Tüm alıştırma soruları

972 soru

Tüm türler972 Çoktan seçmeli497 Çoklu seçim269 Eşleştirme9 Sıralama171 Boşluk doldurma26

A development team is building a native C# client application that runs on domain-joined user workstations. The application needs to request an access token from the Microsoft Identity Platform to query a secure downstream Web API. The solution must support user accounts from any Microsoft Entra ID tenant as well as personal Microsoft accounts. Which approach should the team use to initialize the client application and configure authentication?

Grant access to a shared client secret using a Key Vault access policy and initialize the application using ConfidentialClientApplicationBuilder.

Configure a system-assigned managed identity for the user workstations and initialize the application using ManagedIdentityApplicationBuilder.

Initialize the client application using PublicClientApplicationBuilder.Create(clientId).WithAuthority(AzureCloudInstance.AzurePublic, "common").Build();

Generate a Shared Access Signature (SAS) token for the Web API and configure the client application to authenticate using the token.

Cevabı ve açıklamayı göster

Cevap: Initialize the client application using PublicClientApplicationBuilder.Create(clientId).WithAuthority(AzureCloudInstance.AzurePublic, "common").Build();

Cevap

Initialize the client application using PublicClientApplicationBuilder.Create(clientId).WithAuthority(AzureCloudInstance.AzurePublic, "common").Build();

The correct answer initializes the client application as a public client application. Applications running on desktop computers are classified as public clients since they cannot keep client secrets confidential. The 'common' authority endpoint supports logging in users from any organizational directory (multi-tenant) as well as personal Microsoft accounts.

Adım Adım Çözüm

Determine the client application type based on the execution environment.

Identify that the application runs on user workstations, which makes it a public client application because it cannot securely store secrets.

Public client applications must be initialized using PublicClientApplicationBuilder in MSAL.NET.

Identify the required identity providers and tenants for user login.

The requirement specifies supporting both work/school accounts from any tenant and personal Microsoft accounts.

The 'common' authority audience endpoint is designed to support both multi-tenant Entra ID organizations and personal consumer accounts.

Combine the builder type and authority configuration into the initialization code.

Instantiate the client app using PublicClientApplicationBuilder.Create(clientId).WithAuthority(AzureCloudInstance.AzurePublic, "common").Build().

This correctly configures the MSAL client for public interactive authentication with the widest account support.

Anahtar Kavram

MSAL.NET client application classification and authority selection

Soru 802Soru →

An enterprise client communicates with an API hosted in Azure API Management (APIM). You must implement two security requirements:
1. Validate that the client presents a client certificate containing an authorized thumbprint.
2. Accept the subscription key in a custom HTTP header named `X-API-Signature` instead of the default header.

Which two configuration actions should you perform to meet these requirements?

Geçerli olan tümünü seçin

Configure the `validate-client-certificate` policy in the `inbound` section of the API policy configuration, specifying the allowed client certificate thumbprints.

Configure the API settings in the Azure portal or ARM template to use the custom HTTP header named `X-API-Signature` for subscription key validation.

Add the `validate-client-certificate` policy to the `outbound` section of the API policy configuration.

Configure the `authentication-certificate` policy in the inbound section, referencing a certificate stored in Azure Key Vault without configuring Key Vault access policies to grant the APIM instance GET permissions.

Cevabı ve açıklamayı göster

Cevap: Configure the `validate-client-certificate` policy in the `inbound` section of the API policy configuration, specifying the allowed client certificate thumbprints.; Configure the API settings in the Azure portal or ARM template to use the custom HTTP header named `X-API-Signature` for subscription key validation.

Cevap

Configure the validate-client-certificate policy in the inbound section of the API policy configuration, and configure the API settings to use the custom HTTP header for subscription key validation.

To secure the APIM endpoint with the client certificate, you must configure the validate-client-certificate policy within the inbound section of the policy file. Additionally, to change the header name where APIM expects the subscription key, you must modify the Subscription key header name setting in the API settings configuration.

Adım Adım Çözüm

Place client certificate validation in the inbound request flow.

The APIM gateway will inspect the TLS handshake, extract the client certificate, and validate it against the configured thumbprint before forwarding requests to the backend.

Request validation policies must run in the inbound section to filter unauthorized client requests early.

Modify the API configuration settings to use a custom subscription header.

APIM will look for the subscription key in the custom `X-API-Signature` header instead of the default `Ocp-Apim-Subscription-Key` header.

Updating the header name in the API settings updates the metadata configuration telling APIM where to look for subscription keys.

Anahtar Kavram

Securing APIM gateway endpoints using client certificates and customizing subscription key validation headers.

Tahmini Süre:2m 0s

Soru 803Soru →

Complete the C# code below to define a custom telemetry processor that filters out successful dependency telemetry and register it within the ASP.NET Core dependency injection container.

Aşağıdaki boşlukları doldurun

public class DependencyFilter :
{
private ITelemetryProcessor Next { get; set; }

public DependencyFilter(ITelemetryProcessor next)
{
this.Next = next;
}

public void Process(ITelemetry item)
{
if (item is DependencyTelemetry dependency && dependency.Success == true)
{
return; // Filter out
}
this.Next.Process(item);
}
}

// In Program.cs:
var builder = WebApplication.CreateBuilder(args);
builder.Services.AddApplicationInsightsTelemetry();
builder.Services.<DependencyFilter>();

Cevabı ve açıklamayı göster

Cevap

Implement the ITelemetryProcessor interface for the filter class, and register the class in the ServiceCollection using the AddApplicationInsightsTelemetryProcessor extension method.

