Examkin

All practice questions

171 questions

All types972Multiple choice497Multiple select269Matching9Ordering171Fill in the blank26
Question 121Question →

You are developing a solution that uses Azure Event Grid to route system events from an Event Grid custom topic to a Webhook. You must ensure that any events that cannot be delivered are routed to a container named "deadletters" in an Azure Storage account named "mystorage2026". The solution must secure access to the storage account by using a system-assigned managed identity associated with the custom topic. Which four actions should you perform in sequence? To answer, arrange the actions in the correct order.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

To configure Event Grid dead-lettering using a system-assigned managed identity, you must first enable the system-assigned managed identity on the Event Grid custom topic. Next, assign the Storage Blob Data Contributor role to the custom topic's managed identity at the scope of the destination storage account. Then, create the Event Grid event subscription with dead-lettering configured to the target blob container. Finally, configure the event subscription's dead-letter identity settings to use the System Assigned identity type.
First, the system-assigned identity must be enabled on the Event Grid custom topic so that an identity object is registered in Microsoft Entra ID. Second, the newly created identity must be granted the Storage Blob Data Contributor role on the storage account so it has permission to write logs. Third, the event subscription must be created with dead-lettering enabled pointing to the destination container. Finally, the event subscription's dead-letter identity setting must be configured to use the System Assigned identity to route requests securely.

Step-by-Step Solution

1
Enable the system-assigned managed identity for the Event Grid custom topic.
A system-assigned identity is created in Microsoft Entra ID for the custom topic, yielding an identity principal.
You must create the managed identity principal before you can assign RBAC roles to it or use it for authentication.
2
Assign the Storage Blob Data Contributor role to the custom topic's managed identity on the storage account.
The identity principal is granted write permissions on the Azure Storage account.
Event Grid needs the Storage Blob Data Contributor role to write undelivered events to the dead-letter blob container.
3
Create the Event Grid event subscription and specify the dead-letter endpoint pointing to the deadletters blob container.
The event subscription is created with the specified active event destination and dead-letter destination.
This establishes the event delivery routing rules and designates the fallback container for failed events.
4
Configure the event subscription's dead-letter identity settings to use the System Assigned identity type.
The subscription is configured to authenticate write requests to the dead-letter storage account using the custom topic's system-assigned identity.
By default, Event Grid uses SAS tokens to write to the dead-letter container. To use the managed identity, you must explicitly configure the identity settings on the subscription.

Key Concept

Configuring Event Grid dead-lettering with managed identities
Question 122Question →

You are developing a C# console application that updates the metadata of a block blob in Azure Blob Storage. The application uses the Azure.Storage.Blobs SDK (version 12). To prevent other processes from modifying the blob during the update, you must acquire a write lease on the blob, perform the metadata update, and then release the lease.

Which five actions should you perform in sequence? To answer, arrange the actions in the correct order.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

To perform a leased metadata update, you first instantiate a BlobClient, then create a BlobLeaseClient from it, acquire the lease, call SetMetadataAsync using a BlobRequestConditions containing the lease ID, and finally call ReleaseAsync to release the lease.
The correct sequence starts with instantiating a BlobClient to reference the blob. Next, a BlobLeaseClient is created from the BlobClient. The lease is then acquired using AcquireAsync. Once the lease is active, SetMetadataAsync is called with BlobRequestConditions containing the lease ID. Finally, the lease is released using ReleaseAsync.

Step-by-Step Solution

1
Create a BlobClient instance.
Establishes a programmatic reference to the target blob.
Required to create the BlobLeaseClient and perform operations.
2
Instantiate a BlobLeaseClient using the BlobClient.
Creates a client capable of managing leases on the target blob.
Leases cannot be managed directly through the standard BlobClient.
3
Invoke AcquireAsync on the BlobLeaseClient.
Secures an exclusive write lock (lease) on the blob and returns a lease ID.
Prevents concurrent write operations from other clients.
4
Call SetMetadataAsync on the BlobClient, passing the metadata dictionary and a BlobRequestConditions object containing the lease ID.
Applies the metadata updates to the blob.
Because the blob is leased, any write operation must supply the active lease ID to succeed.
5
Invoke ReleaseAsync on the BlobLeaseClient.
Unlocks the blob, allowing subsequent access by other processes.
Ensures the resource is not locked indefinitely.

Key Concept

Acquiring a write lease, updating blob metadata with request conditions, and releasing the lease using the Azure SDK for .NET.
Question 123Question →

You are developing a C# background service that processes real-time transaction updates from an Azure Cosmos DB container using the .NET SDK v3 Change Feed Processor.

You need to initialize and run the Change Feed Processor.

