must be restricted to HTTPS only.
- Network Constraints: The token must only be usable from the client's public IP address `$198.51.100.72$`.
- Validity: The token must be valid for exactly `$30$` minutes from generation.
- Reliability: The token must be usable immediately upon receipt by the client, without failing due to potential clock synchronization differences (clock skew) between servers.

Which of the following C# code segments should you use to generate the SAS token?

A developer is implementing a partner integration service that authenticates users across several external enterprise clients using Microsoft Entra ID. The configuration must allow sign-ins from any corporate directory but must explicitly block users signing in with personal Microsoft accounts.

Which combination of the `signInAudience` value in the application manifest and the OAuth 2.0 authorization endpoint must be configured?

A developer needs to host a backend service named `payment-worker` on Azure Container Apps. The container image is stored in a private Azure Container Registry (ACR) named `payreg.azurecr.io`. To secure the deployment, the developer wants to avoid hardcoding registry credentials and instead use a managed identity to authenticate the image pull. The solution must support the initial deployment creation of the Container App. Which identity type must be configured for the container app to authenticate the registry pull, and what is the minimum required Azure role-based access control (RBAC) role that must be assigned to the identity on the ACR?

You are configuring diagnostic logging for a .NET web application hosted on a Windows-based Azure App Service. You need to capture application trace messages directly to the local filesystem of the App Service for immediate, short-term troubleshooting without utilizing external Azure storage resources or external SDK dependencies. Which of the following describes the behavior of enabling Application Logging (Filesystem) in this scenario?

You are configuring an ASP.NET Core web application hosted on an Azure App Service to retrieve data from an Azure SQL Database. The application must authenticate using a user-assigned managed identity. You need to configure the required identity and database access. Which five actions should you perform in sequence? To answer, arrange the actions in the correct order.

An organization needs to allow a partner application to read data from a specific Azure Blob Storage container named `reports`. You must configure a Shared Access Signature (SAS) token that meets the following security requirements:

- Allows read-only (least-privilege) access to the `reports` container only.
- Restricts access to a specific external IP address range: $198.51.100.0/24$.
- Restricts communication to the HTTPS protocol only.
- Begins validity immediately and expires in exactly $2$ hours.
- Uses Microsoft Entra ID credentials to secure and sign the token, avoiding the use of the storage account key.

Which type of Shared Access Signature (SAS) must you generate?

You are setting up monitoring for a .NET web application hosted on Azure App Service. You want to implement Application Insights to proactively alert you to potential performance anomalies using Smart Detection, identify execution hot paths using Profiler, and collect debug state for unhandled exceptions using Snapshot Debugger. However, you notice that the Application Insights dashboard is not receiving any telemetry data from the web application. Which configuration requirement must you complete to enable the application to send telemetry to Application Insights?

You are developing a C# console application that uses the Azure.Storage.Blobs SDK (v12). The application retrieves properties for a blob container that has a custom metadata key named `Owner` set to `DevOps`.

You execute the following code to retrieve the container properties:
csharp
var containerClient = new BlobContainerClient(connectionString, "production-logs");
var properties = await containerClient.GetPropertiesAsync();

You need to extract the value of the `Owner` metadata field both directly from the SDK properties dictionary and from the raw HTTP headers.

Which two code segments should you use?

An organization hosting a containerized API on Azure App Service (webapp-prod) needs to access database connection strings stored in Azure Key Vault (kv-prod). The Key Vault uses the Azure Role-Based Access Control (Azure RBAC) permission model. To comply with security policies, the API must authenticate using a user-assigned managed identity named id-prod instead of a system-assigned identity. Which three actions should you perform to configure the application and Key Vault to retrieve the secrets using the user-assigned managed identity? (Select three.)

A Python-based background worker runs in an Azure Function App named func-worker-prod. The Function App needs to retrieve a database password from an Azure Key Vault named kv-secrets-prod.

You configure a user-assigned managed identity named id-worker-prod for the Function App and grant it the Key Vault Secrets User role on kv-secrets-prod. The DbPassword application setting in the Function App is currently configured as follows:

@KeyVault(SecretUri=https://kv-secrets-prod.vault.azure.net/secrets/db-password)

At runtime, the Python worker reads the DbPassword environment variable as the plain text reference string rather than the actual secret value. Which two configuration updates must you perform to ensure the Key Vault reference resolves correctly?

You are deploying a backend microservice named `inventory-service` to an Azure Container Apps environment. The microservice runs inside a container that listens on port 3000 and needs to integrate with Dapr to enable state management and service-to-service invocation using the application ID `inventory-processor`. You are authoring a Bicep template to deploy the container app. Which two settings must you configure within the `dapr` block under `properties.configuration` to successfully enable Dapr integration and register the microservice?

You are developing an ASP.NET Core Web API that runs in an autoscaling Azure App Service plan. The Web API authenticates users using the Microsoft Identity Platform. It must make downstream calls to Microsoft Graph on behalf of the signed-in user by using the OAuth 2.0 On-Behalf-Of (OBO) flow.