To create a custom telemetry filter, the class must implement ITelemetryProcessor and its Process method. To register it in an ASP.NET Core application, use the AddApplicationInsightsTelemetryProcessor service extension method. This registers the processor so it is executed for every telemetry item passing through the telemetry pipeline.

Adım Adım Çözüm

Identify the interface required to implement a custom telemetry filtering mechanism in Application Insights.

The correct interface is ITelemetryProcessor, which defines the Process method.

ITelemetryProcessor is the standard interface in the Application Insights SDK for custom telemetry filters that run in the telemetry pipeline.

Identify the service collection extension method used to register the custom telemetry processor.

The correct extension method is AddApplicationInsightsTelemetryProcessor.

This method ensures that the telemetry processor is correctly integrated into the Application Insights pipeline along with dependency injection dependencies.

Anahtar Kavram

Custom Telemetry Filtering using ITelemetryProcessor and AddApplicationInsightsTelemetryProcessor in ASP.NET Core

Soru 804Soru →

An organization operates a logistics portal where external partner drivers submit location updates. You are configuring an Azure Queue Storage queue named `fleet-updates` to receive these updates. You need to provide the partner application with a Shared Access Signature (SAS) token that allows it to submit new location update messages. The partner application must not be able to view, modify, or delete any other messages in the queue. Which queue permission should you assign to the SAS token to meet this requirement?

Write

Add

Update

Process

Cevabı ve açıklamayı göster

Cevap: Add

Cevap

The Add permission is the correct choice because it allows the partner application to submit new messages to the queue without granting permissions to read, update, or delete existing messages.

The Add permission allows a client to add messages to the queue. This is the least privilege permission that fulfills the requirement to submit new messages while restricting the client from reading or deleting existing messages.

Adım Adım Çözüm

Identify the operation needed by the partner application.

The application needs to submit (enqueue) new location updates.

This determines the minimal functional capability required.

Determine least privilege constraints.

The application must not read (dequeue or peek) or modify existing messages in the queue.

This rules out permissions like Read, Update, and Process.

Map the requirement to Azure Queue Storage SAS permissions.

The 'Add' permission allows writing new messages. 'Write' is not a valid permission for Queue Storage, and other permissions grant excessive rights.

Selecting the correct permission ensures security compliance and functional correctness.

Anahtar Kavram

Azure Queue Storage SAS Permissions

Soru 805Soru →

You are developing a C# .NET 8 Azure Function in an isolated worker process. You configure custom telemetry tracking in the function app using Dependency Injection in the `Program.cs` file. However, during runtime, you find that custom telemetry generated via `TelemetryClient` is not being sent to Azure Monitor because the connection string is missing or not bound correctly in the SDK setup.

You have the following code in your `Program.cs` file:

csharp
var host = new HostBuilder()
.ConfigureFunctionsWorkerDefaults()
.ConfigureServices((context, services) =>
{
services.AddApplicationInsightsTelemetryWorkerService(options =>
{
// Line X
});
})
.Build();

await host.RunAsync();

Which of the following lines of code should you insert at `Line X` to correctly bind the connection string from configuration?

options.ConnectionString = context.Configuration["APPLICATIONINSIGHTS_CONNECTION_STRING"];

options.InstrumentationKey = context.Configuration["APPINSIGHTS_INSTRUMENTATIONKEY"];

options.InstrumentationKey = context.Configuration["APPLICATIONINSIGHTS_CONNECTION_STRING"];

TelemetryConfiguration.Active.ConnectionString = context.Configuration["APPLICATIONINSIGHTS_CONNECTION_STRING"];

Cevabı ve açıklamayı göster

Cevap: options.ConnectionString = context.Configuration["APPLICATIONINSIGHTS_CONNECTION_STRING"];

Cevap

options.ConnectionString = context.Configuration["APPLICATIONINSIGHTS_CONNECTION_STRING"];

The correct option sets the ConnectionString property on the options object using the value retrieved from the host context configuration. This ensures that the Application Insights telemetry client, which is resolved via dependency injection in the Azure Function, has the correct endpoint and key settings to route telemetry to Azure Monitor.

Adım Adım Çözüm

Identify the target SDK configuration model in .NET 8 worker/function environments.

The SDK relies on ApplicationInsightsServiceOptions registered during AddApplicationInsightsTelemetryWorkerService.

We must configure these options inside the delegate parameter of AddApplicationInsightsTelemetryWorkerService to set the connection string correctly.

Choose the correct property name to set.

ConnectionString must be set instead of the deprecated InstrumentationKey property.

Modern Azure Monitor SDKs require ConnectionString to properly support telemetry routing, ingestion endpoints, and security mechanisms.

Bind the configuration value from the builder host context.

Access context.Configuration with the key 'APPLICATIONINSIGHTS_CONNECTION_STRING'.

This retrieves the connection string defined in host settings or local settings, ensuring the correct destination is configured.

Anahtar Kavram

Azure Monitor Application Insights C# SDK configuration using connection strings and Dependency Injection

Tahmini Süre:1m 30s

Soru 806Soru →

You are securing a backend API by routing requests through Azure API Management (APIM). The backend API is secured using Microsoft Entra ID and requires authentication. You need to configure APIM to authenticate to the backend API using the APIM instance's system-assigned managed identity.

Which policy configuration should you apply to meet this requirement?

<inbound>
<base />
<set-header name="Authorization" exists-action="override">
<value>@("Bearer " + "{{keyvault-token}}")</value>
</set-header>
</inbound>

Cevabı ve açıklamayı göster

Cevap: <inbound>
<base />
<authentication-managed-identity resource="api://mybackend" />
</inbound>

Cevap

The configuration that applies the authentication-managed-identity policy with only the resource attribute in the inbound section.

