Examkin

Tüm alıştırma soruları

972 soru

Tüm türler972Çoktan seçmeli497Çoklu seçim269Eşleştirme9Sıralama171Boşluk doldurma26
Soru 641Soru →

Match each Azure Monitor autoscale parameter on the left to its correct functional description on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Cool-down
Duration
Total time aggregation

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Cool-down matches the wait period after a scale event. Duration matches the collection time window. Total time aggregation matches the sum of metric values.
The correct pairings map Cool-down to the post-scale delay period, Duration to the historical metric collection window, and Total time aggregation to the metric summation method.

Adım Adım Çözüm

1
Identify the purpose of the Cool-down setting in Azure Monitor autoscale rules.
Cool-down is designed to prevent rapid scale-up/scale-down cycles by enforcing a post-scale delay.
This matches the description of waiting a set time after a scale action before allowing further adjustments.
2
Analyze the meaning of the Duration parameter.
Duration specifies the time window over which the metrics are gathered prior to comparison against the threshold.
This aligns with the description of the collection and evaluation time window.
3
Determine the role of the Total time aggregation option.
Total is an aggregation type that sums up the telemetry data values over the monitoring duration.
This matches the description of the sum of all collected metric values.

Anahtar Kavram

Azure Monitor autoscale configuration settings including duration, cool-down, and metric aggregation.
Tahmini Süre:1m 0s
Soru 642Soru →

An organization requires that all client requests to a public API gateway verify a JSON Web Token (JWT) before the request is routed to any backend microservice. A developer is adding the `<jwt-validate>` policy.

In which policy section must this policy be defined?

Cevabı ve açıklamayı göster

Cevap: inbound

Cevap

inbound
The correct answer is inbound because Azure API Management executes policies in the inbound section on the incoming request before it is sent to the backend. Validating JSON Web Tokens (JWT) at this stage prevents unauthorized requests from reaching backend services.

Adım Adım Çözüm

1
Determine the stage of API request processing where authentication and token validation must occur.
The authentication token needs to be verified before forwarding the request to the backend microservice.
Validating the token before routing prevents unauthorized traffic from consuming backend resources.
2
Identify the corresponding Azure API Management policy section that runs before the backend is invoked.
The inbound policy section executes prior to backend service forwarding.
Placing the policy in the inbound section guarantees the validation is performed on the incoming request.

Anahtar Kavram

Azure API Management policies are collections of statements that are executed sequentially on the request or response. They are divided into inbound, backend, outbound, and on-error sections to manage requests at different stages.
Soru 643Soru →

You are implementing an ASP.NET Core Web API controller that serves as a Webhook endpoint for an Azure Event Grid subscription. During the creation of the event subscription, the deployment fails with a validation handshake error. You verify that the controller receives the validation request, returns an HTTP 200 OK status code, and includes the validation code as a plain text string in the response body. Which action must you take to resolve the validation handshake failure?

Cevabı ve açıklamayı göster

Cevap: Return a JSON response containing a validationResponse property set to the validation code.

Cevap

Return a JSON response containing a validationResponse property set to the validation code.
For Event Grid to complete a synchronous validation handshake, the endpoint must return an HTTP 200 OK status code with a JSON response body containing the validationResponse property set to the validationCode received in the request. Returning the validation code as a plain text string or an empty response body results in a validation failure.

Adım Adım Çözüm

1
Deserialize the incoming JSON request into an Event Grid event array.
Identify the subscription validation event, which contains the validationCode.
The validation code sent by Event Grid is required to prove ownership of the endpoint.
2
Format the response as a JSON object with the property validationResponse.
A payload structured as {"validationResponse": "<validationCode>"}.
Event Grid requires this specific JSON schema to successfully verify the handshake.
3
Return the formatted JSON payload with an HTTP 200 OK status code.
The subscription deployment completes successfully.
The synchronous validation handshake protocol is satisfied.

Anahtar Kavram

Webhook validation handshake in Azure Event Grid
Soru 644Soru →

You are developing a batch processing system in C# that optimizes storage costs. The system retrieves blobs from a Hot container, adds a metadata key-value pair of "ArchivedBy: BatchProcessor", and then transitions them to the Archive access tier using the Azure.Storage.Blobs SDK.

