All practice questions
972 questions
You are developing a C# application using the Azure.Storage.Blobs SDK (v12). The application must perform a concurrency-safe update to an existing blob named `configuration.json` by acquiring a 30-second exclusive-write lease, uploading the new content, and then immediately releasing the lease.
How should you order the developer's actions to achieve this workflow?
Drag items to arrange them in the correct order
You are developing a C# application that manages document archiving using the Azure.Storage.Blobs SDK (version 12). You write the following helper method to process and archive blobs:
csharp
public static async Task ArchiveBlobAsync(BlobClient blobClient, string user)
{
// Retrieve existing properties
BlobProperties properties = (await blobClient.GetPropertiesAsync()).Value;
// Check if the blob has a classification
if (properties.Metadata.ContainsKey("Classification"))
{
Console.WriteLine($"Classification: {properties.Metadata[\"Classification\"]}");
}
// Add the archival metadata
var metadata = new Dictionary<string, string>
{
{ "ArchivedBy", user }
};
await blobClient.SetMetadataAsync(metadata);
// Transition the blob to the Cool tier
await blobClient.SetAccessTierAsync(AccessTier.Cool);
}
Which of the following statements regarding the behavior or issues in this code are correct? (Select TWO)
Select all that apply
You are developing a secure C# .NET console application that uses the `Azure.Security.KeyVault.Certificates` SDK. The application must provision a new SSL/TLS certificate inside Azure Key Vault. Your organization requires that the certificate be signed by an internal corporate Certificate Authority (CA) that is not integrated with Azure Key Vault. You need to complete the process of generating the certificate while keeping the private key secure within the key vault. Arrange the steps in the correct order to configure, sign, and complete the certificate creation process.
Drag items to arrange them in the correct order
You are configuring a canary deployment for an Azure Container App named `web-shop`. The application is configured to run multiple active revisions. You have deployed a new revision named `web-shop--v2`, and the existing revision is named `web-shop--v1`.
You need to configure the HTTP ingress of the Container App to route of the incoming traffic to `web-shop--v1` and the remaining to `web-shop--v2`.
Which configuration block should you include under the `properties.configuration.ingress` section of the Container App Bicep template?
{
revisionName: 'web-shop--v1'
weight: 80
}
{
revisionName: 'web-shop--v2'
weight: 20
}
]
{
revision: 'web-shop--v1'
percent: 80
}
{
revision: 'web-shop--v2'
percent: 20
}
]
{
revisionName: 'web-shop--v1'
weight: '80%'
}
{
revisionName: 'web-shop--v2'
weight: '20%'
}
]
type: 'SystemAssigned'
}
traffic: [
{
revisionName: 'web-shop--v1'
weight: 80
}
{
revisionName: 'web-shop--v2'
weight: 20
}
]
You are developing a C# backend application that uses the Azure.Storage.Blobs SDK (v12) to manage resources in Azure Blob Storage. A blob contains custom metadata with a key named `ProjectOwner`.
You retrieve the properties of the blob using the following code:
csharp
BlobProperties properties = (await blobClient.GetPropertiesAsync()).Value;
Which code segment should you use to retrieve the value of the `ProjectOwner` custom metadata key?
An enterprise application requires Azure API Management (APIM) to forward client requests to a backend web API that is secured via Microsoft Entra ID. The backend web API expects tokens containing the audience claim https://backend.contoso.com. To facilitate cross-environment deployments, you create a user-assigned managed identity named apim-identity and associate it with your APIM instance. You need to configure APIM to authenticate using this specific identity when calling the backend. Which configuration should you apply to the APIM policy?
An organization is transitioning its Azure resources to use Azure Role-Based Access Control (RBAC) instead of Key Vault access policies. A developer needs to ensure that an Azure Web App can retrieve secrets from a Key Vault named kv-prod using its system-assigned managed identity.
Which configuration change must be performed to allow the Web App to retrieve the secrets?
You are developing a secure client-side Single Page Application (SPA) named OrderClient and a backend Web API named OrderProcessor. The OrderClient application must make HTTP requests to OrderProcessor to retrieve order history on behalf of the currently signed-in user. You need to configure the Microsoft Entra ID app registrations for both applications to secure the API calls using OAuth 2.0. Which of the following configurations should you implement?
