All practice questions

You are developing a logistics monitoring solution in C# that tracks cargo container shipments. The container data is stored in Azure Cosmos DB. You need to write a method using the Azure Cosmos DB .NET SDK v3 that configures the connection, accesses the database and container, and performs a point read of a shipment item. In which order should you execute the steps to initialize the client and perform the point read?

You are developing an ASP.NET Core web application hosted on an Azure App Service. The application must retrieve database connection strings from an Azure Key Vault. The security architecture requires that:

1. The application must authenticate to Azure Key Vault without storing any credentials or secrets in code or configuration files.
2. The identity used for authentication must be shared across multiple web applications in the same environment to simplify access control management.

Which configuration should you implement to meet these requirements?

A development team implements Application Insights monitoring for a .NET 8.0 web API hosted on an Azure App Service using a Premium v3 plan. During testing, the team confirms that the Snapshot Debugger is enabled in the application configuration. However, when developers attempt to open a debug snapshot from an unhandled exception in the Azure portal, they are blocked by an access denied message. The developers already hold the Contributor role at the subscription level. Which of the following actions must be taken to allow the developers to view the debug snapshots?

An enterprise web application is hosted on a Linux-based Azure App Service. A developer needs to configure built-in application logging to capture standard output (stdout) and standard error (stderr) streams to the local filesystem for temporary debugging, and also stream these logs to an Azure Storage account for long-term retention.

Which of the following configurations must the developer perform? (Select two.)

You are deploying a custom Webhook endpoint to receive events from an Azure Event Grid custom topic. The solution must use the default Event Grid event schema. To complete the subscription setup, the endpoint must successfully process the automatic, synchronous validation handshake. Which two of the following configuration or code implementation steps must the Webhook endpoint execute to satisfy the Event Grid validation requirements? (Each correct answer presents a part of the solution. Choose two.)

An organization is migrating an ASP.NET Core web application to Azure App Service. The application must retrieve a database connection string from Azure Key Vault `kv-prod` using Azure App Configuration. The web application is configured to use a user-assigned managed identity named `id-app-prod`. The Azure Key Vault uses Azure role-based access control (Azure RBAC) for authorization. You need to configure the App Configuration key-vault reference and ensure the App Service web application can retrieve the database connection string. Which two configuration steps must you perform? (Select TWO)

You are developing a daemon application named 'BillingJob' that runs nightly as a background service on an Azure Virtual Machine. The application must query Microsoft Graph to retrieve the profile details of all users in the Microsoft Entra ID tenant to generate monthly billing reports. No user is signed in when the application runs.

You need to configure the permissions for the application registration in Microsoft Entra ID while adhering to the principle of least privilege.

Which configuration should you implement?

You need to import an Azure Function App as a new API in an existing Azure API Management (APIM) instance using the Azure portal. In which order should you perform the configuration steps?

You are developing an Azure Durable Functions application in C# using the .NET Isolated worker model. You write the following orchestrator function to manage an order processing workflow:

csharp
[Function("ProcessOrderOrchestrator")]
public static async Task RunOrchestrator(
[OrchestrationTrigger] TaskOrchestrationContext context)
{
var orderId = context.GetInput<string>();

var status = await context.CallActivityAsync<string>("CheckStatus", orderId);

var trackingId = Guid.NewGuid().ToString();

await context.CallActivityAsync("ProcessPayment", new { OrderId = orderId, TrackingId = trackingId });
}

Which line of code in this orchestrator function violates the determinism constraints of Durable Functions?

You are configuring an Azure Monitor Action Group to route alert notifications to a secured custom webhook endpoint. The webhook endpoint is secured using Microsoft Entra ID. You need to ensure that the Action Group can successfully authenticate and send alerts to the webhook. Which configuration should you use for the Webhook receiver in the Action Group?

You are configuring a monitoring solution for an Azure Cosmos DB API for NoSQL account. You need to configure an Azure Monitor alert rule that triggers when client applications receive HTTP status code 429 (Request Rate Too Large) responses. When triggered, the alert must email the operations team and execute an Azure Automation runbook. Which of the following configurations should you implement?