The current implementation contains the following code:

csharp
// blobClient is a valid instance of BlobClient
await blobClient.SetAccessTierAsync(AccessTier.Archive);
var metadata = new Dictionary<string, string> { { "ArchivedBy", "BatchProcessor" } };
await blobClient.SetMetadataAsync(metadata);

During testing, the system throws a RequestFailedException at the last line.

Which of the following changes must you make to resolve this error?

Cevabı ve açıklamayı göster

Cevap: Update the metadata by calling SetMetadataAsync before changing the access tier to Archive, as writing metadata is not supported on blobs that are already in the Archive tier.

Cevap

Update the metadata by calling SetMetadataAsync before changing the access tier to Archive, as writing metadata is not supported on blobs that are already in the Archive tier.
The correct answer is correct because once a blob is transitioned to the Archive access tier, it enters an offline state where only limited operations are supported (such as reading properties/metadata or changing/rehydrating the tier). Direct write operations on properties and metadata, such as calling SetMetadataAsync, are explicitly blocked by Azure Blob Storage. Therefore, metadata must be written while the blob is still in an active tier (Hot or Cool) before the tier transition takes place.

Adım Adım Çözüm

1
Set the metadata of the blob while it is still in the Hot tier using the SDK's SetMetadataAsync method.
The blob's metadata is successfully written and updated on the server.
Blobs in active tiers (Hot/Cool) permit full read/write access to both properties and metadata.
2
Transition the blob to the Archive tier using the SetAccessTierAsync method.
The blob is moved to the Archive tier, retaining the metadata that was set in the previous step.
Once the blob is archived, metadata cannot be modified, but pre-existing metadata remains readable.

Anahtar Kavram

Azure Blob Storage Archive access tier write limitations
Soru 645Soru →

A web application stores user shopping cart data in an Azure Cache for Redis instance. The application does not specify an expiration time (Time to Live) for the cache keys. You need to configure the cache to automatically evict the least recently used keys across the entire dataset when memory limit is reached. Which maxmemory eviction policy should you configure?

Cevabı ve açıklamayı göster

Cevap: allkeys-lru

Cevap

Configure the cache with the allkeys-lru eviction policy.
The correct policy is allkeys-lru. This policy evicts the least recently used keys from the entire key space, which is required because the application does not set an expiration time (TTL) on the keys. Choosing a volatile policy would fail to evict any keys without TTL.

Adım Adım Çözüm

1
Analyze the requirements for cache eviction under memory pressure.
The keys in the cache do not have a Time to Live (TTL) set, and the goal is to evict the least recently used (LRU) keys across all keys when the memory limit is reached.
This helps identify whether we need a policy targeting volatile keys (those with TTL) or all keys.
2
Evaluate the difference between volatile and allkeys policies.
Volatile policies only evict keys that have an expiration time set, while allkeys policies evaluate all keys in the database.
Since the cache keys do not have a TTL set, using a volatile policy would result in no keys being evicted, causing the cache to run out of memory.
3
Select the correct LRU policy.
The allkeys-lru policy is the correct choice because it evicts the least recently used keys among the entire dataset, ignoring whether a TTL is set.
This matches all configuration constraints of the scenario.

Anahtar Kavram

Azure Cache for Redis Eviction Policies
Soru 646Soru →

You manage an Azure App Service plan hosting a critical web application. You have configured an Azure Monitor metric alert rule that uses dynamic thresholds to detect CPU spikes and trigger an action group to notify the operations team. A scheduled database synchronization job runs daily from 02:00 to 03:00 UTC, causing legitimate CPU spikes that trigger false positive alerts. You need to prevent notifications from being sent to the operations team during this period while keeping the alert rule active for reporting and historical analysis. What should you configure to achieve this?

Cevabı ve açıklamayı göster

Cevap: An alert processing rule configured to suppress notifications during the daily maintenance window

Cevap

An alert processing rule configured to suppress notifications during the daily maintenance window
The correct answer is the option that suggests configuring an alert processing rule to suppress notifications. This is because alert processing rules in Azure Monitor allow you to post-process alerts. By setting up a suppression rule on a daily schedule, the metric alert rule continues to evaluate and log alerts in the Azure portal, preserving the historical data required for reporting, while preventing the action group from sending notifications to the operations team.

