All practice questions
972 questions
A development team is building a native C# client application that runs on domain-joined user workstations. The application needs to request an access token from the Microsoft Identity Platform to query a secure downstream Web API. The solution must support user accounts from any Microsoft Entra ID tenant as well as personal Microsoft accounts. Which approach should the team use to initialize the client application and configure authentication?
An enterprise client communicates with an API hosted in Azure API Management (APIM). You must implement two security requirements:
1. Validate that the client presents a client certificate containing an authorized thumbprint.
2. Accept the subscription key in a custom HTTP header named `X-API-Signature` instead of the default header.
Which two configuration actions should you perform to meet these requirements?
Select all that apply
Complete the C# code below to define a custom telemetry processor that filters out successful dependency telemetry and register it within the ASP.NET Core dependency injection container.
Fill in the blanks below
{
private ITelemetryProcessor Next { get; set; }
public DependencyFilter(ITelemetryProcessor next)
{
this.Next = next;
}
public void Process(ITelemetry item)
{
if (item is DependencyTelemetry dependency && dependency.Success == true)
{
return; // Filter out
}
this.Next.Process(item);
}
}
// In Program.cs:
var builder = WebApplication.CreateBuilder(args);
builder.Services.AddApplicationInsightsTelemetry();
builder.Services.<DependencyFilter>();
An organization operates a logistics portal where external partner drivers submit location updates. You are configuring an Azure Queue Storage queue named `fleet-updates` to receive these updates. You need to provide the partner application with a Shared Access Signature (SAS) token that allows it to submit new location update messages. The partner application must not be able to view, modify, or delete any other messages in the queue. Which queue permission should you assign to the SAS token to meet this requirement?
You are developing a C# .NET 8 Azure Function in an isolated worker process. You configure custom telemetry tracking in the function app using Dependency Injection in the `Program.cs` file. However, during runtime, you find that custom telemetry generated via `TelemetryClient` is not being sent to Azure Monitor because the connection string is missing or not bound correctly in the SDK setup.
You have the following code in your `Program.cs` file:
csharp
var host = new HostBuilder()
.ConfigureFunctionsWorkerDefaults()
.ConfigureServices((context, services) =>
{
services.AddApplicationInsightsTelemetryWorkerService(options =>
{
// Line X
});
})
.Build();
await host.RunAsync();
Which of the following lines of code should you insert at `Line X` to correctly bind the connection string from configuration?
You are securing a backend API by routing requests through Azure API Management (APIM). The backend API is secured using Microsoft Entra ID and requires authentication. You need to configure APIM to authenticate to the backend API using the APIM instance's system-assigned managed identity.
Which policy configuration should you apply to meet this requirement?
<base />
<authentication-managed-identity resource="api://mybackend" />
</inbound>
<base />
<authentication-managed-identity resource="api://mybackend" client-id="00000000-0000-0000-0000-000000000000" />
</inbound>
<base />
<authentication-managed-identity resource="api://mybackend" />
</outbound>
<base />
<set-header name="Authorization" exists-action="override">
<value>@("Bearer " + "{{keyvault-token}}")</value>
</set-header>
</inbound>
You are developing an ASP.NET Core web API hosted on Azure App Service (Linux). You need to configure the Application Insights SDK programmatically to send custom telemetry. You retrieve the connection string from Azure App Configuration. Additionally, you have implemented a custom telemetry initializer named `RegionTelemetryInitializer` to enrich all telemetry items with a `DeploymentRegion` property.
Which of the following configurations are required in the `Program.cs` file to ensure that custom telemetry is collected and properly enriched? (Select TWO)
Select all that apply
You are securing an API hosted in Azure API Management (APIM). The security requirements specify that:
1. The API must only accept requests from a partner's public IP address: 203.0.113.50.
2. The APIM gateway must retrieve a shared secret stored in Azure Key Vault to authenticate the request against a legacy backend service.
You configure a system-assigned managed identity for the APIM instance. Which of the following actions must you perform to successfully implement this configuration? Select two.
Select all that apply
You are developing a C# background service that runs on an Azure Virtual Machine and processes data files. The service needs to authenticate to an Azure Queue Storage queue named tasks-queue and enqueue processing tasks. Some task payloads are estimated to be around in size. You must ensure that the solution adheres to the principle of least privilege, uses passwordless authentication where possible, and handles the task payloads successfully.
