All practice questions
972 questions
An Azure App Service plan named `asp-gateway` is currently running a microservice API gateway on the Standard S1 tier with instances. You configure a scale-out autoscale rule that increases the instance count by when the Average CPU percentage is greater than for minutes. To optimize costs when traffic decreases, you need to define a scale-in rule that decreases the instance count by . Which configuration should you choose to prevent autoscale flapping and ensure the rules function correctly?
You are configuring policies for an API gateway in Azure API Management (APIM). The API gateway must meet the following requirements:
1. Restrict client request rates to a maximum of 100 calls per 60 seconds.
2. Remove a sensitive header named `X-Internal-Token` returned by the backend service before the response is sent back to the client.
Which two of the following policy configurations should you implement?
Select all that apply
xml
<inbound>
<base />
<rate-limit calls="100" renewal-period="60" />
</inbound>
xml
<outbound>
<base />
<rate-limit calls="100" renewal-period="60" />
</outbound>
xml
<outbound>
<base />
<set-header name="X-Internal-Token" exists-action="delete" />
</outbound>
xml
<inbound>
<base />
<set-header name="X-Internal-Token" exists-action="delete" />
</inbound>
You are configuring a C# ASP.NET Core web application hosted in Azure App Service to connect to a Premium tier Azure Cache for Redis instance. To align with security best practices, you must eliminate the use of access keys and implement Microsoft Entra ID authentication using the system-assigned managed identity of the App Service.
Which sequence of steps should you perform to configure and establish this secure connection?
Drag items to arrange them in the correct order
Your company requires all storage accounts containing sensitive client data to comply with a security policy that limits the maximum validity period of Shared Access Signatures (SAS) signed with account keys to 4 hours. You have configured a SAS lifetime policy on the storage account named clientdata.
A developer generates an ad-hoc Service SAS token for a blob in this storage account with a validity period of 12 hours.
What is the result when a client attempts to read the blob using this Service SAS token 1 hour after it was generated?
You are designing autoscale rules for an Azure Virtual Machine Scale Set (VMSS) named `vmss-orders` that hosts an order-processing API. The VMSS is configured with a minimum of instances, a maximum of instances, and currently runs instances.
You configure the following scale-out rule:
- Metric: CPU Percentage
- Time grain: minute
- Statistic: Average
- Time aggregation: Average
- Operator: Greater than
- Threshold:
- Operation: Increase count by
- Cooldown: minutes
You need to create a scale-in rule that decreases the instance count by when the CPU load decreases. You must ensure that the scale-in rule does not cause autoscale flapping if the total workload remains constant at the point the scale-out rule is triggered.
Which of the following is the maximum CPU percentage threshold you should configure for the scale-in rule?
You are developing an Azure Function App in C# that needs to retrieve a third-party API key stored as a secret in an Azure Key Vault. The Function App must authenticate to Key Vault securely using a system-assigned managed identity, adhering to the principle of least privilege.
Which five actions should you perform in sequence to configure the resources and write the code? To answer, arrange all the actions from the list of actions to the correct order.
Drag items to arrange them in the correct order
A C# daemon application runs as a Windows Service on an on-premises server. The application must authenticate to the Microsoft Identity Platform without user interaction and query directory metadata from Microsoft Graph. You configure the application registration in Microsoft Entra ID with the Directory.Read.All Application permission, and an administrator grants tenant-wide consent. In your code, you instantiate an IConfidentialClientApplication instance. Which string array should you pass as the scopes argument to the AcquireTokenForClient method to successfully retrieve the access token?
You are developing a media metadata caching solution using Azure Cache for Redis. The cache contains two types of keys:
1. Critical lookup tables that do not have a Time-to-Live (TTL) set and must remain in the cache indefinitely.
2. Dynamic media metadata keys that are set with a TTL. Under memory pressure, you want the cache to prioritize evicting the keys that are nearest to their expiration time.
You need to configure the cache to meet these requirements and ensure the instance has sufficient memory buffer to handle replication and system fragmentation.
Which of the following configuration options should you implement? (Select two.)
Select all that apply
An internal audit team requires temporary, read-only access to log files stored in a private blob container named `applogs`. You are writing the C# backend code to generate a Shared Access Signature (SAS) token for their client software.
The security policy dictates the following constraints:
- The token must be signed using Microsoft Entra ID credentials, avoiding the use of storage account keys.