Adım Adım Çözüm

1
Analyze the requirements for alert notifications.
The alerts must still fire and be recorded in history, but notifications (emails, SMS, etc.) must be suppressed during a specific daily schedule.
Disabling the alert rule or dynamically altering criteria prevents historical tracking of alerts.
2
Identify the Azure Monitor feature designed for altering alert notification behavior post-firing.
Alert processing rules (formerly action rules) allow suppression or modification of actions on fired alerts.
These rules operate on fired alerts without altering the definition or execution of the alert rules themselves.
3
Define the configuration for the alert processing rule.
Create a rule scoped to the App Service plan resource or resource group, select the Suppression action, and set the recurrence schedule to daily between 02:00 and 03:00 UTC.
This configuration natively suppresses notifications during the specified period while letting the alerts fire and be recorded.

Anahtar Kavram

Azure Monitor Alert Processing Rules and Notification Suppression
Soru 647Soru →

A developer is configuring a multi-tenant web application in Microsoft Entra ID. The application manifest has the signInAudience parameter configured as AzureADMultipleOrgs. The developer wants to configure the authentication middleware in the application to redirect users to the correct Microsoft identity platform endpoint so that users from any organizational tenant can sign in, but personal Microsoft accounts (such as Xbox or Outlook accounts) are excluded. Which authority URL should the developer configure for the authentication endpoint?

Cevabı ve açıklamayı göster

Cevap: https://login.microsoftonline.com/organizations

Cevap

https://login.microsoftonline.com/organizations
The authority URL containing 'organizations' is the correct endpoint because it allows users with work or school accounts from any Microsoft Entra ID tenant to authenticate, matching the AzureADMultipleOrgs configuration and successfully excluding personal Microsoft accounts.

Adım Adım Çözüm

1
Analyze the signInAudience setting in the application manifest.
The signInAudience is set to AzureADMultipleOrgs, which corresponds to multi-tenant organization accounts only.
This configuration indicates that only work and school accounts from any Microsoft Entra ID tenant should be allowed, and personal Microsoft accounts must be excluded.
2
Evaluate the available Microsoft identity platform authority endpoints.
The /organizations endpoint maps directly to AzureADMultipleOrgs. The /common endpoint maps to AzureADandPersonalMicrosoftAccount. The /consumers endpoint maps to PersonalMicrosoftAccount.
Choosing the correct endpoint ensures that the authentication requests are routed to the proper account pool in compliance with the manifest's signInAudience.
3
Select the authority URL that matches the /organizations endpoint.
The authority URL is https://login.microsoftonline.com/organizations.
This URL correctly restricts sign-in to organizational directories and matches the multi-tenant configuration.

Anahtar Kavram

Microsoft identity platform multi-tenant endpoints and signInAudience configuration
Soru 648Soru →

You are setting up an API gateway in Azure API Management. You need to restrict client access to a specific range of IP addresses and enable response caching for incoming requests. Which two of the following policy elements must be placed inside the <inbound> section of the policy XML to achieve this?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: ip-filter; cache-lookup

Cevap

To restrict client IP addresses and enable response caching, the ip-filter and cache-lookup policies must be placed in the inbound section of the policy XML.
The policies ip-filter and cache-lookup are used to inspect and filter incoming requests before sending them to the backend service. Therefore, they must be placed in the inbound section of the Azure API Management policy document. Specifically, ip-filter restricts access based on client IP ranges, and cache-lookup checks for cached responses.

Adım Adım Çözüm

1
Identify the section of the API Management policy document that executes before a request is sent to the backend.
The inbound section is evaluated first when a client request arrives.
This is where pre-processing policies, such as request filtering and cache checking, must run.
2
Determine which policy filters client requests by IP address.
The ip-filter policy allows or blocks specific IP addresses and runs during incoming request processing.
This must be placed in the inbound section to block unwanted traffic early.
3
Determine which caching policy is required to check for existing cached responses.
The cache-lookup policy checks the cache and must be placed in the inbound section.
If a cached response exists, it is returned immediately, bypassing the backend. The corresponding cache-store policy is placed in the outbound section to cache the backend response.

Anahtar Kavram

Azure API Management policy sections control when policies are executed relative to the backend request. Inbound processing policies like ip-filter and cache-lookup must reside in the inbound section.
Soru 649Soru →

You are developing a background service in C# that uses the Azure Cosmos DB .NET SDK v3 Change Feed Processor to process document updates from a monitored container. Which of the following statements correctly describes the configuration or behavior of the Change Feed Processor?

Cevabı ve açıklamayı göster

Cevap: The lease container must be partitioned using /id/id, and if the change feed delegate throws an unhandled exception, the processor will continuously retry processing the failed batch of changes.