In which order should you execute the steps? To answer, move all actions from the list of actions to the answer area and arrange them in the correct order.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence of steps to initialize and start the Change Feed Processor is: 1) Obtain container references; 2) Call GetChangeFeedProcessorBuilder on the monitored container; 3) Chain configuration methods; 4) Call Build to create the processor instance; and 5) Call StartAsync to start processing notifications.
To configure the Change Feed Processor, you first get references to both containers. Then, you call `GetChangeFeedProcessorBuilder` on the monitored container. Next, you configure it by chaining configuration options like the lease container and host instance name. After configuration, you build the processor, and finally, you call `StartAsync` to begin receiving change notifications.

Step-by-Step Solution

1
Obtain container references
References to the monitored and lease containers are available.
Both container references are required during the builder configuration process.
2
Initialize the builder
A ChangeFeedProcessorBuilder instance is created.
The builder must be obtained from the monitored container reference while specifying the processor name and delegate.
3
Configure the builder
Lease container and instance name settings are applied to the builder.
These settings are required for the processor to manage leases and identify individual processor hosts.
4
Build the processor
A ChangeFeedProcessor instance is created.
The Build method consumes the configuration and instantiates the processor class.
5
Start the processor
The Change Feed Processor begins listening and processing updates.
StartAsync is needed to trigger the lease acquisition and start the change feed polling loop.

Key Concept

Initializing the Azure Cosmos DB Change Feed Processor using the .NET SDK v3.
Question 124Question →

You are deploying an ASP.NET Core web application to an Azure App Service. The application must securely retrieve a database password stored as a secret in Azure Key Vault. You decide to use a system-assigned managed identity and Key Vault references to configure the application.

Which sequence of steps should you perform to configure the Azure resources and the App Service to resolve the secret?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct order of steps is: 1) Enable the system-assigned managed identity on the Azure App Service instance. 2) Assign the Key Vault Secrets User role to the App Service's managed identity on the Azure Key Vault. 3) Retrieve the Secret Identifier (URI) of the database password secret from the Key Vault. 4) Add a new application setting in the App Service with a value formatted as @Microsoft.KeyVault(SecretUri=...).
The correct order establishes the security identity first, then applies the necessary Key Vault role permissions to it, retrieves the required secret identifier, and finally sets up the application configuration using the Key Vault reference syntax.

Step-by-Step Solution

1
Enable the system-assigned managed identity on the Azure App Service instance.
A service principal representing the App Service is created in Microsoft Entra ID.
This establishes the identity that will be authorized to access the Key Vault.
2
Assign the Key Vault Secrets User role to the App Service's managed identity on the Key Vault.
The App Service's identity is authorized to read secrets from the Key Vault.
Permissions must be configured in advance so that the App Service can resolve the secret reference as soon as it is configured.
3
Retrieve the Secret Identifier (URI) of the secret from the Key Vault.
The target secret's URI is copied.
The URI is required to construct the Key Vault reference syntax used in the App Service configuration.
4
Add a new application setting to the App Service using the @Microsoft.KeyVault(SecretUri=...) syntax.
The Key Vault reference is saved to the App Service settings.
The App Service runtime automatically detects this setting pattern, resolves the reference using the managed identity, and exposes the decrypted secret to the application code.

Key Concept

To securely reference Azure Key Vault secrets from App Service without code changes, you must enable a managed identity on the app, grant it the Key Vault Secrets User role on the Key Vault, and configure the app setting using the @Microsoft.KeyVault(SecretUri=...) syntax.
Question 125Question →

You are developing a .NET application that will write data to a newly provisioned Azure Cache for Redis instance. You need to connect to the cache and write a test key-value pair using the StackExchange.Redis library. Which sequence of steps should you perform? To answer, arrange the actions in the correct order.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

To connect to and write to Azure Cache for Redis using StackExchange.Redis, you must first add the StackExchange.Redis package to your project. Next, retrieve the connection string from the Azure portal. Third, initialize the ConnectionMultiplexer object by calling ConnectionMultiplexer.Connect. Fourth, get a database reference using the GetDatabase method. Finally, perform the write operation by calling StringSet.
Interacting with Azure Cache for Redis starts by installing the required StackExchange.Redis SDK package to make developer APIs available. Once installed, the application requires credentials, which are retrieved as a connection string from the Azure portal. Using this connection string, a ConnectionMultiplexer object is instantiated via ConnectionMultiplexer.Connect. This handles network socket multiplexing and configuration. A database instance is then obtained by calling GetDatabase, which provides the necessary context for commands. Finally, key-value operations like StringSet are executed on this database instance.

Step-by-Step Solution

1
Install NuGet package
The project gains access to the StackExchange.Redis namespaces and types.
The client library provides the necessary API for communicating with Redis.
2
Obtain connection credentials
The target host name, ports, and authorization keys are copied.
The connection credentials are required to authenticate client traffic.
3
Initialize ConnectionMultiplexer
The client establishes a long-lived socket connection to the server.
The ConnectionMultiplexer represents the shared gateway through which database operations flow.
4
Request Database reference
An IDatabase instance is returned.
Standard key-value commands are exposed through the IDatabase interface.
5
Call StringSet
The database registers the key and value.
StringSet stores the specified key and associated string value in the cache.

