Tüm alıştırma soruları

An organization is designing an Azure Resource Manager (ARM) template to deploy a multi-container group to Azure Container Instances (ACI). The deployment must satisfy the following requirements:
- The container group must pull a custom web application image from a private Azure Container Registry (ACR) named `myregistry.azurecr.io`.
- Both containers in the group must retrieve database connection strings from Azure Key Vault at startup without using hardcoded credentials.
- The deployment must utilize managed identities to authenticate against both the ACR and the Key Vault, adhering to the principle of least privilege.

Which configuration strategy should you implement in the template and Azure roles?

You are planning a serverless processing solution using Azure Functions. You need to configure the hosting plans and execution patterns for your function app. Which of the following statements are correct? (Select TWO)

An organization deploys an Azure App Service web app named `app-retail` with a production slot and a deployment slot named `staging`. Each slot is configured with a system-assigned managed identity. You have two Azure Key Vaults:

* `kv-retail-prod` containing a secret named `DbConn`. The Key Vault access policy grants GET permissions to the production slot's system-assigned managed identity.
* `kv-retail-stage` containing a secret named `DbConn`. The Key Vault access policy grants GET permissions to the staging slot's system-assigned managed identity.

You configure the following application setting in both slots (without marking it as a deployment slot setting):

* Production slot: `DbConnectionString = @Microsoft.KeyVault(SecretUri=https://kv-retail-prod.vault.azure.net/secrets/DbConn/)`
* Staging slot: `DbConnectionString = @Microsoft.KeyVault(SecretUri=https://kv-retail-stage.vault.azure.net/secrets/DbConn/)`

You perform a standard deployment slot swap between the `staging` slot and the production slot. Immediately after the swap completes, you observe that the web app fails to connect to the database in both slots because the Key Vault references cannot be resolved.

Which of the following actions will resolve the Key Vault reference resolution failures while adhering to the principle of least privilege?

You are configuring an Azure App Service web app to securely retrieve database credentials from an Azure Key Vault. The solution must use a system-assigned managed identity to access the Key Vault without storing any credentials in the application code or settings.

Which two configuration steps should you perform?

You are configuring a self-hosted runner on an Azure Virtual Machine to build and push container images to an Azure Container Registry (ACR) named devregistry2026. You want to use a user-assigned managed identity to authenticate the Virtual Machine runner to the registry. Which two actions should you perform?

You are designing a serverless solution that uses Azure Functions V4 to process messages from an Azure Service Bus queue. The architecture must comply with the following operational and security requirements:
1. The Service Bus namespace is configured with a private endpoint, and all public network access is disabled.
2. The Function App must scale dynamically (including scaling to zero instances) based on the volume of messages in the queue.
3. No connection strings or secrets can be stored in the Function App settings or in Azure Key Vault.
4. The Function App must authenticate to the Service Bus namespace using a user-assigned managed identity named func-identity.

Which combination of hosting plan and application settings should you configure for the Function App?

Your organization uses an Azure Virtual Machine to run continuous deployment tasks. You need to configure the VM to push a locally built container image named `webapp:v1` to an Azure Container Registry (ACR) named `corpacr`.

To comply with security guidelines, you must not use admin credentials or service principal keys. Instead, you have configured the following:
- A system-assigned managed identity on the VM, which has only the `Reader` role on the resource group containing the ACR.
- A user-assigned managed identity named `cicd-identity` (Client ID: `11111111-2222-3333-4444-555555555555`), which has the `AcrPush` role on `corpacr`.

Which of the following command sequences should you execute on the Azure Virtual Machine to successfully authenticate and push the image to the registry?

An organization is deploying an Azure Function App on a Consumption plan to process messages from an Azure Queue Storage queue. To avoid overwhelming a downstream legacy database, you must implement the following constraints:

1. Restrict the maximum scale-out of the function app instances to a specific limit.
2. Control the maximum number of messages that a single instance can process concurrently.

Which two configurations should you apply to meet these requirements?

A developer needs to push a locally built container image to a private Azure Container Registry (ACR) named contosoacr. The developer is already authenticated to their Azure subscription using the Azure CLI on their local workstation. Which command should the developer run on their workstation to authenticate the local Docker CLI to the registry using their active Azure CLI session?