The correct configuration uses the authentication-managed-identity policy with only the resource attribute specified, placed in the inbound section. This instructs the APIM gateway to use its system-assigned managed identity to fetch a token for the specified resource and attach it to the inbound request before it is forwarded to the backend service.

Adım Adım Çözüm

Determine the authentication mechanism.

Use the authentication-managed-identity policy to obtain a token from Microsoft Entra ID.

This policy manages the acquisition and caching of the token automatically.

Configure the managed identity parameters.

Specify the resource attribute, but omit the client-id attribute.

Omitting the client-id or identity-id tells APIM to use the system-assigned managed identity rather than a user-assigned managed identity.

Determine the policy placement.

Place the authentication-managed-identity policy in the inbound section.

The policy must run before the request is dispatched to the backend service.

Anahtar Kavram

Securing backend services from APIM using managed identity authentication

Tahmini Süre:1m 30s

Soru 807Soru →

You are developing an ASP.NET Core web API hosted on Azure App Service (Linux). You need to configure the Application Insights SDK programmatically to send custom telemetry. You retrieve the connection string from Azure App Configuration. Additionally, you have implemented a custom telemetry initializer named `RegionTelemetryInitializer` to enrich all telemetry items with a `DeploymentRegion` property.

Which of the following configurations are required in the `Program.cs` file to ensure that custom telemetry is collected and properly enriched? (Select TWO)

Geçerli olan tümünü seçin

builder.Services.AddApplicationInsightsTelemetry(options => { options.ConnectionString = appSettings["AppInsightsConnectionString"]; });

builder.Services.AddSingleton<ITelemetryInitializer, RegionTelemetryInitializer>();

builder.Services.Configure<TelemetryConfiguration>(config => { config.InstrumentationKey = appSettings["AppInsightsConnectionString"]; });

builder.Services.AddSingleton<TelemetryClient>(new TelemetryClient(new TelemetryConfiguration { InstrumentationKey = appSettings["AppInsightsConnectionString"] }));

Cevabı ve açıklamayı göster

Cevap: builder.Services.AddApplicationInsightsTelemetry(options => { options.ConnectionString = appSettings["AppInsightsConnectionString"]; });; builder.Services.AddSingleton<ITelemetryInitializer, RegionTelemetryInitializer>();

Cevap

To configure Application Insights with a custom initializer, you must register Application Insights using AddApplicationInsightsTelemetry while specifying the ConnectionString property, and register your custom RegionTelemetryInitializer as a singleton of type ITelemetryInitializer.

Calling AddApplicationInsightsTelemetry and configuring the ConnectionString ensures the SDK successfully initializes and targets the correct Azure resource. Registering the custom initializer as a singleton of ITelemetryInitializer allows the SDK to automatically intercept and enrich all collected telemetry with the custom property.

Adım Adım Çözüm

Call AddApplicationInsightsTelemetry on builder.Services and supply the ConnectionString in the options delegate.

The Application Insights SDK is initialized with the correct connection string.

Connection strings are required to authenticate and route telemetry to the correct Log Analytics workspace.

The SDK automatically resolves the initializer from the DI container.

Registered telemetry initializers are automatically executed for every telemetry item created by the TelemetryClient.

Anahtar Kavram

Configuring Application Insights via ConnectionString and registering custom telemetry initializers using Dependency Injection in ASP.NET Core.

Tahmini Süre:2m 0s

Soru 808Soru →

You are securing an API hosted in Azure API Management (APIM). The security requirements specify that:
1. The API must only accept requests from a partner's public IP address: 203.0.113.50.
2. The APIM gateway must retrieve a shared secret stored in Azure Key Vault to authenticate the request against a legacy backend service.

You configure a system-assigned managed identity for the APIM instance. Which of the following actions must you perform to successfully implement this configuration? Select two.

Geçerli olan tümünü seçin

Configure the <ip-filter> policy within the <inbound> section of the API policy to allow the IP address 203.0.113.50.

Grant the APIM system-assigned managed identity Get secret permission in the Azure Key Vault access policy.

Configure the <ip-filter> policy within the <outbound> section of the API policy to restrict access to the IP address 203.0.113.50.

Create a user-assigned managed identity for APIM and grant access to the Key Vault, but configure APIM settings to use the system-assigned identity to retrieve the secret.

Cevabı ve açıklamayı göster

Cevap: Configure the <ip-filter> policy within the <inbound> section of the API policy to allow the IP address 203.0.113.50.; Grant the APIM system-assigned managed identity Get secret permission in the Azure Key Vault access policy.

Cevap

Configure the <ip-filter> policy within the <inbound> section of the API policy to allow the IP address 203.0.113.50, and grant the APIM system-assigned managed identity Get secret permission in the Azure Key Vault access policy.

Securing APIM inbound traffic requires applying the IP filter in the inbound policy processing phase, and retrieving secrets from Azure Key Vault requires granting the system-assigned managed identity permission to retrieve those secrets.

Adım Adım Çözüm

Determine the correct policy section for client IP address restriction.

Identify that incoming client requests must be evaluated before forwarding to the backend, which requires using the inbound policy section.

Placing ip-filter in inbound ensures unauthorized IPs are blocked immediately.

Configure the ip-filter policy details.

Write the policy configuration to allow 203.0.113.50 in the inbound section.

This implements the requirement to restrict access to the partner's IP address.

Configure the authorization access to retrieve the backend secret from Azure Key Vault.

Grant the Get secret permission specifically to the system-assigned managed identity of the APIM instance.

APIM requires access to Key Vault secrets to authenticate requests to the legacy backend service.

