Tüm alıştırma soruları

You are developing a .NET console application that uses the Azure.Storage.Blobs SDK to migrate security logs from a private container in a source storage account to a container in a destination storage account. The source storage account has public access disabled, and the migration must be done programmatically. Which two actions should you perform to copy the log blob to the destination storage account?

An organization requires an Azure API Management (APIM) instance to securely retrieve a database password from an Azure Key Vault secret. The password will be exposed to API policies via a Named Value. You must use a user-assigned managed identity named apim-identity to authenticate from the APIM instance to the Key Vault.

Which two configurations should you implement to achieve this? (Choose two.)

A backend data ingestion service runs on an Azure Virtual Machine Scale Set (VMSS) with a minimum capacity of $2$ instances and a maximum capacity of $10$ instances. You need to configure autoscale rules based on the CPU percentage metric. The scale-out rule increases the capacity by $1$ instance, and the scale-in rule decreases the capacity by $1$ instance. Which of the following autoscale rule pairs will successfully prevent flapping when the VMSS is operating at its minimum capacity? (Select TWO)

You are implementing an event consumer application in C# using the Azure.Messaging.EventHubs.Processor library. The application will run on multiple virtual machine instances to process events from an Event Hub named telemetry-hub.

You need to configure the EventProcessorClient instances so that:
- The event processing load is distributed dynamically across all running virtual machine instances.
- Each partition is processed by only one active instance at any given time.
- Processing can resume from the last known state after an application restart or instance failure.

Which configuration strategy should you implement?

You are developing an application using the .NET Azure.Storage.Blobs SDK (version 12) to copy a blob from a source container to a destination container. The destination blob already exists and is locked with an active, exclusive write lease. You possess the lease ID for the destination blob. Which of the following approaches should you use to successfully perform the copy operation?

You are developing a backend processing service that runs on an Azure App Service plan named `asp-worker` (currently on the Standard S1 tier). The service processes messages from an Azure Service Bus queue named `task-queue` within a Service Bus namespace named `sb-namespace-prod`.

You need to configure an Azure Monitor autoscale rule to increase the instance count of `asp-worker` when the volume of unprocessed tasks increases.

How should you configure the scale-out metric trigger?

Your organization is migrating the permission model of an Azure Key Vault named `kv-payment-prod` to use the Azure role-based access control permission model instead of Vault access policies. An Azure App Service web application named `app-payment-prod` uses a system-assigned managed identity to retrieve database connection secrets from this Key Vault. Immediately after you change the permission model to Azure RBAC, the web application fails to retrieve secrets, returning a `403 Forbidden` error. Which action should you perform to restore the application's access to the secrets while adhering to the principle of least privilege?

You are configuring an Azure App Service web application to retrieve a third-party payment provider API key stored as a secret in Azure Key Vault. The Key Vault, named kv-payment-prod, is configured to use the Azure role-based access control (Azure RBAC) permission model. The web application uses a system-assigned managed identity for authentication. You must reference the Key Vault secret directly within the App Service application settings under a setting named PaymentApiKey. You must follow the principle of least privilege. Which action should you perform to configure the application setting and permissions?

You are configuring security for an Azure Blob Storage container named `partner-imports` that multiple external clients use to upload diagnostic data. Each client requires write-only permissions. You must ensure that you can immediately revoke access for any individual client if their credentials are leaked, without affecting other clients and without rotating the storage account access keys. Which configuration should you use?

You are configuring Azure Monitor autoscale rules for an Azure App Service plan named `asp-payment` that currently runs a critical web API on $4$ instances. The minimum instance count is configured as $4$, and the maximum is $10$.

You have already configured the scale-out rule as follows:
* Metric: CPU Percentage
* Time aggregation: Average
* Duration (Time window): $10$ minutes
* Operator: Greater than
* Threshold: $75\%$
* Operation: Increase count by $2$

You need to configure the scale-in rule to decrease the instance count by $1$ when the workload decreases, while ensuring that the configuration does not cause autoscale flapping under a constant workload.

Which of the following configurations should you select? (Select TWO)

You have a Standard tier Azure API Management (APIM) instance named apim-service with the default gateway URL apim-service.azure-api.net. You need to configure a custom domain api.contoso.com for the gateway endpoint. The TLS certificate must be managed and automatically renewed by Azure. Which sequence of steps should you perform to configure the custom domain?

