Examkin

All practice questions

972 questions

All types972Multiple choice497Multiple select269Matching9Ordering171Fill in the blank26
Question 761Question →

A food delivery platform dispatch system uses Azure Service Bus to process orders for multiple restaurants. The system must guarantee that orders for each restaurant are processed in the exact order they are received. Additionally, if the consumer application crashes during processing, the message must not be lost and should eventually be moved to the dead-letter queue after a specific number of retries. Which two configuration or implementation steps should you perform to meet these requirements? (Select two.)

Select all that apply

Show answer & explanation

Answer: Enable sessions on the queue and set the SessionId property on each ServiceBusMessage to the restaurant's unique identifier.; Use the ServiceBusSessionProcessor to read messages and call CompleteMessageAsync on the receiver after successful processing of a message.

Answer

Enable sessions on the queue and set the SessionId property on each ServiceBusMessage to the restaurant's unique identifier, and use the ServiceBusSessionProcessor to read messages and call CompleteMessageAsync after successful processing.
To achieve FIFO ordering per restaurant, you must enable sessions on the queue and assign the SessionId property on outgoing messages to the restaurant's identifier. To prevent message loss in case of processing crashes, you must use PeekLock mode (implicitly used by ServiceBusSessionProcessor when calling CompleteMessageAsync explicitly after processing) so that incomplete messages are returned to the queue and eventually dead-lettered after the maximum delivery count is reached.

Step-by-Step Solution

1
Ensure ordered delivery by grouping messages.
Sessions are enabled on the queue, and each message is stamped with a SessionId corresponding to the restaurant ID, enabling FIFO delivery per restaurant.
Azure Service Bus queues do not guarantee FIFO ordering across all messages unless sessions are used to group related messages.
2
Select the correct message processing client.
ServiceBusSessionProcessor is selected for consuming session-locked messages.
Standard non-session processors cannot process session-enabled queues.
3
Configure the correct receive mode to prevent loss.
PeekLock mode (default) is used, and CompleteMessageAsync is called only after successful processing.
If processing fails or the receiver crashes, the lock will expire, making the message available for retry, and eventually moving to the dead-letter queue after max delivery attempts are exceeded.

Key Concept

Azure Service Bus Sessions and Message Lock Modes
Question 762Question →

You manage an Azure Cache for Redis instance that stores session data and reference tables. The session keys are configured with an expiration time, while the reference tables must remain in the cache indefinitely and do not have an expiration time. Due to an unexpected surge in traffic, the cache is reaching its memory limit. You need to configure a policy that removes keys with an expiration time, prioritizing those closest to expiring, while ensuring the reference tables are not removed. Which maxmemory policy should you configure?

Show answer & explanation

Answer: volatile-ttl

Answer

volatile-ttl
The volatile-ttl policy evicts keys with an expiration time (TTL) set, prioritizing those with the shortest remaining time-to-live. Since the reference tables do not have an expiration time, they are protected from eviction under this policy.

Step-by-Step Solution

1
Analyze the requirements for key eviction.
Keys without an expiration time (reference tables) must not be evicted, while keys with an expiration time (session data) must be evicted.
This narrows the choice to policies prefixed with 'volatile-' because 'allkeys-' policies can evict any key regardless of whether it has an expiration time.
2
Determine the prioritization for evicting the keys with expiration times.
The requirement states that eviction should prioritize keys closest to expiring.
The 'volatile-ttl' policy specifically targets keys with an expiration time and evicts those with the shortest remaining time-to-live first.
3
Select the policy matching both criteria.
The correct policy is volatile-ttl.
It satisfies both the constraint of not evicting reference tables and prioritizing session keys closest to expiration.

Key Concept

Azure Cache for Redis maxmemory eviction policies
Question 763Question →

You are deploying a C# .NET 8 microservice to Azure Container Apps. You need to enable Application Insights instrumentation using the SDK. Which two actions should you perform to ensure the SDK is correctly initialized and telemetry is successfully sent to your Azure Monitor resource?

Select all that apply

Show answer & explanation

Answer: Call `builder.Services.AddApplicationInsightsTelemetry()` in the `Program.cs` file of your microservice.; Set the `APPLICATIONINSIGHTS_CONNECTION_STRING` environment variable in the Azure Container App configuration.

Answer

Register the telemetry services in the dependency injection container and set the standard connection string environment variable.
To successfully configure Application Insights using the SDK, you must register the telemetry services within the service container and provide a valid destination. Calling the extension method on the service collection registers the required components, and setting the connection string environment variable tells the SDK where to send the telemetry.