Anahtar Kavram

Securing API Management endpoints by applying inbound policies (ip-filter) and securely accessing backend credentials using Azure Key Vault and Managed Identities.

Tahmini Süre:1m 30s

Soru 809Soru →

You are developing a C# background service that runs on an Azure Virtual Machine and processes data files. The service needs to authenticate to an Azure Queue Storage queue named tasks-queue and enqueue processing tasks. Some task payloads are estimated to be around $128\text{ KB}$ in size. You must ensure that the solution adheres to the principle of least privilege, uses passwordless authentication where possible, and handles the task payloads successfully.

Which of the following designs should you implement?

Authenticate the queue client using a system-assigned managed identity via DefaultAzureCredential, store the

128\text{ KB}

payloads in Azure Blob Storage, and write the blob reference URL as the queue message.

Authenticate the queue client using a system-assigned managed identity via DefaultAzureCredential, and write the raw

128\text{ KB}

payload directly to the queue as a single message.

Authenticate the queue client using an account-level Shared Access Signature (SAS) token configured with full read, write, and delete permissions for the entire storage account.

Authenticate the queue client using a system-assigned managed identity that is shared across multiple independent Azure Virtual Machines running the background service.

Cevabı ve açıklamayı göster

Cevap: Authenticate the queue client using a system-assigned managed identity via DefaultAzureCredential, store the $128\text{ KB}$ payloads in Azure Blob Storage, and write the blob reference URL as the queue message.

Cevap

Authenticate the queue client using a system-assigned managed identity via DefaultAzureCredential, store the

128\text{ KB}

payloads in Azure Blob Storage, and write the blob reference URL as the queue message.

The correct design uses a system-assigned managed identity via DefaultAzureCredential to securely connect to the queue without credentials stored in code, satisfying the least privilege and passwordless requirements. Since the payload size is

128\text{ KB}

and exceeds the

64\text{ KB}

hard limit of Azure Queue Storage, the payload is offloaded to Azure Blob Storage, and a reference URL is written to the queue instead (the claim-check pattern).

Adım Adım Çözüm

Analyze the payload size constraint.

Since

128\text{ KB}

exceeds the

64\text{ KB}

Azure Queue Storage message size limit, the claim-check pattern must be used.

Azure Queue Storage cannot accept messages larger than

64\text{ KB}

directly.

Determine the authentication method conforming to least privilege.

A system-assigned managed identity via DefaultAzureCredential provides passwordless, scope-restricted authentication.

Managed identities avoid stored credentials and can be restricted to specific resources using Azure RBAC.

Verify identity sharing constraints.

A system-assigned managed identity is tied strictly to one VM instance and cannot be shared across multiple resources.

To share an identity across multiple VMs, a user-assigned managed identity would be required instead.

Anahtar Kavram

Handling large message payloads via Blob Storage and secure access using managed identities in Azure Queue Storage

Soru 810Soru →

An organization is securing a backend REST API by routing requests through Azure API Management (APIM). The backend API requires an API key in the request header for authorization. You store this API key as a secret in Azure Key Vault.

You need to configure APIM to retrieve this secret from Key Vault using a user-assigned managed identity named `apim-kv-identity`. You have already associated the user-assigned identity with the APIM instance.

Which configuration should you implement to retrieve the secret and pass it to the backend service?

Grant the user-assigned managed identity `apim-kv-identity` GET permissions on Key Vault secrets. In APIM, create a named value referencing the Key Vault secret URI and specify the user-assigned identity. In the <inbound> policy section, use the <set-header> policy to reference the named value.

Grant the APIM system-assigned managed identity GET permissions on Key Vault secrets. In APIM, create a named value referencing the Key Vault secret URI and specify the system-assigned identity. In the <inbound> policy section, use the <set-header> policy to reference the named value.

Grant the user-assigned managed identity `apim-kv-identity` GET permissions on Key Vault secrets. In APIM, create a named value referencing the Key Vault secret URI and specify the user-assigned identity. In the <outbound> policy section, use the <set-header> policy to reference the named value.

In APIM, create a named value referencing the Key Vault secret URI and specify the user-assigned identity. In the <inbound> policy section, use the <set-header> policy to reference the named value. Do not configure any additional access policies or roles on Key Vault, as associating the identity with APIM automatically grants access.

Cevabı ve açıklamayı göster

Cevap: Grant the user-assigned managed identity `apim-kv-identity` GET permissions on Key Vault secrets. In APIM, create a named value referencing the Key Vault secret URI and specify the user-assigned identity. In the <inbound> policy section, use the <set-header> policy to reference the named value.

Cevap

Grant the user-assigned managed identity `apim-kv-identity` GET permissions on Key Vault secrets, configure a named value in APIM referencing the Key Vault secret URI using that user-assigned identity, and use the `<set-header>` policy in the `<inbound>` section to reference the named value.

The correct configuration uses the user-assigned identity to securely fetch the backend API key secret from Key Vault via an APIM named value, and uses the `<set-header>` policy in the inbound section to add the key to the request sent to the backend. This ensures the key is protected in Key Vault and only retrieved when processing requests.

Adım Adım Çözüm

Grant Access to Key Vault

The user-assigned managed identity `apim-kv-identity` is granted GET permissions on Key Vault secrets via access policy or Azure RBAC.

Before APIM can fetch any secrets, the identity it uses must be authorized to read secrets from the Key Vault.

Create Named Value in APIM

A named value referencing the Key Vault secret URI is created and configured to authenticate using the user-assigned managed identity.

This allows APIM to fetch the secret value securely at runtime using the specified identity.

Configure the Inbound Policy

The `<set-header>` policy is added to the `<inbound>` section, referencing the named value to set the backend authorization header.

