Examkin

Tüm alıştırma soruları

269 soru

Tüm türler972Çoktan seçmeli497Çoklu seçim269Eşleştirme9Sıralama171Boşluk doldurma26
Soru 1Soru →

An organization is developing an ASP.NET Core Web App named ExpenseTracker. The application allows signed-in employees to submit business expenses. To support this, ExpenseTracker must perform the following actions:
1. Retrieve the profile details of the signed-in user from Microsoft Graph.
2. Retrieve a list of departments from a custom protected Web API named DepartmentService (App ID URI: api://departmentservice) on behalf of the signed-in user.

You need to configure the permissions in Microsoft Entra ID for the ExpenseTracker application registration while adhering to the principle of least privilege. Which of the following configuration steps should you perform? (Select TWO)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Add the User.Read delegated permission for the Microsoft Graph API.; Add the api://departmentservice/Departments.Read delegated permission for the DepartmentService API.

Cevap

Add the User.Read delegated permission for the Microsoft Graph API, and add the api://departmentservice/Departments.Read delegated permission for the DepartmentService API.
To access Microsoft Entra ID protected resources on behalf of a signed-in user, client applications must be configured with Delegated permissions. The User.Read delegated permission for Microsoft Graph is the least-privileged permission required to read the signed-in user's profile. For custom APIs, scopes must be defined in the target API's registration (e.g., api://departmentservice) and then consented to by the client app using the fully qualified scope syntax: api://departmentservice/Departments.Read.

Adım Adım Çözüm

1
Analyze the client application type and runtime context.
The client application is an ASP.NET Core Web App where users sign in, and API calls must be made on behalf of the signed-in user. This dictates the use of delegated permissions rather than application permissions.
Delegated permissions allow the application to act on behalf of the signed-in user, enforcing the user's specific access boundaries.
2
Identify the least-privileged Microsoft Graph permission needed to retrieve the user's profile.
The User.Read delegated permission is selected.
User.Read allows the application to read the profile of the signed-in user, which satisfies the first requirement under the principle of least privilege without exposing other users' profiles.
3
Determine the correct custom API scope and format for calling the DepartmentService API.
The api://departmentservice/Departments.Read delegated scope is selected.
Custom API scopes requested by external clients must use the fully qualified URI format (prefixed by the resource's App ID URI) to successfully resolve the resource during token acquisition.

Anahtar Kavram

Microsoft Entra ID Delegated Permissions and Scope Configuration
Soru 2Soru →

You are developing a C# daemon application that runs as a background service on an on-premises Windows server. The application must connect to Azure Blob Storage to process files and authenticate to the Microsoft Identity Platform to obtain access tokens. The solution must meet the following security requirements:
- The application must authenticate without user interaction.
- Credentials must not be stored in cleartext in the application files.
- The authentication mechanism must follow the principle of least privilege.

You need to configure the authentication for the application using MSAL.NET. Which two actions should you perform?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Initialize the application using ConfidentialClientApplicationBuilder.Create(clientId).WithCertificate(certificate).Build() pointing to a locally installed certificate.; Request the access token by calling AcquireTokenForClient with the scope parameter set to https://storage.azure.com/.default.

Cevap

To securely configure MSAL.NET for the on-premises daemon application, you must use a certificate with ConfidentialClientApplicationBuilder and request the token via AcquireTokenForClient specifying the /.default scope.
A background daemon application running on-premises must authenticate without user interaction as a confidential client. Using a client certificate allows the application to authenticate securely to Microsoft Entra ID without exposing cleartext credentials in local configuration files. Furthermore, because daemon applications do not act on behalf of a user, they must request application-only permissions using the client credentials flow, which requires the scope to be configured with the default resource suffix (e.g., https://storage.azure.com/.default).

Adım Adım Çözüm

1
Determine the application type in MSAL.NET
Confidential Client Application
Since the application runs as a background service without user interaction, it is classified as a confidential client rather than a public client.
2
Select the secure credential mechanism
Client certificate configuration via WithCertificate
To satisfy the requirement of not storing credentials in cleartext (which rules out client secrets) and given the on-premises hosting context, a locally installed certificate must be used.
3
Determine the correct authentication flow and scope format
AcquireTokenForClient with the default resource scope
Daemon applications use the Client Credentials flow. This flow requires requesting the default scope of the resource (/.default) because there is no user context to delegate specific scopes.

Anahtar Kavram

Daemon applications using MSAL.NET must build confidential client instances using certificates for secure on-premises deployments and request tokens using the /.default scope.
Soru 3Soru →

You are configuring diagnostics and telemetry for a .NET web application deployed to an Azure App Service that is currently hosted on a Basic (B1) App Service plan. You need to enable Application Insights Profiler to identify performance bottlenecks and hot paths. You also need to enable Snapshot Debugger to capture call stacks and local variables when unhandled exceptions occur. Developers must be able to view and download these debug snapshots in the Azure Portal. Which two actions must you perform? (Select two.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Scale the App Service Plan to the Standard (S1) tier or higher.; Assign the Application Insights Snapshot Debugger role to the developers' Entra ID accounts.

Cevap

Scale the App Service Plan to the Standard (S1) tier or higher, and assign the Application Insights Snapshot Debugger role to the developers' Entra ID accounts.
To successfully implement Profiler and Snapshot Debugger, you must meet both the resource tier and identity access requirements. First, scaling the App Service Plan to Standard (S1) or higher is necessary because the Profiler does not run on Free, Shared, or Basic tiers. Second, assigning the Application Insights Snapshot Debugger role is mandatory because debug snapshots contain potentially sensitive execution state memory, meaning default roles like Reader or Monitoring Contributor cannot access them.