- Connections must be restricted to HTTPS.
- Access must be limited specifically to the client software's outbound IP address of `203.0.113.88`.
Which of the following configurations or code steps are required to generate this SAS token? (Select TWO).
Select all that apply
You are configuring an Azure API Management (APIM) instance to authenticate to a backend API. The backend API is secured with Microsoft Entra ID and requires an authentication token. You configure the APIM instance to use a system-assigned managed identity.
You need to add a policy that obtains an OAuth token for the resource `https://graph.microsoft.com` and presents it to the backend API.
Which XML policy configuration should you apply?
<base />
<authentication-managed-identity resource="https://graph.microsoft.com" />
</outbound>
<base />
<authentication-managed-identity resource="https://graph.microsoft.com" />
</inbound>
<inbound>
<base />
<authentication-managed-identity resource="https://graph.microsoft.com" />
</inbound>
without specifying the client ID or object ID of the user-assigned identity in the policy.
<inbound>
<base />
<set-header name="Authorization" exists-action="override">
<value>{{keyvault-secret-named-value}}</value>
</set-header>
</inbound>
without granting the API Management system-assigned managed identity Get secret permissions in the Key Vault access policies.
A warehouse automation system requires a C# solution to consume high-throughput logistics events from Azure Event Hubs. You must write a consumer application that processes these events reliably, handles errors, updates partition progress in Azure Blob Storage, and shuts down gracefully when a cancellation token is triggered. How should you order the following implementation steps to achieve this?
Drag items to arrange them in the correct order
An enterprise API uses an Azure Cache for Redis instance to store two distinct categories of data: user session tokens that are assigned a sliding expiration Time to Live (TTL) of 30 minutes, and global application configuration settings that are stored without any TTL. Due to a sudden spike in application usage, the cache memory consumption is approaching its limit. You need to configure a policy that automatically evicts the least recently used session keys under memory pressure, while guaranteeing that all global configuration settings remain in the cache. Which maxmemory-policy configuration should you apply?
You are developing a secure backend service in C# using the Azure.Storage.Blobs SDK (v12) to grant temporary access for clients to upload diagnostic files to a private Azure Blob Storage container.
Your company enforces the following security requirements:
- Storage account access keys must not be used or loaded by the application; access must be authenticated via Microsoft Entra ID.
- Clients must only be permitted to write new files; they must not be allowed to read, list, or delete existing files.
- All client connections must be encrypted using HTTPS.
- The SAS token must be valid immediately upon generation, accounting for potential clock synchronization differences between the server and clients.
You write the following code segment:
csharp
// blobServiceClient is an authenticated BlobServiceClient using DefaultAzureCredential
var userDelegationKey = await blobServiceClient.GetUserDelegationKeyAsync(
DateTimeOffset.UtcNow.AddMinutes(-15),
DateTimeOffset.UtcNow.AddHours(2)
);
var sasBuilder = new BlobSasBuilder
{
BlobContainerName = "diagnostics",
BlobName = "log.txt",
Resource = "b"
};
Which code segment should you use to complete the SAS configuration and token generation?
sasBuilder.ExpiresOn = DateTimeOffset.UtcNow.AddMinutes(45);
sasBuilder.Protocol = SasProtocol.HttpsAndHttp;
sasBuilder.SetPermissions(BlobSasPermissions.Write);
string sasToken = sasBuilder.ToSasQueryParameters(userDelegationKey, blobServiceClient.AccountName).ToString();
sasBuilder.ExpiresOn = DateTimeOffset.UtcNow.AddMinutes(45);
sasBuilder.Protocol = SasProtocol.Https;
sasBuilder.SetPermissions(BlobSasPermissions.Write);
string sasToken = sasBuilder.ToSasQueryParameters(userDelegationKey, blobServiceClient.AccountName).ToString();
sasBuilder.ExpiresOn = DateTimeOffset.UtcNow.AddMinutes(45);
sasBuilder.Protocol = SasProtocol.Https;
sasBuilder.SetPermissions(BlobSasPermissions.Write);
var credential = new StorageSharedKeyCredential(blobServiceClient.AccountName, "accountKey");
string sasToken = sasBuilder.ToSasQueryParameters(credential).ToString();
sasBuilder.ExpiresOn = DateTimeOffset.UtcNow.AddMinutes(45);
sasBuilder.Protocol = SasProtocol.Https;
sasBuilder.SetPermissions(BlobSasPermissions.Read | BlobSasPermissions.Write);
string sasToken = sasBuilder.ToSasQueryParameters(userDelegationKey, blobServiceClient.AccountName).ToString();
You are configuring an inbound policy for an Azure API Management (APIM) instance. You need to route incoming API requests to a specific regional backend API based on the value of a custom header named `X-Region`. If the header value is `EU`, the request must be routed to `https://eu-backend.contoso.com/api`. Otherwise, the request must use the default backend. What are the correct API Management policy element names required to complete the XML configuration below?