You are developing a C# backend service that manages delivery truck configurations using the Azure Cosmos DB .NET SDK v3. The container is configured with Session consistency and uses `/fleetId` as the partition key path.
The application runs on multiple independent Azure App Service instances behind a load balancer. You need to implement a workflow where one instance updates a truck configuration (with `id` of `truck-99` and `fleetId` of `fleet-west`) and another instance immediately reads the updated configuration, guaranteeing a read-your-writes level of consistency.
Which code snippet should you use?
await container.ReplaceItemAsync<TruckConfig>(
updatedConfig,
"truck-99",
new PartitionKey("fleet-west")
);
// Instance 2: Read the configuration without passing a session token
ItemResponse<TruckConfig> readResponse = await container.ReadItemAsync<TruckConfig>(
"truck-99",
new PartitionKey("fleet-west")
);
ItemResponse<TruckConfig> writeResponse = await container.ReplaceItemAsync<TruckConfig>(
updatedConfig,
"truck-99",
new PartitionKey("fleet-west")
);
string token = writeResponse.Headers.Session;
// Instance 2: Read the configuration using the session token
ItemResponse<TruckConfig> readResponse = await container.ReadItemAsync<TruckConfig>(
"truck-99",
new PartitionKey("fleet-west"),
new ItemRequestOptions { SessionToken = token }
);
ItemResponse<TruckConfig> writeResponse = await container.ReplaceItemAsync<TruckConfig>(
updatedConfig,
"truck-99",
new PartitionKey("Active")
);
string token = writeResponse.Headers.Session;
// Instance 2: Read the configuration using the status as the partition key
ItemResponse<TruckConfig> readResponse = await container.ReadItemAsync<TruckConfig>(
"truck-99",
new PartitionKey("Active"),
new ItemRequestOptions { SessionToken = token }
);
ItemResponse<TruckConfig> writeResponse = await container.ReplaceItemAsync<TruckConfig>(
updatedConfig,
"truck-99",
new PartitionKey("fleet-west")
);
string token = writeResponse.Headers.Session;
// Instance 2: Attempt to pass the partition key inside the request options
ItemResponse<TruckConfig> readResponse = await container.ReadItemAsync<TruckConfig>(
"truck-99",
null,
new ItemRequestOptions { SessionToken = token, PartitionKey = new PartitionKey("fleet-west") }
);
You are configuring a Bicep template to deploy an Azure Container App named `order-processor`. The application needs to connect to a database using a connection string that is stored as a secret in Azure Key Vault. The connection string must be exposed to the container as an environment variable named `DB_CONNECTION`. Which of the following configuration steps must you perform in the Bicep template to meet these requirements? (Select TWO.)
Select all that apply
You need to configure an Azure App Service web app to retrieve configuration settings from an Azure App Configuration store. The solution must use a user-assigned managed identity.
Which sequence of actions should you perform? Arrange the actions in the correct order from first to last.
Drag items to arrange them in the correct order
You manage a memory-intensive web application named PatientPortalAPI that is currently hosted on a Shared (D1) App Service plan. During peak usage hours, the application experiences memory spikes exceeding 75%, causing it to become unresponsive. You must configure the application to dynamically scale out by adding instances when memory usage exceeds 75%, and automatically scale in when the load subsides. Which of the following actions should you perform to meet these requirements?
You are developing a web application that will be hosted on an on-premises web server. The application must programmatically retrieve database connection strings stored as secrets in an Azure Key Vault.
You need to configure the security and authentication requirements to allow the application to access the secrets.
Which of the following actions should you perform?
You are developing a data synchronization solution using Azure Durable Functions. The solution must implement the Monitor pattern to periodically poll the status of an external import process until it finishes.
Arrange the steps in the correct chronological order of execution for a single complete loop of the monitoring workflow, starting from the client request.
Drag items to arrange them in the correct order
You are developing a C# application that runs on an Azure Virtual Machine (VM). The application uses the Azure.Identity library to authenticate to an Azure Key Vault using DefaultAzureCredential. Both a system-assigned managed identity and a user-assigned managed identity are enabled on the VM. The user-assigned managed identity is granted the Key Vault Secrets User role on the Key Vault, but the system-assigned managed identity has no permissions. When the application runs, it fails to retrieve secrets because DefaultAzureCredential attempts to authenticate using the system-assigned managed identity. You need to configure the environment so that DefaultAzureCredential uses the user-assigned managed identity without modifying the code that instantiates DefaultAzureCredential. Which of the following actions should you perform?