Cevap

The lease container must be partitioned using /id/id, and if the change feed delegate throws an unhandled exception, the processor will continuously retry processing the failed batch of changes.
The correct option correctly states that the lease container must be partitioned by /id/id. Furthermore, when an unhandled exception is thrown in the change feed delegate, the Change Feed Processor will continuously retry the same batch of changes. This guarantees at-least-once processing but requires developers to implement robust try-catch blocks to prevent processing from getting stuck.

Adım Adım Çözüm

1
Configure the lease container with the correct partition key.
The lease container is created with a partition key of /id/id, allowing the Change Feed Processor to successfully distribute partition leases.
The Change Feed Processor stores lease state as individual documents in the lease container. The partition key /id/id ensures efficient state distribution and access.
2
Implement the change feed handler delegate and handle exceptions.
Uncaught exceptions within the delegate cause the Change Feed Processor to retry the same batch of changes indefinitely.
The processor only updates the continuation token in the lease container when the delegate completes successfully. To prevent partition blockage, developers must implement exception handling (such as a try-catch block) within the delegate.

Anahtar Kavram

Azure Cosmos DB Change Feed Processor Configuration and Error Handling
Tahmini Süre:1m 30s
Soru 650Soru →

You are configuring Application Insights telemetry in a C# console application. You need to enrich all telemetry sent to Application Insights with a custom cloud role name by implementing and registering a telemetry initializer.

Complete the code snippet by identifying the correct types and properties for each blank.

Aşağıdaki boşlukları doldurun

using Microsoft.ApplicationInsights.Channel;
using Microsoft.ApplicationInsights.Extensibility;

// A custom initializer to enrich all telemetry with cloud role details
public class CloudRoleNameInitializer :
{
public void Initialize( telemetry)
{
telemetry.Context.Cloud.RoleName = "OrderProcessingService";
}
}

// In the application startup code:
var config = TelemetryConfiguration.CreateDefault();
config.ConnectionString = "ConnectionStringValue";
config..Add(new CloudRoleNameInitializer());
Cevabı ve açıklamayı göster

Cevap

Blank 1 should be filled with ITelemetryInitializer, Blank 2 with ITelemetry, and Blank 3 with TelemetryInitializers.
To write a custom telemetry initializer, you must implement the ITelemetryInitializer interface, which has a single Initialize method taking an ITelemetry argument. To run it, you must add it to the TelemetryInitializers collection on the active TelemetryConfiguration.

Adım Adım Çözüm

1
Implement the telemetry initializer interface.
The class must implement the ITelemetryInitializer interface to hook into the Application Insights telemetry pipeline.
The Application Insights SDK uses this interface to identify custom initializers.
2
Define the input parameter type for the Initialize method.
The method signature must accept an ITelemetry object.
This object represents the raw telemetry data being processed and exposes the Context property to allow modification of metadata like Cloud Role Name.
3
Register the initializer instance in the active configuration.
Add the custom initializer to the TelemetryInitializers collection on the configuration object.
This ensures the SDK executes the initializer for all generated telemetry data before transmission.

Anahtar Kavram

Programmatic configuration of Application Insights Telemetry Initializers in C#
Tahmini Süre:2m 0s
Soru 651Soru →

You are configuring an existing Azure API Management instance to be deployed inside an Azure Virtual Network in Internal mode. You need to ensure that internal clients can successfully resolve and access the API gateway. Which sequence of steps should you perform?

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

To configure API Management in an internal virtual network, first create the subnet and configure NSG rules. Next, update the API Management network settings to Internal and select the subnet. After the deployment updates, retrieve the private Virtual IP (VIP) address. Finally, configure DNS records in a Private DNS Zone pointing to the VIP.
The correct sequence ensures that prerequisites (subnet and NSG rules) are satisfied first to prevent deployment failures. Then, the API Management configuration is updated. After the private VIP is allocated and retrieved, the DNS records are created to enable hostname resolution.