During load testing, you observe that downstream calls experience intermittent latency and fail with HTTP 429 (Too Many Requests) errors from Microsoft Entra ID. You determine that because the App Service scales out to multiple instances, each instance maintains a separate in-memory token cache, resulting in frequent, redundant token exchange requests to Microsoft Entra ID.

You need to resolve the performance issue and prevent rate-limiting while maintaining the signed-in user's context for Microsoft Graph calls.

Which of the following configuration changes should you implement?

You are developing a solution that uses Azure Event Grid to handle custom application events. You need to create a new custom topic, configure a subscription to route events to an Azure Function, and then publish a test event to verify the endpoint routing using an API client.

Which five actions should you perform in sequence? To answer, arrange the actions in the correct order.

You are writing a C# helper method using the `Azure.Storage.Blobs` SDK (v12) to generate a temporary Shared Access Signature (SAS) URL for a specific blob. The SAS URL must meet the following security and technical requirements:
- The SAS token must be signed using Microsoft Entra ID credentials (not storage account access keys).
- The SAS token must remain valid for exactly 2 hours.
- Access to the blob must be restricted to HTTPS only.
- The client must have read-only access (least privilege).
- The code must execute successfully without throwing runtime exceptions from the Azure Storage service.

You write the following C# method:

csharp
public static async Task<Uri> GenerateSecureBlobSasUriAsync(
BlobClient blobClient,
BlobServiceClient blobServiceClient,
string ipAddressRange)
{
// Step 1: Request User Delegation Key
DateTimeOffset keyStart = DateTimeOffset.UtcNow.AddMinutes(-15);
DateTimeOffset keyEnd = DateTimeOffset.UtcNow.AddDays(10);

UserDelegationKey delegationKey = await blobServiceClient.GetUserDelegationKeyAsync(keyStart, keyEnd);

// Step 2: Configure SAS Builder
BlobSasBuilder sasBuilder = new BlobSasBuilder
{
BlobContainerName = blobClient.BlobContainerName,
BlobName = blobClient.Name,
Resource = "b",
StartsOn = DateTimeOffset.UtcNow.AddMinutes(-15),
ExpiresOn = DateTimeOffset.UtcNow.AddHours(2),
Protocol = SasProtocol.HttpsAndHttp
};

sasBuilder.SetPermissions(BlobSasPermissions.Read | BlobSasPermissions.Write);
sasBuilder.IPRange = SasIPRange.Parse(ipAddressRange);

// Step 3: Generate and append SAS token
BlobSasQueryParameters sasParams = sasBuilder.ToSasQueryParameters(delegationKey, blobServiceClient.AccountName);

UriBuilder uriBuilder = new UriBuilder(blobClient.Uri)
{
Query = sasParams.ToString()
};

return uriBuilder.Uri;
}

Which three modifications must you make to the code to ensure it executes successfully and complies with all requirements?

You are configuring permissions in Microsoft Entra ID for a Single Page Application (SPA) named TimeTrackerSPA. The application runs in the user's browser and must perform the following actions:

1. Retrieve the signed-in user's profile details from Microsoft Graph.
2. Read and write time entries using a custom backend Web API named TimeSheetAPI on behalf of the signed-in user.

The TimeSheetAPI application registration exposes a delegated scope named TimeSheet.Write.

Which permissions should you configure for the TimeTrackerSPA application registration?

You are developing a C# application that needs to publish telemetry events to an Azure Event Grid custom topic. You plan to use the Azure SDK for .NET (specifically the Azure.Messaging.EventGrid NuGet package). Which sequence of steps must you perform in your code to publish the events?

You are configuring Application Insights instrumentation for an ASP.NET Core web application that will be hosted on Azure App Service. You want to ensure telemetry data is collected and sent to Azure Monitor. Which two of the following configuration actions are required to achieve this?

An organization deploys a Node.js REST API inside Azure Container Apps (ACA). The container app uses a user-assigned managed identity named `id-api-prod` to authenticate.

The API loads its configuration from an Azure App Configuration instance named `config-payment-prod`. The App Configuration store contains a key named `PaymentGateway:ApiKey` which is configured as a Key Vault reference pointing to a secret named `gateway-api-key` in a Key Vault named `kv-payment-prod`.

The managed identity `id-api-prod` is assigned the App Configuration Data Reader role on the App Configuration store. However, at runtime, the API fails to start because it cannot retrieve the resolved value of the `PaymentGateway:ApiKey` setting, instead receiving an access denied authorization error.

Which of the following actions should you perform to resolve the error?

You are developing an Azure Durable Function in C# (.NET Isolated) to process user registration requests. The orchestrator function must generate a unique correlation ID for tracking and retrieve the current timestamp to record when the process started.

You need to ensure that the orchestrator code remains deterministic and adheres to Durable Functions execution constraints.

Which code segment should you use inside the orchestrator function?

You are developing a serverless order processing workflow using Azure Durable Functions. The workflow is initiated via an HTTP request, performs a payment processing activity, and then runs a receipt generation activity.

Arrange the execution and execution replay events of the Durable Functions runtime in the correct sequential order from the arrival of the initial client request to the execution of the second activity.