Injecting the header in the inbound section ensures the API key is included in the request sent to the backend service.

Anahtar Kavram

Securing backend services with Azure API Management using User-Assigned Managed Identity and Key Vault secret references in inbound policies.

Soru 811Soru →

You are developing an audit utility in C# that processes messages in an Azure Queue Storage queue named inventory-audit. The utility must read the content of up to 10 messages to log their metadata, but it must not lock the messages or make them invisible to other processing services. You are using the Azure.Storage.Queues SDK. Complete the code snippet below using explicit typing (do not use var) to retrieve the messages. Which code segments should you use to fill in the blanks?

Aşağıdaki boşlukları doldurun

QueueClient queueClient = new QueueClient(connectionString, "inventory-audit");

// Inspect up to 10 messages without changing their visibility
[] messages = (await queueClient.(maxMessages: 10)).Value;

Cevabı ve açıklamayı göster

Cevap

Use PeekedMessage for the array type in the first blank, and PeekMessagesAsync (or PeekMessages) for the queue client method in the second blank.

To inspect queue messages without acquiring a lease or modifying their visibility timeout, you must use the PeekMessagesAsync (or PeekMessages) method. This method returns a list of PeekedMessage objects, which represents the state of peeked messages (without pop receipt properties).

Adım Adım Çözüm

Determine the message retrieval requirement.

The utility needs to read messages without locking them or making them invisible to other consumers.

This requirement indicates that a peek operation must be used instead of a standard receive operation.

Select the correct SDK method.

The Azure.Storage.Queues SDK provides the PeekMessagesAsync method (or synchronous PeekMessages) to read messages without modifying their visibility timeout.

ReceiveMessagesAsync would retrieve the messages and set a visibility timeout, locking them from other consumers.

Select the correct return type.

The PeekMessagesAsync method returns a collection of PeekedMessage objects rather than QueueMessage objects.

PeekedMessage represents messages that have been peeked and do not contain lease-specific properties like a PopReceipt.

Anahtar Kavram

Reading Azure Queue Storage messages without changing visibility (peeking)

Soru 812Soru →

You are configuring a secure architecture where an Azure API Management (APIM) instance gateway forwards client requests to a backend API hosted on an Azure App Service. The backend App Service is configured to require Microsoft Entra ID authentication and expects an OAuth token. You want to authenticate the APIM instance to the backend App Service using its system-assigned managed identity. Which two actions should you perform? (Choose two.)

Geçerli olan tümünü seçin

Enable the system-assigned managed identity for the APIM instance.

Add the <authentication-managed-identity resource="https://myapi.azurewebsites.net" /> policy to the <inbound> section of the APIM policy.

Add the <authentication-managed-identity resource="https://myapi.azurewebsites.net" /> policy to the <outbound> section of the APIM policy.

Configure a user-assigned managed identity on the backend App Service and grant the APIM instance access to it.

Configure a Key Vault access policy to allow the backend App Service to retrieve the APIM instance client secret.

Cevabı ve açıklamayı göster

Cevap: Enable the system-assigned managed identity for the APIM instance.; Add the <authentication-managed-identity resource="https://myapi.azurewebsites.net" /> policy to the <inbound> section of the APIM policy.

Cevap

Enable the system-assigned managed identity for the APIM instance, and add the authentication-managed-identity policy with the resource URI to the inbound section of the APIM policy.

To authenticate to a backend service using a managed identity, you must first enable the system-assigned managed identity on the APIM instance. This enables the instance to request tokens from Microsoft Entra ID. Next, you must place the <authentication-managed-identity> policy in the inbound section of the APIM policy to request and attach the Entra ID token to the backend request.

Adım Adım Çözüm

Enable the system-assigned managed identity on the APIM instance resource.

This registers the APIM instance in Microsoft Entra ID and assigns it an identity.

The APIM instance requires an identity to request OAuth tokens.

Grant the APIM system-assigned managed identity the required role or access on the backend App Service.

Allows the backend service to validate and authorize the tokens presented by APIM.

The identity must have permission to access the backend resource.

Add the authentication-managed-identity policy to the inbound section of the APIM policy, specifying the resource URI of the backend service.

APIM requests a token for the specified resource and adds it to the authorization header before sending the request.

This policy must run before the request is forwarded to the backend.

Anahtar Kavram

Authenticating APIM with backend services using managed identity

Soru 813Soru →

You are designing a telemetry ingestion service that uses Azure Queue Storage to buffer patient monitoring logs. The data payload for each log entry varies, with some message payloads reaching up to $90\text{ KB}$ . When these larger payloads are sent to the queue, the client application throws an exception. Which strategy should you implement to resolve this exception?

Compress the log payload and store the compressed byte array within the queue's user-defined metadata properties using the QueueClient.SetMetadataAsync method.

Configure a system-assigned managed identity for the ingestion client and grant it the Storage Queue Data Contributor role to bypass the default message size limit.

Store the log payload in Azure Blob Storage and write only the blob URI as the queue message content.

Generate a service-level Shared Access Signature (SAS) token with Write permission, and append it to the QueueClient connection string to increase the message capacity.

Cevabı ve açıklamayı göster

Cevap: Store the log payload in Azure Blob Storage and write only the blob URI as the queue message content.

Cevap

Store the log payload in Azure Blob Storage and write only the blob URI as the queue message content.

The correct option correctly suggests storing the

90\text{ KB}

payload in Azure Blob Storage and writing only the blob's URI to the queue. This is a classic implementation of the Claim-Check pattern, which is standard for bypassing the strict

64\text{ KB}

message limit of Azure Queue Storage.

Adım Adım Çözüm

Identify the cause of the exception.