Adım Adım Çözüm

1
Prepare the subnet and NSG rules.
A dedicated subnet is created with rules allowing traffic on necessary ports (like port 3443 for management).
API Management checks for network connectivity to dependencies during subnet association; incorrect NSG rules cause deployment failure.
2
Associate API Management with the subnet.
The connectivity status changes to Internal, initiating the deployment update.
This updates the configuration and deploys the gateway components inside the virtual network.
3
Obtain the private Virtual IP.
The private VIP address is retrieved from the API Management properties.
The VIP is needed to configure DNS routing to the internal gateway.
4
Configure DNS records.
DNS resolution is configured using an Azure Private DNS Zone.
Azure does not host DNS for private VIPs automatically, so manual records are required for resolution.

Anahtar Kavram

Internal Virtual Network Integration for Azure API Management
Tahmini Süre:2m 0s
Soru 652Soru →

You are configuring Azure Monitor autoscale rules for different workloads. Match each scaling requirement on the left to its correct Azure Monitor metric and time aggregation configuration on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

A memory-sensitive background worker running on an Azure App Service plan must scale out when the average memory usage across the instances exceeds 80%80\%.
A CPU-intensive batch rendering service on an Azure Virtual Machine Scale Set (VMSS) must scale out if any single VM instance reaches 90%90\% CPU utilization.
An API gateway on an Azure App Service plan must scale out when the total volume of network payload data received by the plan exceeds 500 MB500\text{ MB}.

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Match the memory-sensitive worker to Memory Percentage and Average; match the CPU-intensive batch rendering to CPU Percentage and Maximum; and match the API gateway network volume to Data In and Total.
The correct pairings align the metric and time aggregation with the workload constraints: Memory Percentage (Average) for overall memory usage, CPU Percentage (Maximum) to scale when any single instance peaks, and Data In (Total) to measure the cumulative incoming network payload.

Adım Adım Çözüm

1
Identify the target resource metric for each scenario.
Memory-sensitive worker uses Memory Percentage; CPU-intensive worker uses CPU Percentage; network payload volume uses Data In.
Correct metric selection ensures the autoscale rule reacts to the correct resource bottleneck.
2
Determine the appropriate time aggregation based on the trigger condition.
Average is used for overall memory trend; Maximum is used to catch any single VM instance hitting the CPU limit; Total is used to sum the network data volume over the duration.
Time aggregation defines how the metric values collected over time and across instances are combined to evaluate the threshold.

Anahtar Kavram

Azure Monitor autoscale rules require selecting the correct resource metric and time aggregation (statistic) to properly align with workload requirements and prevent issues like flapping or missed scaling events.
Tahmini Süre:2m 0s
Soru 653Soru →

You are designing a monitoring solution for a critical REST API hosted behind Azure API Management (APIM). The backend service dynamically adds a custom response header named `X-Backend-Server` to indicate which server instance processed the request. The monitoring solution must meet the following requirements:

1. Send an HTTP POST request to `https://api.contoso.com/health` with a JSON payload of `{"ping": true}` every 5 minutes.
2. Verify that the response status code is 200.
3. Verify that the response contains the `X-Backend-Server` header to ensure routing is functioning correctly.
4. Report the test duration, location, and success status as availability metrics to Application Insights.

You need to implement the availability monitoring solution. Which of the following should you do?

Cevabı ve açıklamayı göster

Cevap: Deploy an Azure Function integrated with your virtual network. In the function code, execute the HTTP POST request, verify the response status code and the `X-Backend-Server` header, and report the results using `TelemetryClient.TrackAvailability()` with an `AvailabilityTelemetry` object. Configure the function app to retrieve the Application Insights connection string from Azure Key Vault using a system-assigned managed identity granted the Key Vault Secrets User role.

Cevap

Deploy an Azure Function integrated with the virtual network that executes the POST request, validates the header, and calls TrackAvailability() with a managed identity configured with Key Vault Secrets User permissions.
The correct answer correctly identifies that a custom availability monitoring solution is necessary because Standard availability tests do not support response header validation. It also correctly utilizes `TelemetryClient.TrackAvailability()` with `AvailabilityTelemetry` to send availability metrics, and assigns the correct data plane RBAC role (`Key Vault Secrets User`) to allow the Azure Function's managed identity to read the connection string from Key Vault.

Adım Adım Çözüm

1
Determine the type of availability test required.
Standard availability tests in Application Insights do not support response header validation. Therefore, a custom availability test via SDK is required.
Standard tests only allow validating the HTTP status code, response body contents, and SSL certificate status.
2
Implement the custom availability test.
Create an Azure Function that runs on a timer trigger, sends the POST request, asserts the response headers, and reports results using `TelemetryClient.TrackAvailability`.
This registers the custom test runs in the Application Insights Availability database and populates the availability dashboard.
3
Configure secure secret access.
Assign the system-assigned managed identity of the Azure Function the Key Vault Secrets User RBAC role to fetch the Application Insights Connection String.
The function requires data plane access (Secrets User) to read secrets, not management plane access (Contributor).