An administrator has created an Azure Container Registry named `contosoregistry`. On your local machine, you have a Docker image named `webapp:v1` that is tagged as `contosoregistry.azurecr.io/webapp:v1`. You have successfully run `az acr login --name contosoregistry` to authenticate. Which command must you run to upload this image to your registry?

You are configuring an Azure App Service web app named `prod-webapp` to retrieve a database connection string from an Azure Key Vault named `prod-vault`. The secret in the Key Vault is named `DbConnectionString`. The web app must retrieve the secret using a user-assigned managed identity named `app-identity` (resource ID: `/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/myRG/providers/Microsoft.ManagedIdentity/userAssignedIdentities/app-identity`). No system-assigned identity is enabled on the web app. Which two of the following configurations are required to ensure the web app can successfully retrieve the secret? (Select TWO.)

You are configuring an Azure App Service web app named `app-billing-prod` to retrieve database credentials from an Azure Key Vault named `kv-billing-prod` using a user-assigned managed identity named `id-billing-prod`.

Which two of the following actions must you perform to configure the web app to resolve Key Vault references using the user-assigned managed identity?

A financial services company is deploying an event-driven application using Azure Functions V4. The application includes a function that processes incoming queue messages from an Azure Service Bus namespace. The security architecture mandates that the Function App must connect to the Service Bus namespace using its system-assigned managed identity, completely eliminating the use of connection strings, shared access signature (SAS) keys, or secrets. The Service Bus trigger in the function code is configured with Connection = "ServiceBusConnection". Which of the following configuration steps must be implemented to establish this identity-based connection? (Select TWO)

A developer is configuring an application setting in an Azure App Service web app to reference a secret stored in an Azure Key Vault named kv-prod. The secret is named db-conn-string. The web app has a system-assigned managed identity configured with appropriate permissions. Which syntax should the developer use as the value for the application setting to retrieve the latest version of the secret?

A developer needs to deploy an Azure Function that processes incoming sensor telemetry from a queue. The telemetry data arrives sporadically throughout the day. Each function execution takes less than 10 seconds to complete. The primary goal is to minimize costs by ensuring that billing occurs only when the function is actively running.

Which hosting plan should the developer select?

You are deploying a multi-container group to Azure Container Instances (ACI) using a YAML deployment file. The deployment consists of an application container and a logging sidecar container. The container images are hosted in a private Azure Container Registry (ACR). The application requires persistent storage provided by an Azure File share, and must authenticate to ACR using a user-assigned managed identity to avoid storing credentials in the YAML file. Which two of the following configuration blocks must you include in the YAML deployment definition to satisfy these requirements? (Select two.)

You are deploying an Azure Function App using the Azure Functions V4 runtime and a .NET isolated worker model on an Elastic Premium hosting plan. The function app is configured with a Service Bus queue trigger.

The Service Bus namespace is secured within a virtual network using a private endpoint, and public network access is disabled. The Function App has regional virtual network integration enabled on the same virtual network.

You need to configure the connection using the Function App's system-assigned managed identity instead of connection strings. Additionally, the Function App must scale out dynamically when the Service Bus queue length increases.

Which two configuration settings should you apply to the Function App?

You need to deploy a containerized application to Azure Container Instances (ACI) using the Azure CLI and verify that it has started successfully. Arrange the steps in the correct sequence to achieve this goal.

You are designing an Azure Cosmos DB container to store telemetry data from millions of IoT devices. The workload has a high-write throughput profile ($10,000$ writes per second) and reads are scoped to individual devices. You need to ensure that transactions are restricted to a single device's data, and that storage and Request Units (RUs) are distributed evenly to avoid hot partitions. Which property should you select as the partition key?

You are configuring an Azure Function App (V4) to retrieve messages from an Azure Service Bus queue using an identity-based connection. The Function App is configured with a user-assigned managed identity that has been granted the Azure Service Bus Data Receiver role on the Service Bus namespace. The trigger connection in the function code is named ServiceBusConnection. To ensure the Function App can successfully authenticate and connect using the user-assigned managed identity, which group of application settings must you configure?