Key Concept

Connecting to and interacting with Azure Cache for Redis via StackExchange.Redis in a .NET application.
Question 126Question →

You need to enable Microsoft Entra ID (formerly Azure Active Directory) authentication for the developer portal of an existing Azure API Management (APIM) instance. Which sequence of actions should you perform to complete the configuration? To answer, drag all actions from the list of actions to the answer area and arrange them in the correct order.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

Register the application in Microsoft Entra ID with the redirect URI, generate a client secret, navigate to the Identities blade in the API Management resource, add Microsoft Entra ID as an identity provider with the application details, and publish the Developer Portal.
To enable Microsoft Entra ID authentication for the developer portal, you must first register an application in Microsoft Entra ID to obtain the Client ID and set up a client secret. This allows secure integration between API Management and Entra ID. Next, you navigate to the Identities blade under the Developer portal section of the API Management instance in the Azure portal and configure the Microsoft Entra ID identity provider using the registered credentials. Finally, the developer portal must be published for the sign-in option to become active and visible to users.

Step-by-Step Solution

1
Register the application in Microsoft Entra ID
An application registration is created with a Redirect URI matching the developer portal's callback endpoint.
Microsoft Entra ID needs to know about the developer portal app to authenticate users and redirect them back securely.
2
Generate a client secret
A client secret value is generated for the registered application.
API Management requires a credential (client secret) to securely establish a trust relationship and communicate with Microsoft Entra ID.
3
Navigate to Identities in API Management
The Identities configuration panel for the developer portal is opened in the Azure portal.
This is the location where identity providers for the developer portal are managed.
4
Add and configure Microsoft Entra ID provider
The identity provider configuration is saved with the Client ID, Tenant ID, and Client Secret.
This registers Microsoft Entra ID as an active authentication option for developer portal users.
5
Publish the Developer Portal
The developer portal is rebuilt and redeployed to its hosting endpoint.
Developer portal customizations, including changes to identity providers, do not take effect for users until the portal is published.

Key Concept

Configuring identity providers and authentication for the Azure API Management developer portal.
Question 127Question →

You are developing a C# background service to process telemetry data from an Azure Event Hub. The service must use the EventProcessorClient to consume events, manage partition ownership, and store checkpoints in Azure Blob Storage.

What is the correct sequence of steps to initialize, run, and terminate the EventProcessorClient lifecycle?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence of steps is: 1) Instantiate a BlobContainerClient pointing to the Azure Storage account container designated for checkpointing. 2) Instantiate the EventProcessorClient using the BlobContainerClient, consumer group, namespace connection string, and Event Hub name. 3) Register callback methods for the ProcessEventAsync and ProcessErrorAsync event handlers on the processor client. 4) Invoke the StartProcessingAsync method on the EventProcessorClient. 5) Invoke the StopProcessingAsync method on the EventProcessorClient when the application shuts down.
The lifecycle of the EventProcessorClient requires a storage container to coordinate work across multiple processor instances. Therefore, the BlobContainerClient must be instantiated first, followed by the EventProcessorClient itself. Before starting the processor client, you must register handlers for event and error processing. Once registered, StartProcessingAsync starts the ingestion and processing loop, and StopProcessingAsync stops it gracefully during application shutdown.

Step-by-Step Solution

1
Instantiate the BlobContainerClient.
A BlobContainerClient instance is ready, pointing to the designated checkpoint container.
The EventProcessorClient requires an active BlobContainerClient during its instantiation to coordinate partition ownership and checkpoints.
2
Instantiate the EventProcessorClient.
An EventProcessorClient instance is created with the necessary Storage and Event Hub configuration.
The client must be instantiated with credentials, consumer group name, and the BlobContainerClient before registration of handlers.
3
Register ProcessEventAsync and ProcessErrorAsync delegates.
Event and error processing logic is linked to the client's event handlers.
The .NET SDK requires event and error handlers to be explicitly registered before processing starts to prevent runtime exceptions.
4
Invoke StartProcessingAsync.
The background thread begins execution, partition leases are acquired, and events start flowing.
This starts the consuming loop asynchronously in the background.
5
Invoke StopProcessingAsync.
The processor stops reading events and cleanly releases its storage lease blobs.
Gracefully stopping the client allows other processing instances to immediately assume ownership of the partitions without waiting for lease expirations.

Key Concept

EventProcessorClient Lifecycle and Azure Blob Storage Checkpointing in .NET SDK
Question 128Question →

A developer is writing a service in C# that moves large backup files from a public container to a secure archival container in a different Azure Storage account using the Azure.Storage.Blobs SDK (version 12.x). The operation must execute asynchronously and log a message once the file transfer completes successfully. Place the steps in the correct order to programmatically copy the blob and monitor the progress of the copy operation.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

To perform an asynchronous copy operation and monitor it using the Azure.Storage.Blobs SDK, first instantiate the BlobContainerClient for the destination container. Second, retrieve the target BlobClient from that container. Third, call StartCopyFromUriAsync on the destination client with the source SAS URI. Fourth, call GetPropertiesAsync to fetch the current state. Finally, poll the CopyStatus in a loop until it is no longer Pending.
The correct sequence begins with initializing the container client, followed by getting the specific blob client. Next, the copy is triggered from the destination blob client pointing to the source URI. Finally, the status is monitored by fetching the destination blob properties and polling until the copy status leaves the pending state.