Step-by-Step Solution

1
Add the Application Insights SDK services to the dependency injection container.
The SDK components are registered and ready to collect telemetry.
The application requires these services to auto-collect dependency, request, and exception telemetry.
2
Define the connection string environment variable in the hosting environment.
The SDK resolves the connection string at runtime.
Without a valid connection string, the SDK cannot resolve the target endpoint and telemetry is not sent.

Key Concept

Application Insights SDK Initialization and Connection Configuration
Question 764Question →

A developer is writing a C# application that connects to an Azure Cache for Redis instance using the StackExchange.Redis SDK. To optimize application performance and socket reuse, the application must share a single, thread-safe connection instance using lazy initialization. You need to arrange the steps required to initialize the cache connection client and execute a write operation. What is the correct sequence of steps to configure, establish, and use the connection?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence starts with declaring the lazy ConnectionMultiplexer variable, followed by initializing the variable with the connection delegate. Next, access the Value property to establish the connection, call GetDatabase to obtain a reference to the cache database, and finally execute the write command using StringSetAsync.
According to Azure Cache for Redis developer guidelines, applications should share and reuse a single ConnectionMultiplexer instance. Using Lazy<ConnectionMultiplexer> ensures the connection is only established when the application first requires it, and in a thread-safe manner. Once the Value property is accessed and the connection is active, the database reference is fetched via GetDatabase, and commands are sent through the database reference.

Step-by-Step Solution

1
Declare the static Lazy<ConnectionMultiplexer> variable.
A class-level variable is ready to hold the lazy initializer.
Creating a static variable ensures the ConnectionMultiplexer is shared and reused across the application to prevent socket exhaustion.
2
Initialize the Lazy instance with a connection delegate.
The initialization delegate is registered with connection settings.
This sets up the connection logic without immediately paying the performance cost of establishing the network connection.
3
Access the Value property of the Lazy instance.
The connection delegate is executed, returning the active ConnectionMultiplexer.
Accessing the Value property triggers the connection build thread-safely upon the first request.
4
Retrieve the database reference.
An IDatabase object is returned from the multiplexer.
The application needs a database context to interact with keys and values in the Redis instance.
5
Call StringSetAsync to write data.
The key-value pair is saved in the Azure Cache for Redis.
Commands must be executed against the obtained database reference rather than the multiplexer itself.

Key Concept

Lazy initialization of StackExchange.Redis ConnectionMultiplexer for efficient socket and connection management
Question 765Question →

A developer is configuring response caching for an API in Azure API Management. The developer applies the following policy configuration:

xml
<policies>
<inbound>
<base />
<cache-lookup vary-by-developer="false" vary-by-developer-groups="false" downstream-caching-type="none" />
<cache-store duration="3600" />
</inbound>
<backend>
<base />
</backend>
<outbound>
<base />
</outbound>
</policies>

Why does this policy configuration fail to save?

Show answer & explanation

Answer: The cache-store policy is located in the inbound section, but it must be placed in the outbound section.

Answer

The cache-store policy is located in the inbound section, but it must be placed in the outbound section.
The correct answer states that the cache-store policy is located in the inbound section, but it must be placed in the outbound section. Azure API Management policies execute in specific stages of the message lifecycle. The cache-lookup policy must be in the inbound section to intercept incoming requests and return a cached response if available. Conversely, the cache-store policy must be in the outbound section because it reads the HTTP response headers and body returned by the backend service to write them to the cache for future requests.

Step-by-Step Solution

1
Analyze the placement of the caching policies in the XML configuration.
Both cache-lookup and cache-store are placed inside the inbound policy section.
Correct placement of policies is required for valid schema parsing and execution flow.
2
Determine the execution flow of caching in Azure API Management.
Looking up cached responses must occur before forwarding to the backend (inbound). Storing the backend response must occur after the backend returns a response (outbound).
Since the backend response only exists after the backend scope executes, storing that response must happen in the outbound pipeline.
3
Identify the misplaced policy element causing the schema validation error.
The cache-store policy is in the inbound section, which violates the Azure API Management policy schema definitions.
Fixing the placement by moving cache-store to the outbound section resolves the schema validation error.

Key Concept

Azure API Management response caching policies must be placed in their correct execution sections: cache-lookup in inbound, and cache-store in outbound.
Question 766Question →

You are developing a C# console application that runs on an Azure Virtual Machine. The application must perform key wrapping and unwrapping operations using an RSA key stored in an Azure Key Vault named kv-prod-keys. The Key Vault is configured to use the Azure Role-Based Access Control (Azure RBAC) permission model. The virtual machine has a system-assigned managed identity enabled. You need to grant the application the minimum necessary permissions to perform the operations and configure the application code using the latest Azure SDK for .NET. Which two actions should you perform? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Assign the Key Vault Crypto User role to the system-assigned managed identity of the virtual machine.; Instantiate the CryptographyClient class from the Azure.Security.KeyVault.Keys.Cryptography namespace.