The telemetry data payload can reach up to

90\text{ KB}

, which exceeds the maximum limit of

64\text{ KB}

for Azure Queue Storage messages.

Understanding the physical constraints of Azure Queue Storage is necessary to select the correct architectural pattern.

Evaluate the architectural options for handling message payloads that exceed queue limits.

The Claim-Check pattern is the standard workaround, where large message payloads are stored in Azure Blob Storage and a reference to the blob is queued.

This allows clients to pass small pointer messages through the queue while preserving the full payload in a storage service that easily supports larger objects.

Implement the resolution.

Write the

90\text{ KB}

log payload to a blob, retrieve its URI, and submit that URI as the message string to Azure Queue Storage.

This allows the ingestion client to succeed without throwing exceptions while ensuring downstream consumers can resolve the original payload via the blob URI.

Anahtar Kavram

Handling large queue message payloads using the Claim-Check pattern with Azure Blob Storage.

Soru 814Soru →

A company requires that all requests routed from Azure API Management (APIM) to a backend Azure App Service be authenticated using Microsoft Entra ID. You create a user-assigned managed identity named `apim-backend-identity` and link it to the APIM instance. You must configure the APIM policy so that it automatically requests an OAuth token using the user-assigned identity and includes it in requests to the backend service. How should you configure the APIM policy?

Configure the `<authentication-managed-identity>` policy inside the `<outbound>` section of the API policy, specifying both the backend API's resource URI and the client ID of the user-assigned managed identity.

Configure the `<authentication-managed-identity>` policy inside the `<inbound>` section of the API policy, specifying only the backend API's resource URI and omitting the client ID or identity ID.

Configure the `<authentication-managed-identity>` policy inside the `<inbound>` section of the API policy, specifying both the backend API's resource URI and the client ID of the user-assigned managed identity.

Implement a `<set-header>` policy inside the `<inbound>` section that retrieves credentials from Azure Key Vault using the `@Microsoft.KeyVault(...)` reference syntax, without configuring access policies for the managed identity.

Cevabı ve açıklamayı göster

Cevap: Configure the `<authentication-managed-identity>` policy inside the `<inbound>` section of the API policy, specifying both the backend API's resource URI and the client ID of the user-assigned managed identity.

Cevap

To authenticate requests to a backend API using a user-assigned managed identity, you must configure the `<authentication-managed-identity>` policy within the `<inbound>` section. Because a user-assigned identity is used, you must explicitly provide the client ID or identity ID of that identity. This allows the API Management gateway to successfully request a token for the specified resource and attach it to the request sent to the backend.

Adım Adım Çözüm

Determine the correct policy processing stage.

The `<authentication-managed-identity>` policy must be placed in the `<inbound>` section.

This ensures the OAuth token is obtained and attached to the request before APIM forwards the request to the backend service.

Configure the policy with the identity's client ID.

Specify the `client-id` (or `identity-id`) of the user-assigned managed identity inside the policy attributes.

User-assigned managed identities must be explicitly identified in the policy. Otherwise, APIM defaults to using the system-assigned identity.

Anahtar Kavram

Securing backend services in Azure API Management using user-assigned managed identities.

Soru 815Soru →

A developer needs to secure an API hosted in Azure API Management (APIM) by validating JSON Web Tokens (JWT) issued by Microsoft Entra ID. The validation process must ensure that the token signature is verified against Microsoft Entra ID's keys, and that expired or unauthorized requests are rejected before reaching the backend. Which two configuration steps should the developer perform? (Select TWO.)

Geçerli olan tümünü seçin

Place the <validate-jwt> policy in the <inbound> section of the API policy configuration.

Define the openid-config endpoint URL pointing to the Microsoft Entra ID metadata endpoint in the <validate-jwt> policy.

Place the <validate-jwt> policy in the <outbound> section of the API policy configuration.

Enable a system-assigned managed identity on the APIM instance to sign the incoming client tokens.

Configure the <validate-jwt> policy to reference a signature key in Azure Key Vault without setting a Key Vault access policy for the APIM identity.

Cevabı ve açıklamayı göster

Cevap: Place the <validate-jwt> policy in the <inbound> section of the API policy configuration.; Define the openid-config endpoint URL pointing to the Microsoft Entra ID metadata endpoint in the <validate-jwt> policy.

Cevap

To secure the API endpoints, place the <validate-jwt> policy within the <inbound> processing block and configure the policy to use the Microsoft Entra ID OpenID Connect metadata endpoint for key validation.

The correct options state that the <validate-jwt> policy must be placed in the <inbound> section and configured with the Microsoft Entra ID OpenID Connect metadata endpoint. Inbound policies filter requests before they reach the backend service, which is required for security. The OpenID Connect metadata endpoint configuration ensures that the gateway can fetch and verify the signing keys of the tokens dynamically.

Adım Adım Çözüm

Locate the target API configuration in Azure API Management and open the policy editor.

Access to the API policy XML document.

Policies in APIM are defined using XML blocks at different scopes (global, product, API, or operation).

Add the <validate-jwt> policy inside the <inbound> section of the policy XML.

Token validation is configured to occur before forwarding requests to the backend.

Token checks must happen on inbound requests to prevent unauthorized requests from consuming backend resources.

Set the openid-config attribute of the <validate-jwt> element to the Microsoft Entra ID tenant endpoint.

APIM is configured to fetch and cache the signing keys needed to verify token signatures.

Dynamic key retrieval via OpenID Connect ensures validation remains functional when Microsoft Entra ID rotates signing keys.

Anahtar Kavram

Securing API Management endpoints using inbound JWT validation and OpenID Connect configuration.