You are hosting an ASP.NET Core web application in an Azure App Service. The application requires a database connection string stored as a secret named db-conn in an Azure Key Vault named prod-kv. You create a user-assigned managed identity named app-identity and associate it with the App Service. In prod-kv, you grant the Key Vault Secrets User role to app-identity using Azure RBAC. In the App Service configuration, you add an application setting named ConnectionStrings__DefaultConnection with the value @Microsoft.KeyVault(SecretUri=https://prod-kv.vault.azure.net/secrets/db-conn/). However, the App Service fails to resolve the Key Vault reference at runtime and the application cannot retrieve the database connection string. Which of the following actions should you take to resolve this issue?
You are developing a C# backend service that manages customer order logs using the Azure Cosmos DB .NET SDK v3. The Cosmos DB container uses Session consistency and is partitioned by the customer's identifier (/customerId). A different client session has just created a new order log item with the ID "order-789" for the customer "customer-101". Your service must perform a point read to retrieve this new log item immediately, ensuring it reads the latest write. Which C# code segment should you use?
ItemRequestOptions options = new ItemRequestOptions { SessionToken = sessionToken };
ItemResponse<OrderLog> response = await container.ReadItemAsync<OrderLog>("order-789", new PartitionKey("customer-101"), options);
ItemRequestOptions options = new ItemRequestOptions { SessionToken = sessionToken };
ItemResponse<OrderLog> response = await container.ReadItemAsync<OrderLog>("order-789", new PartitionKey("completed"), options);
ItemRequestOptions options = new ItemRequestOptions { SessionToken = sessionToken };
ItemResponse<OrderLog> response = await container.ReadItemAsync<OrderLog>("order-789", PartitionKey.None, options);
You are transitioning a .NET web application hosted on an Azure App Service named `web-prod` from using a system-assigned managed identity to a new user-assigned managed identity named `id-prod`. The application retrieves secrets from an Azure Key Vault named `kv-prod` using the `DefaultAzureCredential` class. The system-assigned identity must remain temporarily enabled during the migration to prevent configuration issues, but the application must immediately begin using the new user-assigned identity to authenticate. You need to configure the resource association and access permissions using the Azure CLI, and update the application configuration. Arrange the steps in the correct order to achieve this transition while preventing application authorization errors during the configuration process.
Drag items to arrange them in the correct order
An enterprise application requires copying a blob named `archive.zip` from a source storage account to a destination storage account. The destination blob already exists and is locked with an active, exclusive-write lease. The application must perform the copy operation asynchronously and overwrite the destination blob without breaking or releasing the existing lease. You have retrieved the destination blob's lease ID: `d3b07384-d113-4c4e-a51a-7b2c0f209176`.
Which C# code snippet should you run to perform the copy operation?
{
SourceConditions = new BlobRequestConditions
{
LeaseId = "d3b07384-d113-4c4e-a51a-7b2c0f209176"
}
};
await destBlobClient.StartCopyFromUriAsync(sourceUri, options);
{
DestinationConditions = new BlobRequestConditions
{
LeaseId = "d3b07384-d113-4c4e-a51a-7b2c0f209176"
}
};
await destBlobClient.StartCopyFromUriAsync(sourceUri, options);
await leaseClient.StartCopyFromUriAsync(sourceUri);
await destBlobClient.StartCopyFromUriAsync(sourceSasUri);
You are designing the security architecture for an enterprise Azure Function app that processes financial transactions. The app requires access to an Azure SQL Database and retrieves cryptographic keys from an Azure Key Vault. Due to strict CI/CD and compliance policies, the Function app is frequently torn down and recreated in different resource groups using automated Terraform scripts. You need to choose a managed identity configuration that ensures the application can authenticate to Azure SQL and Key Vault with the least administrative effort during deployment cycles, specifically avoiding the need to recreate database users or update Key Vault access policies after each deployment.
Which configuration should you implement?