Answer

Assign the Key Vault Crypto User role to the system-assigned managed identity and use the CryptographyClient class from the Azure.Security.KeyVault.Keys.Cryptography namespace.
To perform cryptographic operations such as key wrapping and unwrapping using an RSA key in Azure Key Vault, the application identity requires the 'Key Vault Crypto User' RBAC role, which provides data plane access for keys. In the Azure SDK for .NET (Azure.Security.KeyVault), cryptographic operations are separated from management operations and must be executed using the 'CryptographyClient' class located in the 'Azure.Security.KeyVault.Keys.Cryptography' namespace.

Step-by-Step Solution

1
Determine the required access control configuration for the Azure Key Vault.
Since the vault uses the Azure RBAC permission model, permissions must be assigned using Azure RBAC roles rather than Key Vault access policies.
Access policies are disabled when the Azure RBAC permission model is active.
2
Select the correct role for key wrapping and unwrapping operations.
The Key Vault Crypto User role is chosen, as it provides the least privilege required to perform data plane cryptographic operations on keys.
Other roles like Key Vault Secrets User are for secrets, and the Reader role does not grant data plane access.
3
Identify the modern C# SDK class and namespace for cryptographic operations.
Use the CryptographyClient class within the Azure.Security.KeyVault.Keys.Cryptography namespace.
The Azure.Security.KeyVault.Keys SDK separates management operations (KeyClient) from cryptographic operations (CryptographyClient) for efficiency and security.

Key Concept

Azure Key Vault cryptographic operations and RBAC-based access control using the Azure SDK for .NET.
Question 767Question →

An e-prescribing platform processes medical prescriptions using an Azure Service Bus queue named `prescription-processing`. You are writing a C# console application that retrieves these prescriptions and updates a database. Because patient safety is critical, the application must guarantee that if a receiver crashes or encounters an unhandled exception while processing a prescription, the message is not lost and becomes available again for other receiver instances to process.

You write the following code segment to initialize the receiver and handle incoming messages:

csharp
string connectionString = "Endpoint=sb://...";
string queueName = "prescription-processing";
await using var client = new ServiceBusClient(connectionString);

var options = new ServiceBusReceiverOptions
{
// Line X
};
ServiceBusReceiver receiver = client.CreateReceiver(queueName, options);
ServiceBusReceivedMessage message = await receiver.ReceiveMessageAsync();

try
{
await ProcessPrescriptionAsync(message);
// Line Y
}
catch (Exception)
{
// Line Z
}

Which set of code segments should you use to complete the implementation?

Show answer & explanation

Answer: Line X: ReceiveMode = ServiceBusReceiveMode.PeekLock
Line Y: await receiver.CompleteMessageAsync(message);
Line Z: await receiver.AbandonMessageAsync(message);

Answer

Configure the receiver to use PeekLock mode, call CompleteMessageAsync in the try block, and call AbandonMessageAsync in the catch block.
The correct implementation configures the receiver to use PeekLock mode, which locks the message on the queue during processing. The message is explicitly completed with CompleteMessageAsync on success, and abandoned with AbandonMessageAsync on failure so it can be reprocessed.

Step-by-Step Solution

1
Determine the correct Service Bus receive mode that prevents message loss during processing failures.
ServiceBusReceiveMode.PeekLock must be chosen for Line X, as ServiceBusReceiveMode.ReceiveAndDelete deletes the message immediately and cannot recover it on failure.
PeekLock keeps the message locked on the server and allows the application to explicitly complete or abandon the message.
2
Select the correct API call to settle the message upon successful processing in the try block.
receiver.CompleteMessageAsync(message) must be called for Line Y.
Completing the message informs Service Bus that the message was successfully processed and can be deleted from the queue.
3
Select the correct API call to release the message lock when an unhandled exception is caught in the catch block.
receiver.AbandonMessageAsync(message) must be called for Line Z.
Abandoning the message releases the lock immediately, allowing other receiver instances to retrieve and process the message without waiting for the lock duration to expire.

Key Concept

Message settlement and receive modes in Azure Service Bus
Estimated Time:1m 30s
Question 768Question →

You are developing a C# ASP.NET Core Web API that will be hosted on Azure App Service. You want to programmatically configure the Application Insights SDK using connection strings read from your configuration provider. You add the Microsoft.ApplicationInsights.AspNetCore NuGet package to your project and write the following initialization code in Program.cs:

csharp
var builder = WebApplication.CreateBuilder(args);

builder.Services.AddApplicationInsightsTelemetry(options =>
{
// Configure telemetry connection string
});

var app = builder.Build();

Which of the following statements should you place inside the action delegate to correctly configure the telemetry connection string?

