All practice questions

You are developing a document approval workflow using Azure Durable Functions in C# (.NET Isolated). The workflow must wait for an external approval event named `DocumentApproved` for up to $24$ hours. If the event is received within $24$ hours, the document is processed. If the $24$-hour limit is reached without receiving the event, the document must be marked as expired. You write the following orchestrator function code:

csharp
[Function("ApprovalOrchestrator")]
public static async Task Run(
[OrchestrationTrigger] TaskOrchestrationContext context)
{
var approvalTask = context.WaitForExternalEvent<bool>("DocumentApproved");
var timeoutTask = Task.Delay(TimeSpan.FromHours(24));

var completedTask = await Task.WhenAny(approvalTask, timeoutTask);
if (completedTask == approvalTask)
{
bool isApproved = approvalTask.Result;
await context.CallActivityAsync("ProcessDocument", isApproved);
}
else
{
await context.CallActivityAsync("ExpireDocument", null);
}
}

Which of the following describes the defect in this orchestrator code?

An organization deploys a background processing application to an Azure App Service Plan in the East US region. The application processes tasks from an Azure Service Bus queue named `task-queue` in the same region.

To handle spikes in workload, you configure an autoscale setting on the App Service Plan with the following scale-out rule:
- Metric source: Service Bus Queue (`task-queue`)
- Metric name: `ActiveMessages`
- Time Grain (Frequency): $1$-minute
- Time Window: $10$-minutes
- Time Aggregation: `Total`
- Operator: `GreaterThan`
- Threshold: $500$
- Scale Action: Increase count by $2$

During a period of stable, low traffic, the queue maintains a steady backlog of approximately $60$ active messages. However, you observe that the App Service Plan unexpectedly scales out to its maximum instance count.

Which of the following is the root cause of this unexpected scaling behavior?

You have an Azure subscription with a Standard General Purpose v2 (GPv2) storage account named `medicalrecordsstore`. The container named `patients` contains the following block blobs:

* `patients/recordA.json`: Modified $120$ days ago. Tag: `ArchiveStatus` = `Ready`. No active lease.
* `patients/recordB.json`: Modified $110$ days ago. Tag: `archivestatus` = `Ready`. No active lease.
* `patients/recordC.json`: Modified $105$ days ago. Tag: `ArchiveStatus` = `Ready`. Has an active lease.

You implement the following lifecycle management policy:

{
"rules": [
{
"enabled": true,
"name": "archiveRule",
"type": "Lifecycle",
"definition": {
"actions": {
"baseBlob": {
"tierToArchive": {
"daysAfterModificationGreaterThan": 100
}
}
},
"filters": {
"blobTypes": ["blockBlob"],
"prefixMatch": ["patients/"],
"blobIndexMatch": [
{
"name": "ArchiveStatus",
"op": "==",
"value": "Ready"
}
]
}
}
}
]
}

After the policy runs, which blobs will be successfully transitioned to the Archive tier?

You are configuring an Azure Event Grid system topic to route system events to an Azure Function. To prevent event loss, you must configure dead-lettering to a secured Azure Storage account. The storage account has its firewall enabled, restricting access to virtual networks and trusted Microsoft services. Which configuration must you implement to authorize Event Grid to write the dead-letter events?

You are developing a background daemon service named DataArchiver that runs on a schedule to back up documents from all user OneDrive libraries to an Azure Blob Storage container. The service must authenticate silently without any user interaction.

You register DataArchiver in Microsoft Entra ID. You need to configure the permissions for Microsoft Graph to allow the service to read the files.

Which configuration should you apply to the application registration to meet the requirements while adhering to the principle of least privilege?

A background data synchronization service runs on an Azure App Service plan (Standard S2 tier) that is currently scaled to $3$ instances. You need to configure autoscale rules for the App Service plan based on the CPU percentage metric. You define the following rules:

* Scale-out rule: Increase the instance count by $3$ when the average CPU percentage is greater than $75\%$ for 10 minutes.
* Scale-in rule: Decrease the instance count by $3$ when the average CPU percentage is less than a target threshold for 10 minutes.

Under a constant workload, you must prevent the autoscale engine from flapping (repeatedly scaling out and scaling in).

Which of the following configurations should you implement?

You are developing a Single Page Application (SPA) using React and MSAL.js to authenticate users and obtain tokens for a downstream Web API. During the application registration in Microsoft Entra ID, you configured the redirect URI as http://localhost:3000/callback. When testing the authentication flow, the user can successfully sign in and the application receives an authorization code. However, when MSAL.js attempts to exchange the authorization code for an access token by sending a POST request to the token endpoint, the browser blocks the request with a Cross-Origin Resource Sharing (CORS) error. Which of the following describes the cause of this issue and the correct action to resolve it?

A company implements an auditing application that processes financial messages. The application uses an Azure Cache for Redis instance to store temporary transaction states. It is critical that no cached transaction states are evicted under memory pressure, as this would cause auditing mismatches. Instead, if the cache memory limit is reached, the application must receive errors so it can temporarily throttle ingestion. Which eviction policy should you configure for the Azure Cache for Redis instance?

You are developing a secure C# web application that runs on-premises. The application must sign in users and then call a downstream Web API on their behalf using the Microsoft Identity Platform.

The application is configured as a confidential client. You have already obtained the authorization code from the initial user login redirect.

You write the following code to initialize the application:

csharp
IConfidentialClientApplication app = ConfidentialClientApplicationBuilder.Create(clientId)
.WithClientSecret(clientSecret)
.WithRedirectUri(redirectUri)
.Build();

You need to complete the code to exchange the authorization code for an access token. Which code segment should you use?

An enterprise application uses Azure API Management (APIM) to route requests to a secure backend microservice. The backend microservice requires a specific API key passed via an HTTP header named X-Backend-Key. To secure the credential, the API key is stored as a secret in Azure Key Vault. You have already created an APIM named value named BackendApiKey that references this secret. APIM must retrieve the secret dynamically from the Key Vault using its system-assigned managed identity. Which configuration and policy placement will successfully inject the API key header into the request sent to the backend?

A developer needs to push a locally built container image to an Azure Container Registry (ACR) named contosoacr. The developer has already logged into their Azure account on their workstation using the Azure CLI command az login. However, when they attempt to push the image, they receive an authentication error from the Docker daemon.

Which of the following Azure CLI commands should the developer run to authenticate the local Docker daemon to the registry?

You are developing a serverless API using Azure Functions. The API must scale automatically to handle traffic spikes, but it requires that instances are pre-warmed to completely avoid cold-start latency. Which hosting plan should you select?

You are deploying an ASP.NET Core web application to an Azure App Service Web App named app-prod-01. The application requires a secret named DbConnectionString stored in an Azure Key Vault named kv-prod-01. The Web App has a system-assigned managed identity that is already configured with a GET access policy on the key vault. You must configure the application settings in the Web App to reference the Key Vault secret without modifying the code. Which configuration format must you use for the value of the DbConnectionString application setting?

You are configuring an Azure Function App that runs on a Consumption hosting plan. You need to increase the execution timeout limit for all functions in the app to the maximum allowable duration under this hosting plan.

Which configuration should you apply to the host.json file?

Your company deploys an Azure App Service web app named webapp-prod. The web app must retrieve a database connection string securely from an Azure Key Vault named kv-prod. You configure a user-assigned managed identity named id-webapp for webapp-prod and grant it the Key Vault Secrets User role on kv-prod. You need to configure the App Service application settings so that the web app can retrieve the latest version of the secret named DbConnectionString using the user-assigned identity. Which of the following configurations should you apply to the App Service application settings?

You are configuring a continuous integration pipeline in GitHub Actions to build and push a container image to an Azure Container Registry (ACR) named contosoacr.azurecr.io. The runner does not have the Azure CLI installed, but has the Docker CLI installed. You have created an Azure Active Directory (Azure AD) service principal with the AcrPush role.

You need to authenticate the Docker CLI on the runner to contosoacr.azurecr.io using the service principal credentials.

Which command should you execute in the pipeline runner?

You are a developer managing container images in Azure. You need to copy a container image named application:v1 from a development Azure Container Registry named devreg to a production Azure Container Registry named prodreg. Both registries are in the same Azure subscription. To save network bandwidth and time, you want to perform this copy directly from registry to registry, without downloading the image to your local workspace or requiring a local Docker installation. Which Azure CLI command should you run?

Your company is deploying a web application to Azure App Service. The application requires a database connection string that is stored securely as a secret named 'db-conn' in an Azure Key Vault named 'kv-prod'. You need to configure the web app's application settings to reference this Key Vault secret using its name. Which value should you use for the application setting?

You are configuring a CI/CD pipeline script to push container images to an Azure Container Registry (ACR) named `myregistry`. The script runs in a lightweight container context where only the Docker CLI is available for the build and push steps. To authenticate, you have already retrieved a Microsoft Entra ID access token for the registry using the Azure CLI and stored it in a variable named `$TOKEN`.

You need to run the `docker login` command to authenticate the local Docker daemon to the registry using this token.

Which command should you run?

An organization is designing a serverless background processing solution using Azure Functions V4 to process large batches of files uploaded to an Azure Blob Storage container. The solution must satisfy the following constraints:
- Individual file processing operations are CPU-intensive and can take up to 15 minutes to complete.
- The function app must connect securely to an Azure SQL Database that is restricted to a private virtual network.
- The system must dynamically scale out the number of instances to handle sudden, unpredictable spikes in upload volume, and scale back down when idle.
- Cold start latency must be minimized for initial requests after periods of inactivity.

Which hosting plan should the organization choose to deploy the Azure Function app?