Which of the following designs should you implement?
An organization is securing a backend REST API by routing requests through Azure API Management (APIM). The backend API requires an API key in the request header for authorization. You store this API key as a secret in Azure Key Vault.
You need to configure APIM to retrieve this secret from Key Vault using a user-assigned managed identity named `apim-kv-identity`. You have already associated the user-assigned identity with the APIM instance.
Which configuration should you implement to retrieve the secret and pass it to the backend service?
You are developing an audit utility in C# that processes messages in an Azure Queue Storage queue named inventory-audit. The utility must read the content of up to 10 messages to log their metadata, but it must not lock the messages or make them invisible to other processing services. You are using the Azure.Storage.Queues SDK. Complete the code snippet below using explicit typing (do not use var) to retrieve the messages. Which code segments should you use to fill in the blanks?
Fill in the blanks below
// Inspect up to 10 messages without changing their visibility
[] messages = (await queueClient.(maxMessages: 10)).Value;
You are configuring a secure architecture where an Azure API Management (APIM) instance gateway forwards client requests to a backend API hosted on an Azure App Service. The backend App Service is configured to require Microsoft Entra ID authentication and expects an OAuth token. You want to authenticate the APIM instance to the backend App Service using its system-assigned managed identity. Which two actions should you perform? (Choose two.)
Select all that apply
You are designing a telemetry ingestion service that uses Azure Queue Storage to buffer patient monitoring logs. The data payload for each log entry varies, with some message payloads reaching up to . When these larger payloads are sent to the queue, the client application throws an exception. Which strategy should you implement to resolve this exception?
A company requires that all requests routed from Azure API Management (APIM) to a backend Azure App Service be authenticated using Microsoft Entra ID. You create a user-assigned managed identity named `apim-backend-identity` and link it to the APIM instance. You must configure the APIM policy so that it automatically requests an OAuth token using the user-assigned identity and includes it in requests to the backend service. How should you configure the APIM policy?
A developer needs to secure an API hosted in Azure API Management (APIM) by validating JSON Web Tokens (JWT) issued by Microsoft Entra ID. The validation process must ensure that the token signature is verified against Microsoft Entra ID's keys, and that expired or unauthorized requests are rejected before reaching the backend. Which two configuration steps should the developer perform? (Select TWO.)
Select all that apply
You are developing a C# background service that processes large report generation requests from an Azure Queue Storage queue named report-jobs. Each report request payload can occasionally reach 150 KB in size. The background service takes up to 10 minutes to compile and upload each report. You must ensure that messages are successfully processed without exceeding Azure Queue Storage limits and that other instances of the background service do not attempt to process the same message concurrently. Which two actions should you perform? (Select two.)
Select all that apply
You are securing an Azure API Management (APIM) gateway endpoint. The security requirements specify that all client applications must authenticate using client certificates, and the APIM gateway must validate that the certificate is not expired and is issued by a specific Certificate Authority (CA).
Which configuration and policy implementation should you use to meet these requirements?
You are designing a web application that allows users to upload profile pictures. After a user uploads an image, the application needs to add a processing message to an Azure Queue Storage queue. The message must contain the user's metadata and a reference to the image. Which of the following approaches should you use to implement this queue solution securely and efficiently while staying within Azure Queue Storage limits?
An organization is deploying an API to Azure API Management (APIM). The security requirements specify that all client applications must authenticate using mutual TLS (client certificates) at the APIM gateway. You need to configure APIM to receive and validate the client certificates. Which two actions should you perform?
Select all that apply
You are securing an API hosted in Azure API Management (APIM). The security requirements specify that clients must authenticate using client certificates. The allowed certificate thumbprint is stored as a secret in Azure Key Vault.
You configure a system-assigned managed identity for the APIM instance.
You create a Named Value in APIM named `CertThumbprint` that references the Key Vault secret. You then add an inbound policy to validate the client certificate thumbprint against the `CertThumbprint` named value.
During testing, requests fail with an HTTP 500 Internal Server Error. The diagnostic logs indicate that APIM is unauthorized to retrieve the secret value from Key Vault.
Which of the following actions will resolve this issue?