Show answer & explanation

Answer: options.ConnectionString = builder.Configuration["ApplicationInsights:ConnectionString"];

Answer

options.ConnectionString = builder.Configuration["ApplicationInsights:ConnectionString"];
The correct option sets the ConnectionString property directly on the ApplicationInsightsServiceOptions object. When configuring Application Insights in ASP.NET Core applications using the SDK, this property must be set to ensure telemetry is sent to the correct resource endpoint.

Step-by-Step Solution

1
Analyze the properties of the ApplicationInsightsServiceOptions class passed to AddApplicationInsightsTelemetry.
The options class provides a direct ConnectionString property to specify ingestion endpoints.
This allows developers to configure the SDK connection string programmatically during service registration.
2
Avoid deprecated properties like InstrumentationKey.
Ensure ConnectionString is used instead of InstrumentationKey.
Microsoft has deprecated instrumentation keys in favor of connection strings, which support endpoint routing and secure token authentication.
3
Assign the configuration value using builder.Configuration.
Set options.ConnectionString = builder.Configuration["ApplicationInsights:ConnectionString"].
This correctly pulls the setting from the configuration providers (such as appsettings.json or environment variables) and assigns it to the SDK options.

Key Concept

Programmatic configuration of Application Insights SDK using connection strings.
Estimated Time:1m 30s
Question 769Question →

You are developing a .NET 8 background worker service that processes queue messages and communicates with an external database. You need to manually track the database call as a dependency using the Application Insights SDK, and ensure any thrown exceptions are logged to Application Insights.

Complete the code by filling in the blanks with the correct TelemetryClient method names.

Fill in the blanks below

using Microsoft.ApplicationInsights;
using Microsoft.ApplicationInsights.DataContracts;
using System;
using System.Threading.Tasks;

public class QueueProcessor
{
private readonly TelemetryClient _telemetryClient;
private readonly IExternalService _externalService;

public QueueProcessor(TelemetryClient telemetryClient, IExternalService externalService)
{
_telemetryClient = telemetryClient;
_externalService = externalService;
}

public async Task ProcessJobAsync(string jobId)
{
// Start and correlate a dependency tracking operation
using (var operation = _telemetryClient.<DependencyTelemetry>("DatabaseCall"))
{
try
{
await _externalService.ExecuteAsync(jobId);
operation.Telemetry.Success = true;
}
catch (Exception ex)
{
operation.Telemetry.Success = false;
_telemetryClient.(ex);
throw;
}
}
}
}
Show answer & explanation

Answer

The first blank must be 'StartOperation' to begin a correlated telemetry tracking operation, and the second blank must be 'TrackException' to record the exception details in Application Insights.
The correct method for starting a scoped operation telemetry flow is `StartOperation`, which integrates seamlessly with C#'s `using` pattern to capture telemetry duration. The correct method for recording raw application exceptions is `TrackException` to capture the complete error signature.

Step-by-Step Solution

1
Identify the telemetry tracking pattern designed to measure operation duration and context propagation using C# using-blocks.
The `StartOperation` extension method of `TelemetryClient` starts a timed operation scope and returns an `IOperationHolder<T>` instance.
Using `StartOperation` automatically sets start time, tracks duration upon disposal, and correlates sub-operations.
2
Determine the correct telemetry API method to log exceptions with full call stack details.
The `TrackException` method accepts an `Exception` object to send to the Application Insights exception log store.
Using `TrackException` maps the caught error to Azure Monitor exception tables, ensuring diagnostic details are preserved.

Key Concept

Manual dependency tracking and exception instrumentation with Application Insights SDK
Question 770Question →

You are developing a solution that uses Azure API Management (APIM). You need to configure an inbound policy that forwards the client's original IP address to the backend service by adding a custom request header named `X-Client-IP`. You must use a C# policy expression within the `<set-header>` policy.

Complete the policy configuration by filling in the missing C# expression in the blank. What is the C# expression to retrieve the client's IP address from the request context?

Fill in the blanks below

<inbound>
<base />
<set-header name="X-Client-IP" exists-action="override">
<value>@()</value>
</set-header>
</inbound>
Show answer & explanation

Answer

context.Request.IpAddress
In Azure API Management, the context object is a read-only variable available within policy expressions. To access details about the client's request, you use the Request property of the context. The client's IP address is specifically exposed via the IpAddress property on the Request object. Therefore, the correct expression to fill the blank is context.Request.IpAddress.