Anahtar Kavram

Application Insights Custom Availability Monitoring using TrackAvailability and TelemetryClient
Soru 654Soru →

You are developing a solution that uses Azure Event Grid to route system events from an Event Grid custom topic to a Webhook. You must ensure that any events that cannot be delivered are routed to a container named "deadletters" in an Azure Storage account named "mystorage2026". The solution must secure access to the storage account by using a system-assigned managed identity associated with the custom topic. Which four actions should you perform in sequence? To answer, arrange the actions in the correct order.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

To configure Event Grid dead-lettering using a system-assigned managed identity, you must first enable the system-assigned managed identity on the Event Grid custom topic. Next, assign the Storage Blob Data Contributor role to the custom topic's managed identity at the scope of the destination storage account. Then, create the Event Grid event subscription with dead-lettering configured to the target blob container. Finally, configure the event subscription's dead-letter identity settings to use the System Assigned identity type.
First, the system-assigned identity must be enabled on the Event Grid custom topic so that an identity object is registered in Microsoft Entra ID. Second, the newly created identity must be granted the Storage Blob Data Contributor role on the storage account so it has permission to write logs. Third, the event subscription must be created with dead-lettering enabled pointing to the destination container. Finally, the event subscription's dead-letter identity setting must be configured to use the System Assigned identity to route requests securely.

Adım Adım Çözüm

1
Enable the system-assigned managed identity for the Event Grid custom topic.
A system-assigned identity is created in Microsoft Entra ID for the custom topic, yielding an identity principal.
You must create the managed identity principal before you can assign RBAC roles to it or use it for authentication.
2
Assign the Storage Blob Data Contributor role to the custom topic's managed identity on the storage account.
The identity principal is granted write permissions on the Azure Storage account.
Event Grid needs the Storage Blob Data Contributor role to write undelivered events to the dead-letter blob container.
3
Create the Event Grid event subscription and specify the dead-letter endpoint pointing to the deadletters blob container.
The event subscription is created with the specified active event destination and dead-letter destination.
This establishes the event delivery routing rules and designates the fallback container for failed events.
4
Configure the event subscription's dead-letter identity settings to use the System Assigned identity type.
The subscription is configured to authenticate write requests to the dead-letter storage account using the custom topic's system-assigned identity.
By default, Event Grid uses SAS tokens to write to the dead-letter container. To use the managed identity, you must explicitly configure the identity settings on the subscription.

Anahtar Kavram

Configuring Event Grid dead-lettering with managed identities
Soru 655Soru →

A logistics company runs a warehouse management system that processes package delivery messages from an Azure Service Bus queue. The processing application must meet the following requirements:
- Ensure that messages are only removed from the queue after they are successfully processed.
- If the application crashes or fails during processing, the message must automatically become visible to other instances of the receiver after the lock duration expires.
- Follow the principle of least privilege for security configuration.

Which two actions should you perform to implement this solution? (Select two.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configure the ServiceBusReceiver to use PeekLock receive mode.; Call the CompleteMessageAsync method after successful message processing.

Cevap

Configure the receiver to use PeekLock receive mode, and call the CompleteMessageAsync method after successful message processing.
To satisfy the reliability requirement, the receiver must retrieve messages using the PeekLock receive mode, which locks the message temporarily instead of deleting it immediately. Once the message is successfully processed, the client must explicitly call CompleteMessageAsync to delete the message from the queue. This ensures that if the application crashes, the lock will expire and the message will reappear in the queue for processing.

Adım Adım Çözüm

1
Determine the correct message receive mode for reliable processing.
PeekLock mode must be used.
PeekLock ensures the message is locked on the queue rather than deleted, allowing recovery if the receiver crashes.
2
Determine how to complete the message lifetime on successful processing.
Call CompleteMessageAsync.
Calling CompleteMessageAsync deletes the locked message from the queue after processing is successfully finished.

Anahtar Kavram

Azure Service Bus Queue Message Processing Modes
Soru 656Soru →

You are developing a C# console application that updates the metadata of a block blob in Azure Blob Storage. The application uses the Azure.Storage.Blobs SDK (version 12). To prevent other processes from modifying the blob during the update, you must acquire a write lease on the blob, perform the metadata update, and then release the lease.