Soru 816Soru →

You are developing a C# background service that processes large report generation requests from an Azure Queue Storage queue named report-jobs. Each report request payload can occasionally reach 150 KB in size. The background service takes up to 10 minutes to compile and upload each report. You must ensure that messages are successfully processed without exceeding Azure Queue Storage limits and that other instances of the background service do not attempt to process the same message concurrently. Which two actions should you perform? (Select two.)

Geçerli olan tümünü seçin

Upload the report request payload to Azure Blob Storage, and use the Blob URI as the queue message payload.

Call QueueClient.ReceiveMessagesAsync and specify a visibilityTimeout of at least 10 minutes.

Initialize the QueueClient using QueueClientOptions with the maximum message size set to 256 KB.

Generate a Shared Access Signature (SAS) token for the queue with full Manage permissions to authorize the background service.

Retrieve the messages using QueueClient.PeekMessagesAsync to prevent the visibility timeout clock from starting during processing.

Cevabı ve açıklamayı göster

Cevap: Upload the report request payload to Azure Blob Storage, and use the Blob URI as the queue message payload.; Call QueueClient.ReceiveMessagesAsync and specify a visibilityTimeout of at least 10 minutes.

Cevap

To resolve the limits and processing concurrency issues, you must upload the report request payload to Azure Blob Storage and use the Blob URI as the queue message payload, and call QueueClient.ReceiveMessagesAsync with a visibilityTimeout of at least 10 minutes.

The correct options are the ones that suggest uploading the payload to Azure Blob Storage and using the Blob URI as the queue message payload, and calling QueueClient.ReceiveMessagesAsync with a visibilityTimeout of at least 10 minutes. Storing the payload in Azure Blob Storage is necessary because Azure Queue Storage messages have a hard size limit of 64 KB, and the payload can reach 150 KB. Specifying a visibilityTimeout of 10 minutes ensures that the message remains invisible to other consumer instances while the background service processes the report, preventing duplicate processing.

Adım Adım Çözüm

Address the 64 KB limit of Azure Queue Storage messages.

Since the payload can be 150 KB, store it in Azure Blob Storage and place only the URI link in the queue message.

This implements the Claim Check pattern to bypass the queue storage size limit.

Prevent duplicate concurrent processing for the 10-minute operation.

Call QueueClient.ReceiveMessagesAsync and specify a visibilityTimeout of 10 minutes or more.

The default visibility timeout is 30 seconds. Setting it to 10 minutes keeps the message invisible to other instances while it is being processed.

Anahtar Kavram

Handling large payloads and visibility timeouts in Azure Queue Storage

Soru 817Soru →

You are securing an Azure API Management (APIM) gateway endpoint. The security requirements specify that all client applications must authenticate using client certificates, and the APIM gateway must validate that the certificate is not expired and is issued by a specific Certificate Authority (CA).

Which configuration and policy implementation should you use to meet these requirements?

Enable client certificate negotiation in the APIM gateway settings, and configure an inbound policy that validates the certificate using context.Request.Certificate properties.

Enable client certificate negotiation in the APIM gateway settings, and configure an outbound policy that validates the certificate using context.Request.Certificate properties.

Enable a system-assigned managed identity on the APIM instance, and configure an authentication-managed-identity policy in the inbound section of the API.

Upload the trusted CA certificate to Azure Key Vault, configure a validate-jwt inbound policy to validate the certificate, and grant the client application Get permissions in the Key Vault access policies.

Cevabı ve açıklamayı göster

Cevap: Enable client certificate negotiation in the APIM gateway settings, and configure an inbound policy that validates the certificate using context.Request.Certificate properties.

Cevap

Enable client certificate negotiation in the APIM gateway settings, and configure an inbound policy that validates the certificate using context.Request.Certificate properties.

To secure an APIM gateway using client certificates, you must first configure the gateway to negotiate client certificates. Once negotiated, the certificate is accessible in the policy context. The validation logic must reside in the inbound section so that requests are verified before reaching the backend. The context.Request.Certificate object exposes the necessary properties to verify issuer and expiration details.

Adım Adım Çözüm

Enable client certificate negotiation on the APIM custom domain or gateway configurations.

The APIM gateway will request and negotiate client certificates during the TLS handshake.

By default, APIM does not request client certificates. This configuration ensures the certificate is available in the request context.

Configure the inbound policy section of the target API or product.

A policy rule is added to the inbound processing pipeline.

Security checks and request validation must be executed in the inbound section before requests are dispatched to the backend service.

Use the context.Request.Certificate expression within a conditional policy (e.g., choose or check-header) to validate the certificate's issuer and expiration date.

APIM checks the properties of the certificate and returns a 401 Unauthorized status if validation fails.

Using context.Request.Certificate properties ensures that only valid, non-expired certificates from the trusted CA are permitted to pass.

Anahtar Kavram

Securing APIM endpoints via client certificate authentication (Mutual TLS) and policy expressions

Soru 818Soru →

You are designing a web application that allows users to upload profile pictures. After a user uploads an image, the application needs to add a processing message to an Azure Queue Storage queue. The message must contain the user's metadata and a reference to the image. Which of the following approaches should you use to implement this queue solution securely and efficiently while staying within Azure Queue Storage limits?

Store the profile picture in Azure Blob Storage, create a queue message containing the Blob URI and user metadata ensuring the total message size is under 64 KB, and authenticate the application using a managed identity assigned the Storage Queue Data Message Sender role.

Embed the base64-encoded profile picture binary data directly in the queue message body along with the user metadata, ensuring the queue message does not exceed 256 KB.

Store the profile picture in Azure Blob Storage, and include a Shared Access Signature (SAS) token in the queue message body that grants full read, write, and delete permissions to the storage account with a 1-year expiration to ensure the worker has access.