Step-by-Step Solution

1
Instantiate the BlobContainerClient.
Establishes connection capabilities to the target container.
You must have a container client reference to acquire a reference to a specific blob in that container.
2
Retrieve the destination BlobClient.
Provides a client reference for the specific blob to be created or overwritten by the copy operation.
Copy operations are initiated on the destination blob client directly.
3
Call StartCopyFromUriAsync using the source URI.
Triggers the asynchronous copy operation on the Azure side, returning a copy ID.
The destination blob must pull the data from the source URI using the Storage service copy engine.
4
Call GetPropertiesAsync on the destination client.
Populates the BlobProperties object containing the CopyStatus.
You need to retrieve the latest state from Azure to check if the operation has already completed or is still running.
5
Check the CopyStatus value and poll in a loop.
Ensures the application waits for the operation to resolve to Success, Failed, or Aborted.
Because copying is asynchronous, the copy status must be checked iteratively until it is no longer pending.

Key Concept

Using Azure.Storage.Blobs SDK to copy blobs asynchronously from a source URI and monitor the copy status.
Question 129Question →

You are developing a background service in C# that uses the .NET Azure.Storage.Blobs SDK to migrate public assets to a secure container. You need to copy a blob named video.mp4 from a public source container to a destination container in your storage account. The copy operation must run asynchronously, and the service must monitor the progress until it is fully completed.

Arrange the steps in the correct order to perform the copy and monitor its status.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

First, instantiate the BlobServiceClient. Next, retrieve the destination BlobContainerClient and get a reference to the destination BlobClient. Then, call StartCopyFromUriAsync on the destination BlobClient using the source URI. Afterward, call GetPropertiesAsync to retrieve the initial status. Finally, poll the CopyStatus property in a loop until it is no longer pending.
The correct sequence begins with creating the client connection, accessing the destination container and blob references, initiating the copy from the source URI, and then polling the status properties until the operation is no longer pending.

Step-by-Step Solution

1
Instantiate the BlobServiceClient.
A service client is created to communicate with the target Azure Storage Account.
Establishing a service client is the prerequisite step for obtaining container and blob client references.
2
Retrieve references to the destination BlobContainerClient and BlobClient.
Client objects representing the destination container and the target blob are initialized.
You must obtain a reference to the specific target blob client to execute the copy method on it.
3
Call StartCopyFromUriAsync on the target BlobClient.
The asynchronous copy operation is initiated on the Azure Storage side.
This triggers the destination storage service to start copying data from the specified source URI.
4
Call GetPropertiesAsync on the target BlobClient.
The current metadata and state of the target blob are fetched.
The copy operation runs asynchronously on the server, so you must query the blob properties to find the status of the copy.
5
Poll the CopyStatus property in a loop.
The loop terminates once the copy status transitions to Succeeded, Failed, or Aborted.
This ensures the application waits until the background copy is fully resolved before performing subsequent logic.

Key Concept

Asynchronous blob copying and status monitoring using the .NET Azure.Storage.Blobs SDK
Question 130Question →

An organization is configuring a custom domain for a web application. You need to create an SSL/TLS certificate in Azure Key Vault by using a non-integrated Certificate Authority (CA). Which sequence of steps should you perform to complete this process? To answer, drag the appropriate actions from the list of actions to the answer area and arrange them in the correct sequence.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence of steps is: First, create a certificate in Azure Key Vault with the policy set to use a non-integrated CA (Issuer Name set to Unknown). Second, download the Certificate Signing Request (CSR) file from the pending certificate. Third, submit the CSR to your external Certificate Authority (CA) and download the signed certificate. Finally, merge the signed certificate into the pending certificate request in Azure Key Vault.
To create a certificate in Azure Key Vault using a non-integrated CA, you must first initiate the request in Key Vault by setting the issuer to Unknown. This generates a private key and a CSR within Key Vault. Next, you download the CSR to submit it to the external CA. Once the CA issues the signed certificate, you merge it back into the pending request to pair it with the private key.

Step-by-Step Solution

1
Create the certificate with the issuer set to Unknown.
Azure Key Vault generates a key pair and a CSR, and sets the certificate status to pending.
This is the initial step required to generate the CSR within Key Vault's secure boundary.
2
Retrieve the CSR from the pending certificate.
The CSR file (.csr or PEM format) is downloaded.
The CSR contains the public key and identity information that must be signed by the external CA.
3
Submit the CSR to the CA and retrieve the signed certificate.
A signed public certificate (.cer or .crt file) is obtained from the CA.
The external CA validates ownership and issues the signed certificate.
4
Merge the signed certificate in Azure Key Vault.
The pending certificate status changes to active, associating the private key with the signed certificate.
This finalizes the certificate creation process inside the Key Vault.