You are developing a secure .NET web application using the `Azure.Storage.Blobs` SDK (v12). The application must generate a Shared Access Signature (SAS) token for an Azure Blob Storage container named `invoices`.

The security requirements are as follows:
- The token must be signed using Microsoft Entra ID credentials (a User Delegation SAS) instead of the storage account key.
- The client must only be allowed to read and list the contents of the container.
- The SAS must restrict access to requests originating from the client IP address range `198.51.100.0/24`.
- The token must enforce the use of HTTPS only.
- The token must account for potential clock skew by setting the start time to 15 minutes before the current time.

You write the following method to generate the SAS token:

csharp
public async Task<string> GenerateContainerSasUriAsync(BlobServiceClient client, string containerName, string accountName)
{
UserDelegationKey delegationKey = await client.GetUserDelegationKeyAsync(
DateTimeOffset.UtcNow.AddMinutes(-15),
DateTimeOffset.UtcNow.AddHours(2)
);

BlobSasBuilder builder = new BlobSasBuilder()
{
BlobContainerName = containerName,
Resource = "c",
StartsOn = DateTimeOffset.UtcNow.AddMinutes(-15),
ExpiresOn = DateTimeOffset.UtcNow.AddHours(2)
};

// INSERT CODE HERE

BlobSasQueryParameters sasParams = builder.ToSasQueryParameters(delegationKey, accountName);
return $"{client.Uri}{containerName}?{sasParams}";
}

Which code segment should you insert to complete the method and meet the requirements?

A library book reservation system uses an Azure Service Bus queue to manage user reservation requests. The reservation system must process each request reliably. If a worker instance fails or restarts while processing a request, the request message must not be lost and must become available again in the queue so that another worker can pick it up.

Which option or method should you configure for the Service Bus receiver to satisfy this requirement?

You are designing a security architecture for three Azure Function apps that must retrieve database connection secrets from a single Azure Key Vault. The solution must use managed identities, minimize administrative overhead, and grant only the minimum permissions required to read the secrets.

Which two configuration steps should you perform?

You are implementing an Azure Durable Functions workflow in C# to handle a human approval process with a $24$-hour escalation timeout. Order the steps in the sequence they occur during a successful execution where a manager approves the request within the $24$-hour window.

You are developing a C# daemon application that runs on an Azure Virtual Machine. The application must automate the renewal of an Azure Key Vault certificate named 'ssl-cert' which is issued by a non-integrated internal Certificate Authority (CA).

The application must run under a user-assigned managed identity named 'app-identity'. The renewal workflow requires:
1. Retrieving the pending Certificate Signing Request (CSR) generated by Key Vault.
2. Submitting the CSR to the CA and receiving the signed certificate.
3. Merging the signed certificate back into Key Vault to complete the process.

You need to configure the required permissions and implement the code using the Azure.Security.KeyVault.Certificates library.

Which of the following configurations and code segments should you implement?

You are developing a C# application using the Azure.Storage.Blobs SDK (version 12) to update the metadata and change the access tier of an existing block blob. The blob is currently leased under the lease ID 5e2b834b-74d1-4e0d-b8d2-5a210d7a04bc. You must set a custom metadata tag Project to Delta and change the blob's access tier to Cool. Which C# code snippet should you use to successfully perform these operations?

An organization is implementing a client-side Single Page Application (SPA) named ClientConnect. The application must authenticate users using Microsoft Entra ID and access a secure downstream web API named DataAPI on behalf of the signed-in user. The DataAPI exposes a custom scope named Data.Write.

You register both ClientConnect and DataAPI in Microsoft Entra ID.

Which two configuration steps should you perform in Microsoft Entra ID to implement the required permissions and consent? Select two.

You are deploying an Azure Container App named `payment-processor` that needs to securely access a database connection string stored in an Azure Key Vault named `kv-vault`.

You want the Container App to authenticate to the Key Vault using a system-assigned managed identity and expose the secret to the application container as an environment variable named `DB_CONNECTION`.

Which four actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

You need to secure static content delivered via an Azure CDN endpoint by configuring a custom domain named `media.contoso.com` with HTTPS. You want to use a free certificate managed by Azure CDN. Which sequence of actions must you perform to configure the custom domain and enable HTTPS? Arrange the steps in the correct order.