Step-by-Step Solution

1
Identify the context variable available in Azure API Management policy expressions.
The context variable is implicitly available in all APIM policy expressions.
Policy expressions are C# statements or expressions that have access to the context variable.
2
Determine the property of the context variable that represents the incoming HTTP request.
The context.Request property represents the incoming request sent by the client.
To retrieve information about the incoming client call (like headers, query parameters, or IP address), we must inspect the request context.
3
Locate the specific property containing the client's IP address on the Request object.
context.Request.IpAddress returns the IP address of the client as a string.
This property is populated by the API Management gateway with the caller's IP address.

Key Concept

Azure API Management context variables and policy expressions
Question 771Question →

You are developing a secure .NET web API hosted on an Azure App Service. The API needs to programmatically retrieve an X.509 certificate, including its private key, from an Azure Key Vault named `kv-prod` to sign outgoing requests.

The App Service is configured with a system-assigned managed identity and has been assigned only the 'Key Vault Secrets User' Azure RBAC role on `kv-prod`.

Which C# code segment should you use to retrieve the certificate along with its private key?

Show answer & explanation

Answer: var client = new SecretClient(new Uri("https://kv-prod.vault.azure.net/"), new DefaultAzureCredential());
KeyVaultSecret secret = await client.GetSecretAsync("SigningCert");
var certificate = new X509Certificate2(Convert.FromBase64String(secret.Value));

Answer

Use SecretClient with DefaultAzureCredential to retrieve the certificate value as a secret, then instantiate the X509Certificate2 object using the base64-decoded bytes.
In Azure Key Vault, when an X.509 certificate is created or imported, the certificate's private key and full PFX/PEM contents are stored as a Secret with the same name. To retrieve the private key of a certificate programmatically, you must retrieve it as a secret using the SecretClient and decode the base64-encoded secret value. Because the App Service managed identity is granted the 'Key Vault Secrets User' RBAC role, it has the necessary permissions to read secrets from the Key Vault.

Step-by-Step Solution

1
Identify where the private key of an Azure Key Vault certificate is stored.
The private key of an Azure Key Vault certificate is stored as a Key Vault Secret under the same name.
Azure Key Vault certificates are composite resources; the public portion is managed via the certificate API, but the private key can only be downloaded programmatically by retrieving the secret payload.
2
Verify authorization requirements against the assigned role.
The 'Key Vault Secrets User' RBAC role allows read access to secrets but not to certificates or keys.
Since the private key must be retrieved as a secret, the application needs to utilize SecretClient and must have the Secrets User permission.
3
Select the correct SDK client and credentials for local reconstruction.
Initialize SecretClient using DefaultAzureCredential to leverage the system-assigned managed identity, get the secret, base64-decode the value, and initialize X509Certificate2.
DefaultAzureCredential seamlessly handles system-assigned managed identity authentication in App Service environments.

Key Concept

Retrieving certificates with private keys from Azure Key Vault using the Azure SDK for .NET and Azure RBAC
Estimated Time:1m 30s
Question 772Question →

A digital ticketing platform processes high-value concert ticket bookings using an Azure Service Bus queue. To prevent booking failures, the system must guarantee that if a processing instance crashes during the checkout transaction, the message is not lost and remains available in the queue for another instance to process. Which message receive mode and SDK action should you implement?

Show answer & explanation

Answer: Receive messages using PeekLock mode, perform the checkout logic, and then call CompleteMessageAsync.

Answer

Receive messages using PeekLock mode, perform the checkout logic, and then call CompleteMessageAsync.
Receiving messages using PeekLock mode ensures that the message is locked but remains in the queue. Only after successful processing is CompleteMessageAsync called to permanently delete the message. If a crash occurs, the lock expires, making the message available for other instances to process.

Step-by-Step Solution

1
Select PeekLock receive mode for the Service Bus client/receiver.
The message is retrieved from the queue and locked for a specified duration, preventing other receivers from processing it while keeping it in the queue.
Ensures that if the receiver crashes, the message remains in the queue and can be reprocessed when the lock expires.
2
Execute the ticket checkout logic.
The booking transaction is completed successfully.
Verifies that the message has been successfully processed before removing it from the system.
3
Invoke CompleteMessageAsync on the receiver passing the message.
The message is permanently deleted from the queue.
Signals to Azure Service Bus that processing was successful and the message can be safely removed.

Key Concept

Azure Service Bus receive modes: PeekLock vs ReceiveAndDelete.
Estimated Time:1m 30s
Question 773Question →

A developer is configuring a Premium tier Azure Cache for Redis instance for a retail e-commerce application. The cache stores two types of data: product inventory levels (which are critical and must never be evicted, and do not have an expiration time set) and user search queries (which have an expiration time set). Under memory pressure, the system must only evict search query data while preserving all product inventory levels. Additionally, you must reserve memory for background processes to ensure stable replication and failover operations. Which two configuration settings should you implement to meet these requirements?