Key Concept

Azure Key Vault Certificate Lifecycle Management with Non-Integrated CA
Question 131Question →

You have a Standard tier Azure API Management (APIM) instance named apim-service with the default gateway URL apim-service.azure-api.net. You need to configure a custom domain api.contoso.com for the gateway endpoint. The TLS certificate must be managed and automatically renewed by Azure. Which sequence of steps should you perform to configure the custom domain?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

To configure a custom domain with an Azure-managed certificate, you must first create a DNS CNAME record pointing the custom domain to the default gateway hostname, add the custom domain for the Gateway endpoint in the Azure portal, choose the Managed certificate option, and then save the configuration to trigger verification and provisioning.
The correct order ensures that domain ownership can be verified dynamically by API Management. The CNAME record must exist in DNS before saving the custom domain configuration in Azure. Once the configuration is saved with the Managed certificate option selected, Azure verifies the CNAME record and requests the certificate from the Certificate Authority.

Step-by-Step Solution

1
Create a CNAME record in your DNS provider pointing the custom domain to the default API Management gateway hostname.
The DNS system starts propagating the CNAME record.
Azure API Management requires the CNAME record to be in place before configuring the custom domain with a managed certificate, as it queries the DNS to verify domain ownership.
2
In the Azure portal, navigate to the API Management Custom domains settings and add a custom domain for the Gateway endpoint.
The custom domain configuration form is opened and populated with the custom hostname.
This associates the custom domain with the Gateway service endpoint of your API Management instance.
3
Set the Certificate type to Managed.
API Management is configured to request a free, managed TLS certificate instead of requiring an uploaded custom certificate or Azure Key Vault integration.
Choosing the Managed option tells Azure to handle both the creation and automatic renewal of the TLS certificate.
4
Save the custom domain configuration.
The API Management service validates the CNAME record and begins provisioning the TLS certificate.
Saving the configuration triggers the asynchronous ownership verification and certificate binding process.

Key Concept

Configuring custom domains with Azure Managed Certificates in API Management
Question 132Question →

You are configuring a C# ASP.NET Core web application hosted in Azure App Service to connect to a Premium tier Azure Cache for Redis instance. To align with security best practices, you must eliminate the use of access keys and implement Microsoft Entra ID authentication using the system-assigned managed identity of the App Service.

Which sequence of steps should you perform to configure and establish this secure connection?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

To configure Microsoft Entra ID authentication using the system-assigned managed identity, first enable Microsoft Entra ID authentication on the Azure Cache for Redis instance. Second, assign a Redis Access Policy to the managed identity. Third, in the application code, acquire a Microsoft Entra ID token. Fourth, configure the StackExchange.Redis connection options using the Object ID of the managed identity as the username and the token as the password. Finally, establish the connection using the ConnectionMultiplexer.
Establishing a passwordless connection requires enabling Entra ID authentication on the Redis resource, configuring the appropriate Redis Access Policy for the managed identity, obtaining the JWT access token client-side, configuring the client to pass the Object ID and token, and finally establishing the connection.

Step-by-Step Solution

1
Enable Microsoft Entra ID authentication on the cache instance.
The Redis server is configured to accept token-based authentication connections.
By default, Azure Cache for Redis uses access keys. Entra ID authentication must be explicitly enabled.
2
Create a Redis Access Policy assignment linking the system-assigned managed identity to a role like Redis Data Reader or Redis Data Owner.
The identity is authorized to access the Redis data layer with specific permissions.
Authentication will fail if the identity does not have an active policy assignment mapping it to a permissions policy.
3
Acquire a token for the Redis resource inside the ASP.NET Core application using DefaultAzureCredential.
A short-lived JWT token is retrieved from Microsoft Entra ID representing the managed identity.
The client must present a valid Microsoft Entra token to Redis to authenticate.
4
Configure StackExchange.Redis ConnectionOptions, passing the Object ID as the username and the token as the password.
The connection metadata is set up to send the required credentials during the Redis AUTH call.
Redis protocol uses the AUTH command where the username must be the principal's Object ID and the password must be the token.
5
Call ConnectionMultiplexer.Connect.
A connection is successfully negotiated and opened.
This establishes the TCP connection and performs the handshake containing the AUTH command.

Key Concept

Microsoft Entra ID Authentication and Access Policies in Azure Cache for Redis
Estimated Time:2m 0s
Question 133Question →

You are developing an Azure Function App in C# that needs to retrieve a third-party API key stored as a secret in an Azure Key Vault. The Function App must authenticate to Key Vault securely using a system-assigned managed identity, adhering to the principle of least privilege.

Which five actions should you perform in sequence to configure the resources and write the code? To answer, arrange all the actions from the list of actions to the correct order.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

To retrieve the secret securely, first enable the system-assigned managed identity on the Function App. Next, assign the Key Vault Secrets User RBAC role to this identity to grant read access. In the code, instantiate a DefaultAzureCredential, pass it to initialize a SecretClient, and then call GetSecretAsync to retrieve the secret value.
The correct sequence begins by provisioning the identity, granting it read-only permissions via RBAC (Key Vault Secrets User), instantiating the credential provider (DefaultAzureCredential), initializing the Key Vault client (SecretClient), and executing the secret retrieval request.

Step-by-Step Solution

1
Enable the system-assigned managed identity on the Function App.
A service principal is created in Microsoft Entra ID representing the Function App.
This establishes the identity context that will be authorized to access Key Vault.
2
Assign the Key Vault Secrets User RBAC role to the Function App's identity on the Key Vault.
The identity receives the minimum required permissions to read secrets.
Azure RBAC requires a security principal to grant permissions. You must use the Key Vault Secrets User role for least privilege secret reading.
3
Instantiate a DefaultAzureCredential object in the C# code.
A token credential pipeline is created.
The DefaultAzureCredential class automatically discovers the managed identity when deployed to Azure.
4
Instantiate a SecretClient passing the Key Vault URI and the DefaultAzureCredential.
A SecretClient instance is initialized.
The SecretClient from the Azure.Security.KeyVault.Secrets library handles all API operations against Key Vault.
5
Call the GetSecretAsync method on the SecretClient.
The secret containing the API key is retrieved.
This makes the actual network call to Key Vault to return the secret value.

Key Concept

Establishing a secure connection from an Azure Function App to Azure Key Vault using modern C# SDKs and a managed identity with role-based access control.
Question 134Question →

A warehouse automation system requires a C# solution to consume high-throughput logistics events from Azure Event Hubs. You must write a consumer application that processes these events reliably, handles errors, updates partition progress in Azure Blob Storage, and shuts down gracefully when a cancellation token is triggered. How should you order the following implementation steps to achieve this?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

To implement the consumer, first initialize the BlobContainerClient and EventProcessorClient. Second, assign handlers to ProcessEventAsync and ProcessErrorAsync. Third, call StartProcessingAsync to begin event processing. Fourth, call UpdateCheckpointAsync inside the event handler to store offsets. Finally, invoke StopProcessingAsync during shutdown to release leases.
The correct sequence for using the EventProcessorClient is: 1) Initialize the container and processor client objects; 2) Assign handlers to both the event and error delegates; 3) Start processing using the async start method; 4) Save consumer progress using update checkpoint within the active loop; and 5) Stop processing using the async stop method to release the storage leases.

Step-by-Step Solution

1
Initialize client objects.
BlobContainerClient and EventProcessorClient instances are created and linked.
You must create the storage client first because the processor client requires it to handle partition lease management and checkpoint storage.
2
Register event and error handlers.
Handlers for ProcessEventAsync and ProcessErrorAsync are registered on the EventProcessorClient.
The client requires both event and error handler delegates to be defined before it can run. Starting the client without registering both delegates throws an InvalidOperationException.
3
Start processor execution.
The background thread pool begins receiving events and acquiring partition ownership leases.
Calling StartProcessingAsync activates the EventProcessorClient, starting partition load balancing and routing incoming events to your handlers.
4
Persist processing checkpoint.
The current partition offset is saved to Azure Blob Storage.
Calling UpdateCheckpointAsync periodically inside the event handler ensures that if the host crashes, another processor can resume reading from the last saved offset.
5
Stop processor execution.
Event processing stops, and partition ownership leases are released.
When stopping or shutting down, calling StopProcessingAsync gracefully shuts down background processing tasks and releases blob storage leases.

Key Concept

Lifecycle and execution order of the Azure SDK EventProcessorClient for Event Hubs partition consumer operations.
Question 135Question →

You are configuring database persistence for a newly provisioned Azure Cache for Redis instance in the Premium tier to ensure data can be recovered in the event of a cache failure. You decide to implement Redis database (RDB) persistence.

Which sequence of steps must you perform in the Azure Portal to configure and enable RDB persistence?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

To configure RDB database persistence in the Azure Portal, you must navigate to the Data persistence menu of the Premium tier cache, select the RDB option, set the Backup Frequency, choose the Storage Account and container, and click Save.
Configuring RDB persistence requires first navigating to the Data persistence section of a Premium cache, enabling the RDB option, specifying the backup interval, configuring the target Azure Storage Account, and finally saving the changes to apply them.