Which five actions should you perform in sequence? To answer, arrange the actions in the correct order.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

To perform a leased metadata update, you first instantiate a BlobClient, then create a BlobLeaseClient from it, acquire the lease, call SetMetadataAsync using a BlobRequestConditions containing the lease ID, and finally call ReleaseAsync to release the lease.
The correct sequence starts with instantiating a BlobClient to reference the blob. Next, a BlobLeaseClient is created from the BlobClient. The lease is then acquired using AcquireAsync. Once the lease is active, SetMetadataAsync is called with BlobRequestConditions containing the lease ID. Finally, the lease is released using ReleaseAsync.

Adım Adım Çözüm

1
Create a BlobClient instance.
Establishes a programmatic reference to the target blob.
Required to create the BlobLeaseClient and perform operations.
2
Instantiate a BlobLeaseClient using the BlobClient.
Creates a client capable of managing leases on the target blob.
Leases cannot be managed directly through the standard BlobClient.
3
Invoke AcquireAsync on the BlobLeaseClient.
Secures an exclusive write lock (lease) on the blob and returns a lease ID.
Prevents concurrent write operations from other clients.
4
Call SetMetadataAsync on the BlobClient, passing the metadata dictionary and a BlobRequestConditions object containing the lease ID.
Applies the metadata updates to the blob.
Because the blob is leased, any write operation must supply the active lease ID to succeed.
5
Invoke ReleaseAsync on the BlobLeaseClient.
Unlocks the blob, allowing subsequent access by other processes.
Ensures the resource is not locked indefinitely.

Anahtar Kavram

Acquiring a write lease, updating blob metadata with request conditions, and releasing the lease using the Azure SDK for .NET.
Soru 657Soru →

A developer is configuring an Azure API Management (APIM) instance to expose a backend API. The backend API includes a custom response header named `X-Backend-Version` that contains sensitive version information. The developer needs to remove this header from all responses before they are returned to the client. In which policy section must the policy to remove this header be placed?

Cevabı ve açıklamayı göster

Cevap: outbound

Cevap

outbound
The outbound section in Azure API Management policies is specifically designed to intercept and modify the response returned by the backend service before it is delivered to the client. Therefore, policies like set-header (with an action to delete) must be placed in the outbound section to remove the X-Backend-Version header from the response.

Adım Adım Çözüm

1
Identify the stage of the API Management request-response pipeline where the backend response is processed.
The response has been received from the backend but has not yet been sent to the client.
We need to remove a header from the backend's response before the client receives it.
2
Map the identified stage to the corresponding APIM policy section.
The stage maps to the outbound policy section.
The outbound section handles outgoing response modification.

Anahtar Kavram

Azure API Management policy sections control the timing and context of policy execution. The inbound section modifies incoming requests, backend controls forwarding, outbound modifies responses, and on-error handles exceptions.
Soru 658Soru →

You are developing a C# background service that processes real-time transaction updates from an Azure Cosmos DB container using the .NET SDK v3 Change Feed Processor.

You need to initialize and run the Change Feed Processor.

In which order should you execute the steps? To answer, move all actions from the list of actions to the answer area and arrange them in the correct order.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence of steps to initialize and start the Change Feed Processor is: 1) Obtain container references; 2) Call GetChangeFeedProcessorBuilder on the monitored container; 3) Chain configuration methods; 4) Call Build to create the processor instance; and 5) Call StartAsync to start processing notifications.
To configure the Change Feed Processor, you first get references to both containers. Then, you call `GetChangeFeedProcessorBuilder` on the monitored container. Next, you configure it by chaining configuration options like the lease container and host instance name. After configuration, you build the processor, and finally, you call `StartAsync` to begin receiving change notifications.

Adım Adım Çözüm

1
Obtain container references
References to the monitored and lease containers are available.
Both container references are required during the builder configuration process.
2
Initialize the builder
A ChangeFeedProcessorBuilder instance is created.
The builder must be obtained from the monitored container reference while specifying the processor name and delegate.
3
Configure the builder
Lease container and instance name settings are applied to the builder.
These settings are required for the processor to manage leases and identify individual processor hosts.
4
Build the processor
A ChangeFeedProcessor instance is created.
The Build method consumes the configuration and instantiates the processor class.
5
Start the processor
The Change Feed Processor begins listening and processing updates.
StartAsync is needed to trigger the lease acquisition and start the change feed polling loop.