Select all that apply

Show answer & explanation

Answer: Configure the maxmemory-policy setting to volatile-lfu; Configure the maxmemory-reserved setting to allocate memory for non-data operations

Answer

To configure the Azure Cache for Redis instance correctly, you should set the maxmemory-policy setting to volatile-lfu and configure the maxmemory-reserved setting to allocate memory for non-data operations.
Configuring volatile-lfu ensures that only keys with an expiration time set (the transient search queries) are evicted when the cache is full. Configuring maxmemory-reserved ensures that a portion of memory is reserved for non-cache operations such as replication and clustering overhead, preventing out-of-memory errors during failovers.

Step-by-Step Solution

1
Identify that product inventory levels do not have an expiration time (TTL) set, whereas search query data does.
Product inventory levels require protection from eviction policies that target non-expiring keys.
This establishes the logical constraint for selecting the eviction policy.
2
Choose an eviction policy prefixed with 'volatile-' (such as volatile-lfu) so that only keys with a TTL are eligible for eviction.
Keys without a TTL (such as product inventory levels) are protected from being evicted.
This ensures the transient search query data is sacrificed under memory pressure while keeping critical data.
3
Determine the need to reserve memory for overhead activities like replication and failover, and configure the maxmemory-reserved setting.
Dedicated memory is set aside for replication and fragmentation purposes.
This guarantees stability during failovers and high-write loads.

Key Concept

Memory eviction policies and memory reservation in Azure Cache for Redis
Estimated Time:1m 30s
Question 774Question →

You need to create a new SSL/TLS certificate in Azure Key Vault using a non-integrated Certificate Authority (CA). Which sequence of steps should you perform to generate the Certificate Signing Request (CSR) and complete the certificate creation in Key Vault?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence starts with initiating the certificate creation operation in Key Vault with the Issuer set to Unknown. Next, you download the generated Certificate Signing Request (CSR). You then submit this CSR to the external Certificate Authority (CA) and retrieve the signed certificate. Finally, you merge the signed certificate back into the pending certificate operation in Key Vault to complete the process.
The correct process involves first initiating the certificate operation with the issuer set to Unknown, which generates the CSR. The CSR is then retrieved and signed by the external CA. Finally, the signed certificate is merged back into the pending operation to match the private key.

Step-by-Step Solution

1
Initiate the certificate creation in Azure Key Vault with the issuer configuration set to Unknown.
Key Vault creates a pending certificate operation, generating a private/public key pair and a Certificate Signing Request (CSR).
Specifying Unknown as the issuer tells Key Vault that an external, non-integrated CA will be responsible for signing the certificate.
2
Retrieve the CSR from the pending certificate operation.
You obtain the CSR file (PEM format) from the Azure Portal, CLI, or SDK.
You must download the CSR to pass it to the external authority.
3
Submit the CSR to the external CA and retrieve the signed certificate.
The CA signs the public key and issues a certificate (usually as a .cer or .p7b file).
The external CA must authenticate the request and sign it to make the certificate valid.
4
Merge the signed certificate back into the pending Key Vault certificate operation.
The certificate state updates to Active and is ready for use.
Merging links the public certificate from the CA with the private key stored securely in Key Vault.

Key Concept

Creating certificates in Azure Key Vault using a non-integrated CA requires generating a CSR, obtaining the signed certificate externally, and merging it back to associate it with the private key.
Question 775Question →

You are configuring an Azure API Management (APIM) policy to authenticate requests to a secure backend service. The backend service requires Azure Active Directory (Azure AD) tokens for the resource `https://api.contoso.com`. You must use a user-assigned managed identity with the Client ID `11111111−2222−3333−4444−55555555555511111111-2222-3333-4444-555555555555` to authenticate the requests.

Which of the following XML configurations correctly implements this authentication?

Show answer & explanation

Answer: <inbound>
<base />
<authentication-managed-identity resource="https://api.contoso.com" client-id="11111111-2222-3333-4444-555555555555" />
</inbound>

Answer

The policy configuration that places the authentication-managed-identity element inside the inbound section and includes the correct resource and client-id attributes is correct.
The correct configuration uses the authentication-managed-identity policy within the inbound section, specifying the target resource and the client-id of the user-assigned managed identity. This ensures API Management acquires the Azure AD token using the correct identity and attaches it to the inbound request before it is sent to the backend.