Step-by-Step Solution

1
Navigate to the Data persistence settings.
The Data persistence blade is opened, displaying options for Disabled, RDB, and AOF.
This is the entry point for configuring persistence in Azure Cache for Redis.
2
Enable RDB persistence.
The RDB configuration options are exposed.
RDB is disabled by default; enabling it is required to expose the backup parameters.
3
Select a backup frequency.
A specific backup interval (e.g., 15 minutes) is configured.
This defines the snapshot interval for taking point-in-time backups.
4
Configure the storage account destination.
The destination container is linked to the cache instance.
Azure Cache for Redis requires a storage account in the same region to store the backup files.
5
Save the configuration.
The configuration is committed and the cache begins RDB persistence.
Any changes made in the Azure Portal are pending until explicitly saved.

Key Concept

Redis Database (RDB) Persistence Configuration
Question 136Question →

You are developing a C# console application to consume messages from an Azure Service Bus queue using the Azure.Messaging.ServiceBus SDK. You need to initialize, execute, and cleanly terminate a ServiceBusProcessor to process messages asynchronously. Which of the following sequences represents the correct chronological order of steps required to achieve this?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence begins with instantiating a ServiceBusClient, followed by calling CreateProcessor. Next, you register the ProcessMessageAsync and ProcessErrorAsync event handlers, then call StartProcessingAsync. To shut down, you call StopProcessingAsync and finally call DisposeAsync on both the processor and client.
Establishing a connection requires first instantiating the ServiceBusClient, then using it to obtain a ServiceBusProcessor. You must register the required message and error event handlers on the processor before invoking StartProcessingAsync. During application shutdown, you must cleanly halt message retrieval by calling StopProcessingAsync before freeing resources via DisposeAsync.

Step-by-Step Solution

1
Instantiate a ServiceBusClient using the connection string.
A ServiceBusClient connection is established.
The client is the primary factory class used to create processors.
2
Call CreateProcessor on the client.
A ServiceBusProcessor instance is obtained.
The processor is scoped to a specific queue and handles message fetching.
3
Register the ProcessMessageAsync and ProcessErrorAsync handlers.
Event handlers are bound to the processor.
The SDK requires both handlers to be registered before processing can begin.
4
Call StartProcessingAsync.
The message pump is activated.
This starts the background message receiving loop.
5
Call StopProcessingAsync.
Message reception is stopped.
This is necessary to gracefully stop processing before disposing resources.
6
Call DisposeAsync on the processor and client.
Network and client resources are freed.
Clean disposal prevents resource leaks and hanging TCP connections.

Key Concept

ServiceBusProcessor Lifecycle Management
Question 137Question →

Your company is configuring SSL/TLS certificates for a web application and wants to automate the certificate renewal lifecycle using an integrated Certificate Authority (CA) partner, DigiCert. You need to configure Azure Key Vault to automatically request and renew certificates from DigiCert. Which sequence of actions must you perform to configure the integrated certificate auto-renewal?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

Retrieve the organization ID, API key, and account credentials from the partner Certificate Authority; register the partner Certificate Authority as a certificate issuer in the Azure Key Vault using the retrieved credentials; create a certificate policy in the Azure Key Vault that specifies the registered issuer and configures a lifetime trigger for auto-renewal; and create the certificate in the Azure Key Vault using the configured certificate policy to initiate the initial enrollment and enable automatic renewals.
The correct configuration sequence for integrated CA certificate auto-renewal begins with obtaining the credentials from the CA provider. Next, these credentials are used to register the CA as an issuer object within the Key Vault. Once the issuer exists, you define a certificate policy referencing that issuer and setting the auto-renewal lifetime trigger. Finally, you create the certificate based on that policy to trigger the initial generation and establish the auto-renewal lifecycle.

Step-by-Step Solution

1
Retrieve organization details and API keys from DigiCert.
Credentials are ready to be used in Azure Key Vault.
Azure Key Vault requires CA account credentials to authenticate and communicate with the partner CA.
2
Register the partner CA as an issuer in the Key Vault.
An issuer object is created in the Key Vault.
A certificate policy cannot reference an issuer until the issuer is registered in the Key Vault.
3
Create a certificate policy containing issuer details and lifetime actions.
A policy defining the auto-renewal percentage trigger is ready.
The policy must exist to define the properties of the certificate and specify that the CA should auto-renew it at a specific lifetime milestone.
4
Create the certificate in Key Vault using the policy.
The initial certificate is generated and auto-renewal is active.
This initiates the initial contact with the CA and configures the certificate for the automated renewal cycle.

Key Concept

Azure Key Vault integrated Certificate Authority auto-renewal configuration
Question 138Question →

A developer is writing a C# application that connects to an Azure Cache for Redis instance using the StackExchange.Redis SDK. To optimize application performance and socket reuse, the application must share a single, thread-safe connection instance using lazy initialization. You need to arrange the steps required to initialize the cache connection client and execute a write operation. What is the correct sequence of steps to configure, establish, and use the connection?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence starts with declaring the lazy ConnectionMultiplexer variable, followed by initializing the variable with the connection delegate. Next, access the Value property to establish the connection, call GetDatabase to obtain a reference to the cache database, and finally execute the write command using StringSetAsync.
According to Azure Cache for Redis developer guidelines, applications should share and reuse a single ConnectionMultiplexer instance. Using Lazy<ConnectionMultiplexer> ensures the connection is only established when the application first requires it, and in a thread-safe manner. Once the Value property is accessed and the connection is active, the database reference is fetched via GetDatabase, and commands are sent through the database reference.