Anahtar Kavram

Initializing the Azure Cosmos DB Change Feed Processor using the .NET SDK v3.
Soru 659Soru →

You are configuring a multi-tenant web application registration in Microsoft Entra ID. The application must allow users from any organizational Microsoft Entra ID tenant to sign in, but it must explicitly block users signing in with personal Microsoft accounts (such as outlook.com or hotmail.com). Which two configurations should you implement to satisfy this requirement? (Select two)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Set the signInAudience parameter in the application manifest to AzureADMultipleOrgs; Configure the authority endpoint in the application code to use the /organizations tenant placeholder

Cevap

To configure a multi-tenant application to accept only organizational accounts while excluding personal accounts, you must set the signInAudience parameter to AzureADMultipleOrgs in the manifest and route authentication requests to the /organizations endpoint.
To limit access strictly to work or school accounts across any Microsoft Entra ID tenant, the application manifest must define the sign-in audience as AzureADMultipleOrgs. Correspondingly, client applications must request authorization from the /organizations endpoint to prevent personal accounts from being evaluated.

Adım Adım Çözüm

1
Select the appropriate sign-in audience for organizational accounts.
The signInAudience property in the application registration manifest must be set to AzureADMultipleOrgs.
This configuration allows users from any Entra ID tenant (work or school accounts) to authenticate while blocking personal Microsoft accounts.
2
Determine the correct authorization authority endpoint.
The authority URL must use the /organizations endpoint instead of /common.
The /organizations endpoint restricts authentication to Entra ID organizational tenants only, whereas /common would also allow personal Microsoft accounts.

Anahtar Kavram

Configuring multi-tenant sign-in audiences and authority endpoints in Microsoft Entra ID
Tahmini Süre:1m 30s
Soru 660Soru →

An online retail inventory application is hosted on an Azure Virtual Machine (VM) and uses a C# worker service with the Azure.Messaging.EventHubs.Processor library to consume messages from an Azure Event Hub. The application uses a system-assigned managed identity to authenticate and utilizes an Azure Blob Storage container as a checkpoint store for partition load balancing. When the service starts up, it connects to the Event Hub successfully but fails to process partitions, throwing an error indicating that it is unauthorized to perform operations on the blob checkpoint container. You need to configure the minimal permissions required to allow the EventProcessorClient to initialize, manage partition leases, and write checkpoints. Which of the following actions should you perform?

Cevabı ve açıklamayı göster

Cevap: Assign the Storage Blob Data Contributor role to the VM's system-assigned managed identity at the scope of the checkpoint blob container.

Cevap

Assign the Storage Blob Data Contributor role to the VM's system-assigned managed identity at the scope of the checkpoint blob container.
The correct answer is to assign the Storage Blob Data Contributor role to the VM's system-assigned managed identity at the scope of the checkpoint blob container. The EventProcessorClient uses Azure Blob Storage as a collaborative coordinator to distribute partitions dynamically and record progress (checkpointing). This process requires the client to create blobs, modify their contents, and manage leases. The Storage Blob Data Contributor role provides the data plane permissions necessary to perform these operations while adhering to the principle of least privilege by scoping it to the specific container.

Adım Adım Çözüm

1
Identify the operation being performed by the application client.
The application uses EventProcessorClient which manages partition ownership leases and writes checkpoints in Azure Blob Storage.
Understanding the tasks performed by the client helps determine the required permissions.
2
Determine the required storage operations for these tasks.
The client must be able to read, write, create, and modify metadata (including leasing) on blobs in the checkpoint container.
Checkpointing and partition ownership require active write and lease operations, not just read access.
3
Map the required operations to the least privilege Azure Role-Based Access Control (RBAC) role.
The Storage Blob Data Contributor role provides read, write, and delete access to blob data, which covers all the client's requirements.
Adhering to the principle of least privilege ensures security boundaries are maintained while providing functional access.

Anahtar Kavram

To enable EventProcessorClient checkpointing and partition lease management using a managed identity, the identity must be granted the Storage Blob Data Contributor role at the storage container scope.
ÖncekiSayfa 33 / 49Sonraki
Tüm alıştırma soruları — Microsoft Azure Developer (AZ-204) | Examkin