Step-by-Step Solution

1
Determine the correct policy section for backend authentication.
Identify that the authentication policy must be placed in the inbound section so that it executes before the request is dispatched to the backend service.
Placing the policy in the outbound section runs after the backend response has already been received, resulting in unauthenticated requests.
2
Specify the user-assigned managed identity configuration.
Include the client-id attribute with the target GUID value to ensure the policy uses the user-assigned managed identity instead of defaulting to the system-assigned managed identity.
Omitting the client-id attribute tells API Management to look for a system-assigned identity, which may not be enabled or permissioned.
3
Configure the target resource audience.
Set the resource attribute to the backend's App Registration URI or App ID URI.
The resource parameter defines the audience for the acquired Azure AD token.

Key Concept

Azure API Management Managed Identity Authentication Policies
Estimated Time:1m 30s
Question 776Question →

You are developing an ASP.NET Core Web API that must secure its endpoints using the Microsoft Identity Platform. The Web API will accept JWT access tokens sent by client applications in the HTTP Authorization header. You need to configure the Web API to validate these tokens using the `Microsoft.Identity.Web` library. Which two actions should you perform to complete the configuration? (Select two.)

Select all that apply

Show answer & explanation

Answer: In the `Program.cs` file, call `builder.Services.AddMicrosoftIdentityWebApi(builder.Configuration);` to register token validation services.; In the `appsettings.json` file, create an `AzureAd` configuration section containing the `Instance`, `Domain`, `TenantId`, and `ClientId` keys.

Answer

To configure the Web API to validate tokens using Microsoft.Identity.Web, you must call builder.Services.AddMicrosoftIdentityWebApi(builder.Configuration) in Program.cs and define the AzureAd configuration section in appsettings.json.
To secure an ASP.NET Core Web API using the Microsoft Identity Platform, you use the `Microsoft.Identity.Web` library. First, you configure the authentication middleware in the `Program.cs` file by calling `AddMicrosoftIdentityWebApi(builder.Configuration)`. Second, you provide the registration details under the `AzureAd` section in the `appsettings.json` file so the middleware knows which tenant and client ID to validate the tokens against.

Step-by-Step Solution

1
Configure the ASP.NET Core application's Program.cs to use Microsoft.Identity.Web services.
The authentication services are registered using the `AddMicrosoftIdentityWebApi` method.
This method configures the Web API to validate incoming JWT bearer tokens.
2
Add the connection parameters to the configuration file.
The application configuration has an `AzureAd` section with `Instance`, `Domain`, `TenantId`, and `ClientId` keys.
The library relies on these settings to obtain metadata and locate the authority for token validation.

Key Concept

Configuring token validation in an ASP.NET Core Web API using Microsoft.Identity.Web.
Question 777Question →

An IoT monitoring solution uses Azure Cache for Redis to store two types of data:

1. The latest telemetry reading for each device, which does not have an expiration time (TTL) set.
2. Temporary event logs that are configured with a Time-to-Live (TTL) of 24 hours.

Due to a surge in device activity, the cache is approaching its maximum memory limit. You need to configure the cache eviction policy so that under memory pressure, the cache removes the least recently used temporary event logs first, while ensuring that the device telemetry readings are never evicted.

Which eviction policy should you configure?

Show answer & explanation

Answer: volatile-lru

Answer

volatile-lru
The volatile-lru policy evicts the least recently used keys among those that have an expiration (TTL) set. Since the latest telemetry readings do not have a TTL, they are completely safe from eviction, while the expiring event logs will be removed as needed under memory pressure.

Step-by-Step Solution

1
Analyze the requirements for data retention and eviction behavior under memory pressure.
Temporary event logs have a TTL and can be evicted, while telemetry readings must never be evicted and do not have a TTL.
This establishes that we must use a volatile eviction policy (which only targets keys with an expiration set) rather than an allkeys policy.
2
Determine the specific eviction algorithm needed to remove the oldest or least recently used event logs first.
The Least Recently Used (LRU) algorithm matches the requirement of removing the least recently accessed keys first.
Combining the volatile scope with the LRU algorithm leads to the volatile-lru policy.

Key Concept

Azure Cache for Redis eviction policies control how keys are removed when the cache memory limit is reached. The volatile-lru policy targets only keys with an expiration (TTL) set, protecting keys without an expiration.
Estimated Time:1m 30s
Question 778Question →

An airline baggage tracking application uses an Azure Service Bus queue named `baggage-scans` to process scan events. You need to configure the queue and the receiver client to meet the following requirements:
1. Duplicate scan messages sent within a 10-minute window must be automatically discarded by the queue.
2. If a receiver application fails to process a scan event, the message must remain in the queue to be retried.
3. If processing a scan event fails 5 times, the message must be automatically routed to the dead-letter queue.

Which two configurations or actions should you implement? (Select two.)

Select all that apply

Show answer & explanation

Answer: Enable duplicate detection on the queue and set the duplicate detection history time window to 10 minutes.; Set the queue's maximum delivery count to 5 and receive messages using PeekLock mode.