Fill in the blanks below
<inbound>
<base />
<choose>
< condition="@(context.Request.Headers.GetValueOrDefault("X-Region") == "EU")">
< base-url="https://eu-backend.contoso.com/api" />
</>
</choose>
</inbound>
You are developing a C# desktop application that will run on local client workstations. The application must authenticate users using the Microsoft Identity Platform and call a secured downstream Web API. You need to write the MSAL.NET code to initialize the application and acquire the access token. Which two code segments should you use? (Select two.)
Select all that apply
You are developing a C# background service that processes smart meter telemetry data from an Azure Service Bus queue named 'meter-telemetry'. If the processing of a telemetry message fails due to an external API outage, the message must not be lost and should remain in the queue for another attempt. You need to initialize the receiver and handle the message processing in a way that guarantees at-least-once delivery. Which code segment should you use?
var receiver = client.CreateReceiver("meter-telemetry", options);
var message = await receiver.ReceiveMessageAsync();
// Process message...
await receiver.CompleteMessageAsync(message);
var receiver = client.CreateReceiver("meter-telemetry", options);
var message = await receiver.ReceiveMessageAsync();
// Process message...
await receiver.CompleteMessageAsync(message);
var receiver = client.CreateReceiver("meter-telemetry", options);
var message = await receiver.ReceiveMessageAsync();
// Process message...
// Allow the lock duration to expire naturally
var receiver = client.CreateReceiver("meter-telemetry", options);
var message = await receiver.ReceiveMessageAsync();
// Process message...
An Azure App Configuration store needs to retrieve a database password stored in an Azure Key Vault named kv-app-prod at runtime. The Key Vault uses the Azure Role-Based Access Control (RBAC) permission model. The App Configuration store has a system-assigned managed identity enabled. Which of the following actions should you perform to configure the App Configuration store to reference the Key Vault secret? (Select TWO.)
Select all that apply
A web application for a news outlet uses Azure Cache for Redis to store articles. The articles fall into two main categories:
1. Breaking news stories, which receive a high volume of read requests shortly after publication, but traffic drops to zero within hours.
2. Evergreen features, which receive a steady, low-volume stream of read requests consistently over several months.
All cached articles are configured with a Time-to-Live (TTL) value. Under high load, the cache memory limit is reached. You need to configure an eviction policy that retains the evergreen features (consistently accessed over time) and prioritizes evicting breaking news stories whose traffic has subsided, even if those stories were accessed more recently than some evergreen features.
Which eviction policy should you choose?
You are developing a secure C# application using the `Azure.Storage.Blobs` SDK (v12) to generate a Shared Access Signature (SAS) token. The token will grant temporary access to an external partner to download a specific PDF report from a private Azure Blob Storage container.
The solution must comply with the following security constraints:
- Grant read-only access to the specific blob.
- Restrict communication to HTTPS requests only.
- Limit access to the partner's public IP address, which is `198.51.100.45`.
- Set the start time to 15 minutes before the current time to account for clock skew.
- Set the expiry time to 2 hours from the current time.
Which two of the following code segments should you use to configure the `BlobSasBuilder` instance named `sasBuilder`? (Choose two.)
Select all that apply
A corporate financial system uses an Azure Service Bus queue named `expense-claims` to process employee reimbursement requests. You are writing the message consumption logic in C# using the `Azure.Messaging.ServiceBus` SDK. To ensure reliability, if the consumer application fails mid-operation, the message must remain in the queue and be re-delivered after the lock duration expires. Once the expense claim is successfully recorded, the message must be deleted.
Which two actions should you take to implement this workflow? (Select two)
Select all that apply