Store the profile picture in Azure Blob Storage, and configure the application to use a system-assigned managed identity, exporting its client secret to authenticate the QueueClient from the client-side browser application.

Cevabı ve açıklamayı göster

Cevap: Store the profile picture in Azure Blob Storage, create a queue message containing the Blob URI and user metadata ensuring the total message size is under 64 KB, and authenticate the application using a managed identity assigned the Storage Queue Data Message Sender role.

Cevap

The correct approach stores the large file (profile picture) in Azure Blob Storage and keeps the queue message size below the 64 KB limit by only including the URI and user metadata. Authenticating via managed identity with the Storage Queue Data Message Sender role ensures secure and credential-free interaction with Azure Queue Storage following least privilege access control.

Adım Adım Çözüm

Analyze size constraints for the queue message payload.

Determine that since profile pictures can easily exceed 64 KB, the image must be stored externally in Azure Blob Storage, and only a reference (URI) should be stored in the queue message.

Azure Queue Storage has a strict maximum message size of 64 KB.

Select the appropriate security and identity mechanism.

Use Azure Active Directory (Microsoft Entra ID) authentication with a managed identity assigned to the Storage Queue Data Message Sender role.

This implements secure, credential-free authentication with the least privilege required to write to the queue.

Anahtar Kavram

Azure Queue Storage message size limits and secure access configuration

Soru 819Soru →

An organization is deploying an API to Azure API Management (APIM). The security requirements specify that all client applications must authenticate using mutual TLS (client certificates) at the APIM gateway. You need to configure APIM to receive and validate the client certificates. Which two actions should you perform?

Geçerli olan tümünü seçin

Enable the Negotiate client certificate setting in the gateway domain configuration of the API Management instance.

Add an inbound policy that validates the client certificate properties using the context.Request.Certificate variable.

Add an outbound policy that validates the client certificate properties using the context.Request.Certificate variable.

Configure a user-assigned managed identity to authenticate the incoming client requests at the gateway.

Cevabı ve açıklamayı göster

Cevap: Enable the Negotiate client certificate setting in the gateway domain configuration of the API Management instance.; Add an inbound policy that validates the client certificate properties using the context.Request.Certificate variable.

Cevap

To implement client certificate authentication, you must enable the Negotiate client certificate setting in the gateway domain configuration and add an inbound policy that validates the certificate using the context.Request.Certificate variable.

To successfully authenticate incoming clients using mutual TLS, the API Management gateway must negotiate the client certificate. This is configured at the gateway domain settings. Then, to inspect and enforce authorization rules, an inbound policy must be added to validate the certificate's thumbprint or other properties using the request context.

Adım Adım Çözüm

Enable certificate negotiation at the gateway domain configuration.

The gateway requests a client certificate during the TLS handshake.

By default, the gateway does not request a client certificate during TLS negotiation.

Add validation logic to the inbound policy section.

Requests with invalid or missing certificates are rejected before reaching the backend.

Simply negotiating the certificate is not enough; the gateway must actively validate the certificate's thumbprint, issuer, or subject before routing the call.

Anahtar Kavram

Client certificate authentication at the API Management gateway requires both enabling TLS client certificate negotiation at the domain configuration level and validating the certificate properties within an inbound policy.

Soru 820Soru →

You are securing an API hosted in Azure API Management (APIM). The security requirements specify that clients must authenticate using client certificates. The allowed certificate thumbprint is stored as a secret in Azure Key Vault.

You configure a system-assigned managed identity for the APIM instance.

You create a Named Value in APIM named `CertThumbprint` that references the Key Vault secret. You then add an inbound policy to validate the client certificate thumbprint against the `CertThumbprint` named value.

During testing, requests fail with an HTTP 500 Internal Server Error. The diagnostic logs indicate that APIM is unauthorized to retrieve the secret value from Key Vault.

Which of the following actions will resolve this issue?

Grant the APIM system-assigned managed identity the 'Get' permission for secrets in the Azure Key Vault access policy.

Configure the APIM instance to use a user-assigned managed identity, as system-assigned managed identities are not supported for Key Vault-backed Named Values.

Grant the APIM system-assigned managed identity the 'Get' permission for certificates in the Azure Key Vault access policy, leaving secrets permissions unconfigured.

Add a client credential client secret to the APIM instance configuration and assign it access to the Key Vault secrets.

Cevabı ve açıklamayı göster

Cevap: Grant the APIM system-assigned managed identity the 'Get' permission for secrets in the Azure Key Vault access policy.

Cevap

Grant the APIM system-assigned managed identity the 'Get' permission for secrets in the Azure Key Vault access policy.

To resolve the authorization issue, the system-assigned managed identity of the APIM instance must be granted the 'Get' permission for secrets in the Azure Key Vault access policy. This allows the APIM gateway to dynamically retrieve the secret value containing the certificate thumbprint when executing the policy.

Adım Adım Çözüm

Identify the type of resource being accessed in Key Vault by the APIM Named Value.

The Named Value references a secret, so the GET operation is sent to the Key Vault secrets endpoint.

Determining the correct resource type ensures the proper permission scope is applied.

Configure permissions for the APIM system-assigned managed identity in Key Vault.

The identity is granted the 'Get' permission under Secret Permissions in the Key Vault access policies.

This authorizes APIM to dynamically fetch the secret value during policy execution without hardcoded credentials.

Anahtar Kavram

Securing APIM endpoints with client certificate validation backed by Azure Key Vault secrets retrieved using managed identities.

ÖncekiSayfa 41 / 49Sonraki

Tüm alıştırma soruları

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram