Examkin

Tüm alıştırma soruları

972 soru

Tüm türler972Çoktan seçmeli497Çoklu seçim269Eşleştirme9Sıralama171Boşluk doldurma26
Soru 961Soru →

You are developing a C# .NET 8 isolated worker Azure Function App. To meet your company's security compliance, the Application Insights connection string must be retrieved at startup from an Azure Key Vault using the Azure Identity library, rather than being stored in plain text in application settings.

In `Program.cs`, you retrieve the connection string value from Key Vault and store it in a variable named `vaultConnectionString`.

Which code segment should you use to register Application Insights telemetry with this connection string in the dependency injection container?

Cevabı ve açıklamayı göster

Cevap: csharp
services.AddApplicationInsightsTelemetryWorkerService(options =>
{
options.ConnectionString = vaultConnectionString;
});
services.ConfigureFunctionsApplicationInsights();

Cevap

The correct option is the one that sets the `ConnectionString` property of `ApplicationInsightsServiceOptions` inside `AddApplicationInsightsTelemetryWorkerService` and then calls `ConfigureFunctionsApplicationInsights`.
The correct option programmatically sets the connection string via the configuration lambda in `AddApplicationInsightsTelemetryWorkerService`. In .NET isolated worker Azure Functions, the `AddApplicationInsightsTelemetryWorkerService` extension method is used to register the telemetry services, and passing an action configuring `ApplicationInsightsServiceOptions.ConnectionString` is the supported way to provide the connection string programmatically. Calling `ConfigureFunctionsApplicationInsights` afterwards integrates the worker telemetry with the Functions host.

Adım Adım Çözüm

1
Configure the options for `AddApplicationInsightsTelemetryWorkerService`.
Specifies the target connection string using the configuration options.
Allows the underlying telemetry service to route telemetry data to the correct Application Insights resource.
2
Call `ConfigureFunctionsApplicationInsights()`.
Integrates the Application Insights worker service with the Azure Functions host telemetry.
Ensures functions-specific tracking (like invocation success/failure and execution logs) is correctly correlated.

Anahtar Kavram

Programmatic configuration of Application Insights Connection String in Azure Functions Isolated Worker
Soru 962Soru →

You are implementing an Azure Monitor alert solution for an Azure App Service web application. You need to create an alert rule that triggers when the web application's CPU percentage deviates significantly from its historical baseline. The alert must trigger an Azure Function to execute diagnostic scripts and send an email notification to the operations team. Which configuration should you implement?

Cevabı ve açıklamayı göster

Cevap: Create a metric alert rule that uses dynamic thresholds. Create an action group containing both an Azure Function action and an Email/SMS/Push/Voice action.

Cevap

Create a metric alert rule that uses dynamic thresholds. Create an action group containing both an Azure Function action and an Email/SMS/Push/Voice action.
The correct configuration is to create a metric alert rule with dynamic thresholds combined with an action group that contains both an Azure Function action and an Email/SMS/Push/Voice action. Dynamic thresholds apply machine learning to automatically establish baselines and flag anomalies for resource metrics such as CPU percentage. Action groups natively support multiple action types, allowing the system to run an automated diagnostic function and email the team concurrently.

Adım Adım Çözüm

1
Determine the type of alert rule required to monitor resource performance metrics such as CPU percentage.
Identify that a Metric Alert is required because it can monitor resource-level metrics directly with low latency.
Metric alerts are optimized for performance counters like CPU percentage, whereas Activity Log alerts track control-plane events.
2
Select the appropriate threshold criteria to identify deviations from historical behavior.
Choose Dynamic Thresholds instead of Static Thresholds.
Dynamic thresholds apply machine learning algorithms to historical data to detect anomalies and adjust limits dynamically over time.
3
Configure the actions to execute when the alert criteria are met.
Define an Action Group containing an Azure Function action and an Email/SMS/Push/Voice action.
Action groups support multiple receivers, allowing both automated diagnostics (via Azure Functions) and manual notification (via Email) to be triggered from a single alert.

Anahtar Kavram

Azure Monitor Metric Alerts with Dynamic Thresholds and Action Group Actions
Soru 963Soru →

You are configuring a Python FastAPI web application hosted on Azure App Service to load its settings from an Azure App Configuration store. One of the keys in the App Configuration store, DbConnectionString, is configured as a Key Vault reference pointing to a secret in Azure Key Vault. The App Service is configured to use a system-assigned managed identity. At runtime, the application successfully retrieves standard key-values from the App Configuration store but fails with an authorization error when attempting to resolve the value of the DbConnectionString key. How should you resolve this issue?

Cevabı ve açıklamayı göster

Cevap: Grant the App Service's system-assigned managed identity the Key Vault Secrets User role on the Azure Key Vault.

Cevap

Grant the App Service's system-assigned managed identity the Key Vault Secrets User role on the Azure Key Vault.
The correct solution is to grant the App Service's system-assigned managed identity the Key Vault Secrets User role on the Azure Key Vault. In Azure App Configuration, Key Vault references are resolved client-side by the application client library. This library uses the credentials supplied to the configuration provider (in this scenario, the system-assigned managed identity of the App Service) to authenticate directly against the Azure Key Vault. Therefore, the App Service's identity requires direct access to read secrets in the Key Vault.

Adım Adım Çözüm

1
Identify where the Key Vault reference resolution takes place.
The App Configuration provider library resolves Key Vault references client-side within the application process.
Understanding the client-side nature of Key Vault references in App Configuration is critical for setting permissions on the correct identity.
2
Determine which identity is executing the application process.
The App Service's system-assigned managed identity.
Since the application runs on the App Service, it uses the App Service's identity to connect to resources.
3
Assign the appropriate RBAC role to the App Service's identity on the Key Vault.
Assign Key Vault Secrets User role (or Get permissions in access policies) to the App Service's identity.
This grants the application permission to fetch the secret value during the configuration loading process.

Anahtar Kavram

Key Vault Reference Resolution in Azure App Configuration
Tahmini Süre:1m 30s
Soru 964Soru →

You are securing an Azure API Management (APIM) gateway endpoint. You need to ensure that the APIM gateway validates the JSON Web Token (JWT) provided in the authorization header of incoming requests before forwarding the requests to the backend service. In which section of the APIM policy XML configuration must you place the validate-jwt policy?

Cevabı ve açıklamayı göster

Cevap: inbound

Cevap

inbound
Placing the validate-jwt policy in the inbound section ensures that the JSON Web Token is validated before the request is processed further or forwarded to the backend service.

Adım Adım Çözüm

1
Analyze the request lifecycle in Azure API Management policies.
The phases execute in order: inbound, backend, outbound, and on-error (if a failure occurs).
To validate credentials before the backend is touched, the validation must occur in the earliest phase.
2
Determine where validation policies like validate-jwt must reside.
The validate-jwt policy is an inbound processing policy.
Placing validate-jwt in the inbound section blocks unauthorized requests at the gateway level before they consume backend resources.

Anahtar Kavram

Azure API Management policies are executed in specific sections based on the request flow, and token validation must occur in the inbound section to protect backend resources.
Tahmini Süre:45s
Soru 965Soru →

You are developing a microservice named `OrderProcessing` that runs on an Azure App Service and sends telemetry to Azure Application Insights. You need to implement an Azure Monitor alert rule that triggers whenever the number of critical exceptions (where the `severityLevel` is 33) exceeds 5050 within any 1515-minute window. The alert evaluation must run every 55 minutes. To minimize query execution latency and data scanning costs, you must configure the query and rule settings efficiently.

Which configuration should you implement?

Cevabı ve açıklamayı göster

Cevap: Configure a Log Search Alert rule with the KQL query `exceptions | where cloud_RoleName == "OrderProcessing" and severityLevel == 3`, set the Measure to Table rows, set the Aggregation granularity (Period) to 1515 minutes, and set the Evaluation frequency to 55 minutes.

Cevap

Configure a Log Search Alert rule with a KQL query that filters the exceptions by cloud role name and severity level, setting the measure to Table rows, the aggregation granularity to 15 minutes, and the evaluation frequency to 5 minutes.
The correct configuration utilizes a Log Search Alert rule with a KQL query that filters for the specific cloud role and severity level, relying on Azure Monitor to automatically apply the time filter on the `timestamp` column based on the configured aggregation granularity (1515 minutes) and evaluation frequency (55 minutes). This prevents redundant query execution and minimizes log scanning costs.

Adım Adım Çözüm

1
Analyze the requirement to detect exceptions of a specific severity level over a time window.
Identify that a Log Search Alert rule is required since we need to filter on the `severityLevel` property which is inside log telemetry rather than standard metrics.
Log Search Alerts allow KQL queries on raw Application Insights tables to filter by custom properties and log fields.
2
Determine the correct KQL query design to minimize execution cost.
Write a query without any hardcoded time filter, as Azure Monitor's Scheduled Query Rules automatically append the time filter based on the configured Aggregation Granularity.
Hardcoding a lookback filter like `ago(24h)` scans redundant data on every evaluation, increasing costs and query latency.
3
Evaluate target actions for notifications and integrations.
Configure Action Groups to trigger notifications or external automations, noting that they cannot directly hold autoscale rules or resolve Key Vault references natively.
Action Groups act as the target receiver pipeline, whereas autoscale settings and Key Vault authorization are configured at different layers of Azure.

Anahtar Kavram

Azure Monitor Log Search Alerts and Action Groups configuration
Soru 966Soru →

A developer needs to configure security for a specific endpoint in Azure API Management. The endpoint must only accept requests from a partner's office network (subnet 198.51.100.0/24198.51.100.0/24) and must verify that the request contains a valid subscription key.

Which two configuration settings or policy definitions must be applied within Azure API Management to enforce these security controls?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Define the `ip-filter` policy inside the `<inbound>` element of the API policy.; Select the 'Require subscription' check box in the settings of the API.

Cevap

Defining the `ip-filter` policy inside the `<inbound>` element of the API policy and selecting the 'Require subscription' check box in the settings of the API.
To restrict access by IP address, the `ip-filter` policy must be configured within the `<inbound>` block, which evaluates incoming requests before forwarding them to the backend. To enforce key validation, the 'Require subscription' setting must be enabled on the API, which ensures that Azure API Management validates the presence of a valid subscription key in the request headers or query parameters.

Adım Adım Çözüm

1
Determine where to apply IP restrictions in the API gateway policy definition.
The restriction must be evaluated before the request reaches the backend service, which means using the `ip-filter` policy inside the `<inbound>` element.
Incoming requests need to be validated at the entry point of the gateway.
2
Determine how to enforce API key validation on incoming client requests.
Enable the 'Require subscription' property on the API or its containing product.
This configuration instructs the API Management gateway to verify that a valid subscription key is supplied in the request headers or query string.

Anahtar Kavram

Securing API Management endpoints using IP filtering and subscription key enforcement.
Soru 967Soru →

An organization is developing a multi-tenant software solution named VendorPortal. The solution must allow users from any organizational Microsoft Entra ID tenant to sign in. The solution must explicitly block authentication requests from personal Microsoft accounts, such as those registered with Outlook.com or Xbox Live. Which configuration parameters should you apply to the application manifest and the identity provider authority URL?

Cevabı ve açıklamayı göster

Cevap: Manifest signInAudience set to AzureADMultipleOrgs and authority URL set to https://login.microsoftonline.com/organizations

Cevap

Manifest signInAudience set to AzureADMultipleOrgs and authority URL set to https://login.microsoftonline.com/organizations
To configure a multi-tenant application that supports only organizational directories and blocks personal Microsoft accounts, the developer must set the signInAudience in the application manifest to AzureADMultipleOrgs. Additionally, the authority URL must point to the organizations endpoint. Using the organizations endpoint ensures that personal accounts are blocked at the identity provider sign-in page before they can input credentials.

Adım Adım Çözüm

1
Determine the required user audience scope for the application.
The application must support users from any organization (multi-tenant) but exclude personal Microsoft accounts.
This establishes the target audience profile for the manifest configuration.
2
Select the appropriate signInAudience value in the Microsoft Entra ID application manifest.
Identify that AzureADMultipleOrgs is the correct setting for multi-tenant organizations without personal accounts.
AzureADMultipleOrgs enables multi-tenant support while excluding personal accounts (which would require AzureADandPersonalMicrosoftAccount).
3
Configure the authority endpoint to match the tenant restriction requirements.
Select the /organizations endpoint (https://login.microsoftonline.com/organizations) instead of /common.
The /organizations endpoint restricts sign-in attempts to organizational directories, preventing personal accounts from proceeding at the protocol level.

Anahtar Kavram

Configuring multi-tenant authorization endpoints and application manifest audiences in Microsoft Entra ID.
Tahmini Süre:1m 30s
Soru 968Soru →

You are deploying a .NET web application to an Azure App Service. The application is configured to retrieve its configuration settings from an Azure App Configuration store named appconf-prod. Some settings, such as database credentials, are stored as Key Vault references pointing to secrets in an Azure Key Vault named kv-prod. The App Service has a system-assigned managed identity enabled. At runtime, the application loads configuration values from appconf-prod but receives the raw JSON metadata of the Key Vault references instead of the actual secret values. Which of the following actions must you perform to resolve this issue and successfully retrieve the secret values? (Select THREE correct actions.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Grant the App Service's system-assigned managed identity the App Configuration Data Reader role on the appconf-prod store.; Grant the App Service's system-assigned managed identity the Key Vault Secrets User role on the kv-prod Key Vault.; Configure the application's configuration builder to call ConfigureKeyVault and pass a token credential such as DefaultAzureCredential.

Cevap

To resolve the raw JSON metadata issue and retrieve the actual secret values, you must grant the App Service's managed identity the App Configuration Data Reader role on the configuration store, grant the same managed identity the Key Vault Secrets User role on the Key Vault, and configure the application code using ConfigureKeyVault with an appropriate credential like DefaultAzureCredential.
The system-assigned managed identity of the App Service must have read permissions for both the App Configuration store (App Configuration Data Reader) and the Key Vault (Key Vault Secrets User). In addition, the application's startup code must be updated to call ConfigureKeyVault on the configuration builder, passing a credential like DefaultAzureCredential so the SDK can resolve the references at startup.

Adım Adım Çözüm

1
Configure application code to resolve Key Vault references.
The App Configuration provider client is instructed to detect and fetch Key Vault references using the provided credentials.
By default, the SDK only reads key-value metadata. Enabling ConfigureKeyVault with DefaultAzureCredential enables client-side resolution of Key Vault references.
2
Assign the App Configuration Data Reader role to the App Service managed identity on the App Configuration store.
The application can successfully authenticate and read the configurations (including Key Vault reference metadata) from the store.
The managed identity requires read permissions on the App Configuration store to fetch configuration keys and values.
3
Assign the Key Vault Secrets User role to the App Service managed identity on the Key Vault.
The application can fetch the actual secret values from Key Vault when resolving the references.
Since Key Vault references are resolved client-side by the application, the application's managed identity must have secret read access on the target Key Vault.

Anahtar Kavram

Key Vault references in Azure App Configuration are resolved client-side by the application's SDK. This requires that the application's identity has read permissions to both the App Configuration store and the target Key Vault, and that the SDK is configured to resolve the references.
Soru 969Soru →

You are developing a C# console application that will run in an Azure Container Instance (ACI). The application is designed to consume telemetry data from an Azure Event Hub using the EventProcessorClient from the Azure.Messaging.EventHubs NuGet package. Checkpointing and partition ownership must be tracked using Azure Blob Storage, and the application must authenticate using a user-assigned managed identity.

Which of the following Azure role-based access control (RBAC) roles must you assign to the managed identity to ensure the application can both read events and manage checkpoints? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Storage Blob Data Contributor on the Azure Storage container; Azure Event Hubs Data Receiver on the Azure Event Hub

Cevap

Storage Blob Data Contributor on the Azure Storage container and Azure Event Hubs Data Receiver on the Azure Event Hub
To consume events and track progress, the managed identity requires both the Azure Event Hubs Data Receiver role to read events from the partitions, and the Storage Blob Data Contributor role on the storage container to create, modify, and delete lease/checkpoint blobs.

Adım Adım Çözüm

1
Identify the permissions required for consuming events from Azure Event Hubs.
The application needs to connect to the Event Hub and read partition events, which requires the Azure Event Hubs Data Receiver role.
Without receiver permissions, the EventProcessorClient cannot establish a partition receiver connection to pull event streams.
2
Identify the permissions required for partition checkpointing and ownership storage.
The application needs to read, write, and delete blobs inside the Azure Blob Storage container to handle leases and checkpoint offsets, which requires the Storage Blob Data Contributor role.
The EventProcessorClient uses blobs as a coordination mechanism. It must acquire leases and write checkpoint state, which requires write/delete permissions on the blobs.

Anahtar Kavram

Azure Event Hubs consumer permissions and Blob Storage checkpointing role requirements
Soru 970Soru →

You are provisioning a new Azure API Management (APIM) instance using the Consumption tier to front a set of serverless Azure Functions. To optimize response times and minimize backend executions, you need to implement API response caching. Which configuration step must you perform to enable caching for this APIM instance?

Cevabı ve açıklamayı göster

Cevap: Provision an external cache, such as Azure Cache for Redis, and configure it in the External Cache settings of the API Management instance.

Cevap

Provision an external cache, such as Azure Cache for Redis, and configure it in the External Cache settings of the API Management instance.
Provisioning an external cache, such as Azure Cache for Redis, is correct because the Consumption tier of Azure API Management does not have a built-in cache. To use caching policies, you must register an external cache in the API Management instance settings.

Adım Adım Çözüm

1
Identify the limitations of the selected Azure API Management tier.
The Consumption tier is a serverless offering that does not include a built-in cache.
Choosing the correct architecture requires knowing which features are native to the selected service tier.
2
Determine the alternative mechanism to support API caching in the Consumption tier.
An external cache (such as Azure Cache for Redis) must be provisioned and configured.
API Management caching policies (e.g., cache-lookup, cache-store) can target an external cache when a built-in cache is unavailable.
3
Add the external cache configuration in the Azure portal or via ARM/Bicep template.
The external cache is registered under the 'External cache' settings in API Management.
This links the external Redis instance to APIM, allowing policies to route cache lookups and stores to it.

Anahtar Kavram

Azure API Management Caching in the Consumption Tier
Tahmini Süre:1m 30s
Soru 971Soru →

You are deploying a web application to Azure App Service. The application must retrieve a database connection string from an Azure Key Vault named kv-billing. You configure a system-assigned managed identity for the App Service and assign the Key Vault Secrets User role to the identity on kv-billing. You need to configure an application setting in the App Service named DbConnectionString that references the secret named DbPassword in the Key Vault without pinning it to a specific version. Which of the following values represents the correct syntax to define the Key Vault reference?

Cevabı ve açıklamayı göster

Cevap: @Microsoft.KeyVault(SecretUri=https://kv-billing.vault.azure.net/secrets/DbPassword)

Cevap

@Microsoft.KeyVault(SecretUri=https://kv-billing.vault.azure.net/secrets/DbPassword)
The correct answer uses the valid syntax format '@Microsoft.KeyVault(SecretUri=https://kv-billing.vault.azure.net/secrets/DbPassword)'. This tells the Azure App Service runtime to fetch the secret named 'DbPassword' from the Key Vault named 'kv-billing' using the system-assigned managed identity.

Adım Adım Çözüm

1
Identify the required prefix for Key Vault references in Azure App Service application settings.
The prefix must be @Microsoft.KeyVault.
Azure App Service recognizes this prefix to intercept and resolve the reference from Key Vault before exposing the configuration value to the application code.
2
Identify the correct parameter name for referencing a secret by its URI.
The parameter name is SecretUri.
Using other parameter names like Uri will cause the reference to be treated as invalid syntax and it will not resolve.
3
Format the URI for the secret without pinning a version.
The URI is https://kv-billing.vault.azure.net/secrets/DbPassword.
Leaving out the version GUID at the end of the secret path ensures that the reference always resolves to the latest version of the secret.

Anahtar Kavram

Key Vault references allow an Azure App Service application to read secrets from Key Vault using configuration settings without modifying application code, requiring a system-assigned or user-assigned managed identity with appropriate access permissions.
Soru 972Soru →

You are configuring policies in Azure API Management (APIM) for a weather forecasting API. The API must satisfy the following requirements:
1. Strip a sensitive query parameter named `internal-token` from the request before it is forwarded to the backend.
2. Authenticate to the backend service using the APIM instance's system-assigned managed identity.

Which two of the following XML policy configurations should you apply to meet these requirements? (Select two)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: xml
<inbound>
<base />
<set-query-parameter name="internal-token" action="delete" />
</inbound>
; xml
<inbound>
<base />
<authentication-managed-identity resource="https://management.azure.com/" />
</inbound>

Cevap

Apply the inbound policy to delete the query parameter and the inbound policy using the authentication-managed-identity tag without a client-id attribute.
The inbound policy block executes before the request is forwarded to the backend. Deleting query parameters must be performed here using the set-query-parameter policy. Additionally, acquiring an access token using the system-assigned managed identity is configured in the inbound block via the authentication-managed-identity policy, which must omit the client-id attribute to indicate system-assigned identity utilization.

Adım Adım Çözüm

1
Determine the correct policy section for stripping query parameters.
The inbound section is selected because modifications to the request must occur before it is sent to the backend.
Placing request modifications in the outbound section would execute them after the backend has already processed the request.
2
Select the correct XML policy to remove the query parameter.
The set-query-parameter policy with action="delete" is configured inside the inbound block.
This removes the specified parameter from the query string of the incoming request.
3
Determine the correct policy configuration for system-assigned managed identity authentication.
The authentication-managed-identity policy is placed in the inbound block with the resource attribute, omitting the client-id attribute.
Omitting client-id instructs APIM to use the system-assigned identity. Specifying client-id is reserved for user-assigned managed identities.

Anahtar Kavram

Azure API Management policies are executed sequentially within specific blocks (inbound, backend, outbound, on-error). Inbound policies modify requests before forwarding, including credential acquisition and parameter sanitization.
ÖncekiSayfa 49 / 49
Tüm alıştırma soruları — Microsoft Azure Developer (AZ-204) | Examkin