Answer

To meet the requirements, you should enable duplicate detection on the queue with a 10-minute history time window, and configure the queue's maximum delivery count to 5 while using PeekLock mode in the receiver application.
Enabling duplicate detection with a 10-minute history window allows Azure Service Bus to drop duplicate messages sent within that time frame. Using PeekLock mode allows the system to retry processing if a failure occurs, and setting the maximum delivery count to 5 automatically dead-letters the message after 5 unsuccessful attempts.

Step-by-Step Solution

1
Configure duplicate detection.
Enable duplicate detection on the Service Bus queue and configure the duplicate detection history time window to 10 minutes.
This automatically filters out duplicate messages with the same MessageId within the specified window.
2
Select correct receive mode.
Configure the receiver client application to use PeekLock mode.
PeekLock receives messages in a two-stage operation, allowing retries if processing fails, unlike ReceiveAndDelete which deletes them immediately.
3
Configure delivery retry limit.
Set the queue's maximum delivery count to 5.
When PeekLock is used, Service Bus increments the delivery count each time a message is locked and not completed. Reaching the limit of 5 automatically routes the message to the dead-letter queue.

Key Concept

Azure Service Bus message reliability, duplicate detection, and receive modes
Question 779Question →

Your company is migrating an Azure App Service web application to a new security model. The web application must retrieve database connection strings stored as secrets in an Azure Key Vault. The Key Vault is configured to use the Azure role-based access control (Azure RBAC) authorization model. You need to configure the minimum permissions required for the web application's system-assigned managed identity to read the secrets. Which configuration should you apply?

Show answer & explanation

Answer: Assign the Key Vault Secrets User role to the system-assigned managed identity.

Answer

Assign the Key Vault Secrets User role to the system-assigned managed identity.
The correct answer is to assign the Key Vault Secrets User role to the system-assigned managed identity. Under the Azure RBAC authorization model, this specific role provides the minimum privilege necessary to read secret values (such as database connection strings) without granting administrative permissions to create or delete secrets. Furthermore, because the vault uses Azure RBAC, legacy access policies are disabled, and the Web App's existing system-assigned managed identity should be used directly rather than creating a new identity.

Step-by-Step Solution

1
Identify the active authorization model for the Azure Key Vault.
The Key Vault is configured for Azure RBAC, meaning classic Key Vault access policies are disabled and will not grant access.
Choosing the correct authorization mechanism is necessary to ensure permissions are successfully evaluated.
2
Determine the minimum privilege Azure RBAC role required to read secret values.
The Key Vault Secrets User role allows reading secret values, whereas Key Vault Reader only allows reading metadata.
Using the least privilege principle prevents over-assigning permissions while still enabling functionality.
3
Apply the role assignment to the appropriate identity.
The role is assigned directly to the App Service's existing system-assigned managed identity.
This utilizes the existing identity lifecycle without creating redundant resources.

Key Concept

Azure Key Vault RBAC permission model and built-in roles
Estimated Time:1m 30s
Question 780Question →

A developer is implementing the Cache-Aside pattern in an Azure App Service web application that retrieves user profile information from an Azure SQL Database. The application uses Azure Cache for Redis to improve read latency. You need to sequence the actions the application must perform when a user profile is requested and a cache miss occurs. Which sequence of actions should the application execute? Move all actions to the answer area and arrange them in the correct order.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The application must first request the user profile from the Azure Cache for Redis instance. Upon detecting a null response (cache miss), it queries the primary Azure SQL Database, stores the retrieved user profile back into the cache with a defined Time-To-Live (TTL), and finally returns the data to the client.
The correct sequence begins with checking the cache to see if the requested user profile data is already available. If a cache miss occurs, indicated by a null response, the application must query the authoritative Azure SQL Database. Once the database returns the profile, the application writes that data back to the cache with an appropriate TTL so that future reads will hit the cache. Finally, the user profile is returned to the client.

Step-by-Step Solution

1
Check the cache using the target key.
A null or empty response is returned, indicating a cache miss.
Checking the cache first prevents unnecessary load on the backend database.
2
Query the primary database.
The requested user profile is retrieved from the database.
The database is the system of record and holds the data when a cache miss occurs.
3
Write the data to the cache.
The cache is populated with the profile data and an associated TTL.
Populating the cache on read-miss is the core mechanism of the Cache-Aside pattern to optimize subsequent requests.
4
Return the user profile data.
The requesting client receives the data.
This completes the lifecycle of the client request.

Key Concept

Cache-Aside pattern execution flow for read operations under a cache miss scenario
PreviousPage 39 / 49Next
All practice questions — Microsoft Azure Developer (AZ-204) | Examkin