Step-by-Step Solution

1
Declare the static Lazy<ConnectionMultiplexer> variable.
A class-level variable is ready to hold the lazy initializer.
Creating a static variable ensures the ConnectionMultiplexer is shared and reused across the application to prevent socket exhaustion.
2
Initialize the Lazy instance with a connection delegate.
The initialization delegate is registered with connection settings.
This sets up the connection logic without immediately paying the performance cost of establishing the network connection.
3
Access the Value property of the Lazy instance.
The connection delegate is executed, returning the active ConnectionMultiplexer.
Accessing the Value property triggers the connection build thread-safely upon the first request.
4
Retrieve the database reference.
An IDatabase object is returned from the multiplexer.
The application needs a database context to interact with keys and values in the Redis instance.
5
Call StringSetAsync to write data.
The key-value pair is saved in the Azure Cache for Redis.
Commands must be executed against the obtained database reference rather than the multiplexer itself.

Key Concept

Lazy initialization of StackExchange.Redis ConnectionMultiplexer for efficient socket and connection management
Question 139Question →

You need to create a new SSL/TLS certificate in Azure Key Vault using a non-integrated Certificate Authority (CA). Which sequence of steps should you perform to generate the Certificate Signing Request (CSR) and complete the certificate creation in Key Vault?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence starts with initiating the certificate creation operation in Key Vault with the Issuer set to Unknown. Next, you download the generated Certificate Signing Request (CSR). You then submit this CSR to the external Certificate Authority (CA) and retrieve the signed certificate. Finally, you merge the signed certificate back into the pending certificate operation in Key Vault to complete the process.
The correct process involves first initiating the certificate operation with the issuer set to Unknown, which generates the CSR. The CSR is then retrieved and signed by the external CA. Finally, the signed certificate is merged back into the pending operation to match the private key.

Step-by-Step Solution

1
Initiate the certificate creation in Azure Key Vault with the issuer configuration set to Unknown.
Key Vault creates a pending certificate operation, generating a private/public key pair and a Certificate Signing Request (CSR).
Specifying Unknown as the issuer tells Key Vault that an external, non-integrated CA will be responsible for signing the certificate.
2
Retrieve the CSR from the pending certificate operation.
You obtain the CSR file (PEM format) from the Azure Portal, CLI, or SDK.
You must download the CSR to pass it to the external authority.
3
Submit the CSR to the external CA and retrieve the signed certificate.
The CA signs the public key and issues a certificate (usually as a .cer or .p7b file).
The external CA must authenticate the request and sign it to make the certificate valid.
4
Merge the signed certificate back into the pending Key Vault certificate operation.
The certificate state updates to Active and is ready for use.
Merging links the public certificate from the CA with the private key stored securely in Key Vault.

Key Concept

Creating certificates in Azure Key Vault using a non-integrated CA requires generating a CSR, obtaining the signed certificate externally, and merging it back to associate it with the private key.
Question 140Question →

A developer is implementing the Cache-Aside pattern in an Azure App Service web application that retrieves user profile information from an Azure SQL Database. The application uses Azure Cache for Redis to improve read latency. You need to sequence the actions the application must perform when a user profile is requested and a cache miss occurs. Which sequence of actions should the application execute? Move all actions to the answer area and arrange them in the correct order.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The application must first request the user profile from the Azure Cache for Redis instance. Upon detecting a null response (cache miss), it queries the primary Azure SQL Database, stores the retrieved user profile back into the cache with a defined Time-To-Live (TTL), and finally returns the data to the client.
The correct sequence begins with checking the cache to see if the requested user profile data is already available. If a cache miss occurs, indicated by a null response, the application must query the authoritative Azure SQL Database. Once the database returns the profile, the application writes that data back to the cache with an appropriate TTL so that future reads will hit the cache. Finally, the user profile is returned to the client.

Step-by-Step Solution

1
Check the cache using the target key.
A null or empty response is returned, indicating a cache miss.
Checking the cache first prevents unnecessary load on the backend database.
2
Query the primary database.
The requested user profile is retrieved from the database.
The database is the system of record and holds the data when a cache miss occurs.
3
Write the data to the cache.
The cache is populated with the profile data and an associated TTL.
Populating the cache on read-miss is the core mechanism of the Cache-Aside pattern to optimize subsequent requests.
4
Return the user profile data.
The requesting client receives the data.
This completes the lifecycle of the client request.

Key Concept

Cache-Aside pattern execution flow for read operations under a cache miss scenario
PreviousPage 7 / 9Next
All practice questions — Microsoft Azure Developer (AZ-204) | Examkin