You are authoring a Bicep template to deploy a new Azure Key Vault. The Key Vault must meet the following security requirements:

* Use Azure Role-Based Access Control (RBAC) for authorization instead of vault access policies.
* Prevent the permanent deletion of the Key Vault, its secrets, keys, and certificates by any user, including administrators.

Which two properties must you configure within the `properties` block of the Key Vault resource definition?

You are developing a C# transaction ingestion service that processes events from an Azure Event Hub. The service is built using the Azure.Messaging.EventHubs.Processor library and runs on multiple host instances. During performance testing, you encounter lease conflict exceptions when host instances scale up. You need to ensure that the checkpoint store is configured correctly and that partition ownership is managed properly. Which of the following describes the correct storage configuration and client behavior for implementing checkpointing with the EventProcessorClient?

You are implementing a method in a C# application using the `Azure.Storage.Blobs` SDK (v12) to generate a temporary upload URI for a client. The client must be allowed to upload a single blob named `report.pdf` to a container named `documents`.

The implementation must meet the following security requirements:
- Limit permissions strictly to uploading the specified blob.
- Enforce the HTTPS protocol for the upload request.
- Sign the SAS using Microsoft Entra ID credentials rather than the storage account's shared access key.
- Prevent authentication failures due to clock skew between the client and Azure Storage.

You have the following code segment:

csharp
var credential = new DefaultAzureCredential();
var blobServiceClient = new BlobServiceClient(
new Uri("https://mystorage.blob.core.windows.net"),
credential
);

// [Block 1]

var sasBuilder = new BlobSasBuilder()
{
BlobContainerName = "documents",
BlobName = "report.pdf",
Resource = "b",
// [Block 2]
};
sasBuilder.SetPermissions(BlobSasPermissions.Write);

Which of the following code segments should you use to complete the implementation? (Select two.)

You are designing autoscale rules for several Azure solutions to optimize performance and prevent rapid oscillation (flapping). Match each Azure Monitor autoscale configuration setting on the left to the corresponding workload requirement it satisfies on the right.

You are developing a C# background service that processes high-volume telemetry data from an Azure Event Hub using the EventProcessorClient class. The background service runs across multiple instances in an Azure App Service plan, and you must use Azure Blob Storage for checkpointing and load balancing partition ownership. Some telemetry payloads can occasionally exceed 64 KB. You need to configure the authentication and storage access for the application while ensuring it can handle the payload sizes and follow security best practices. Which configuration and authentication approach should you implement to meet these requirements?

You are developing a C# command-line interface (CLI) tool that will be executed by system administrators on headless Linux servers. The tool must authenticate the administrators using their individual Microsoft Entra ID credentials to access a secure downstream Web API. The administrators' accounts have multi-factor authentication (MFA) enabled. Which MSAL.NET method should you use to acquire the token?

You are developing an API gateway solution using Azure API Management (APIM). You have a backend API hosted on an Azure App Service that is secured with Microsoft Entra ID. You want to configure APIM to authenticate to the backend API using the APIM instance's system-assigned managed identity. Which of the following configurations and actions should you use to implement this authentication mechanism?

An energy management company is deploying a distributed system to monitor smart meter readings. Telemetry data is streamed to an Azure Event Hub, and you must build a C# subscriber application using the Azure.Messaging.EventHubs SDK to process the data in parallel across multiple virtual machine instances. The application must ensure that partitions are balanced dynamically among the running instances and that event processing resumes from the last known checkpoint in the event of an instance failure. Which of the following actions are required to implement the event consumer using the EventProcessorClient class? Select two.

You are developing a C# console application that will run on multiple Azure Virtual Machines. The application must authenticate to the Microsoft Identity Platform and access Microsoft Graph using a managed identity. Because the application runs on multiple virtual machines, they must all share the same managed identity. You use MSAL.NET to implement the authentication code. You write the following code:

csharp
string clientId = "00000000-0000-0000-0000-000000000000";
string resource = "https://graph.microsoft.com";

// Initialize the managed identity application
IManagedIdentityApplication app = [Snippet 1]
.Build();

// Acquire the token
AuthenticationResult result = await app.[Snippet 2]
.ExecuteAsync();

Which two code segments should you use to complete the implementation? (Select two.)