Adım Adım Çözüm

1
Evaluate the hosting plan compatibility for the Profiler feature.
Identify that the current Basic (B1) tier does not support Application Insights Profiler, requiring an upgrade to Standard (S1) or higher.
Profiler requires Standard or higher tiers due to compute resource availability and licensing constraints.
2
Evaluate the RBAC permissions required for developers to view call stacks and process memory snapshots.
Determine that standard Reader or Monitoring roles are insufficient, and specify that the Application Insights Snapshot Debugger role must be assigned.
Snapshots contain sensitive in-memory data, which requires a specialized role that explicitly grants access to the PII and debug variables.

Anahtar Kavram

Configuring requirements and access permissions for Application Insights Profiler and Snapshot Debugger.
Soru 4Soru →

You are designing a monitoring solution for a message-processing application. The application processes messages from an Azure Service Bus queue named orders-queue. You must configure Azure Monitor to trigger an alert when the number of active messages in orders-queue exceeds 1,000. When the alert is triggered, it must perform the following actions:

1. Send an email notification to the operations manager.
2. Execute an Azure Function named ScaleProcessor to increase processing capacity.

Which two configurations are required to implement this solution? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Create an action group that contains an Email receiver and an Azure Function receiver.; Create a metric alert rule that monitors the ActiveMessages metric of the queue.

Cevap

The correct configurations are to create an action group containing Email and Azure Function receivers, and to create a metric alert rule monitoring the ActiveMessages metric of the queue.
To satisfy the requirements, you need to monitor a quantitative, numerical metric (queue size) and trigger both a notification and custom automation code. The option stating to create an action group with Email and Azure Function receivers addresses the notification and execution requirements. The option stating to create a metric alert rule monitoring the ActiveMessages metric ensures that the alert fires immediately when the count exceeds 1,000.

Adım Adım Çözüm

1
Define notifications and automation
An Azure Monitor action group is configured with an Email receiver pointing to the operations manager's address and an Azure Function receiver pointing to the ScaleProcessor function.
Action groups centralize the execution of notification and remediation steps triggered by alerts.
2
Configure the metric alert source
A new metric alert rule is created with the target resource set to the orders-queue within the Service Bus namespace.
This establishes the scope of the alert to monitor queue-specific metrics.
3
Set the alert condition and link the action group
The metric alert condition is set to evaluate the ActiveMessages metric using a static threshold greater than 1,000, and the rule is linked to the created action group.
This completes the alert configuration, connecting the criteria to the automated actions.

Anahtar Kavram

Azure Monitor Metric Alerts and Action Group Receivers
Soru 5Soru →

You are developing a web application named DocPortal. The application must perform the following security actions:
1. Allow users to sign in and view files stored in their personal OneDrive folders.
2. Allow a scheduled background service within the application to read group memberships across the tenant without a signed-in user.

You need to configure the Microsoft Graph permissions for the application registration. The solution must adhere to the principle of least privilege.

Which two permissions should you configure? (Select two.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Files.Read configured as a Delegated permission.; GroupMember.Read.All configured as an Application permission.

Cevap

Configure Files.Read as a Delegated permission and GroupMember.Read.All as an Application permission.
Delegated permissions are required when the application needs to act on behalf of a signed-in user (such as reading the user's personal OneDrive files via Files.Read). Application permissions are required when the application runs as a background service without a user present (such as a scheduled job reading group memberships via GroupMember.Read.All). This configuration ensures proper identity context separation and complies with the principle of least privilege.

Adım Adım Çözüm

1
Determine the identity context for the first requirement.
The requirement calls for a signed-in user to access their own files, which requires a Delegated permission.
Delegated permissions run in the context of the signed-in user.
2
Identify the minimum required delegated scope for the first requirement.
The scope is Files.Read.
Files.Read provides read access to the signed-in user's files, fulfilling the least privilege concept.
3
Determine the identity context for the second requirement.
The requirement calls for a scheduled background service to read group memberships without a signed-in user, which requires an Application permission.
Application permissions run in the context of the application service principal rather than a user.
4
Identify the minimum required application scope for the second requirement.
The scope is GroupMember.Read.All.
GroupMember.Read.All is the least privileged application permission that allows reading group memberships.

Anahtar Kavram

Selecting and configuring the correct permission type (Delegated vs. Application) and scope for Microsoft Graph API integrations.
Soru 6Soru →

You are developing a web application named ComplianceHub and a backend Web API named AuditAPI. Both applications are registered in Microsoft Entra ID. The applications must meet the following security requirements:

1. ComplianceHub must allow signed-in users to read their own audit reports from AuditAPI.
2. A background archiving service must run nightly to read all audit logs from AuditAPI without user interaction.

You need to configure the permissions and scopes for the application registrations. Which two configurations should you perform? (Select two.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configure AuditAPI to expose a delegated scope named Audits.Read, and grant the ComplianceHub app registration the delegated permission for api://<AuditAPI_App_ID>/Audits.Read.; Configure AuditAPI to expose an application permission (App Role) named Audits.Archive with the allowed member type set to Applications, grant ComplianceHub this permission, and obtain administrator consent.

Cevap

Configure the backend API to expose a delegated scope and grant the client application the delegated permission (api://<AuditAPI_App_ID>/Audits.Read) for user-interactive operations, and configure the backend API to expose an application permission (App Role) and obtain administrator consent for background operations.
The correct configurations involve defining a delegated scope on the API and granting it to the client for user-centric access, and defining an application permission (App Role) with admin consent for the service-to-service background access. For user-interactive access, the API exposes a scope (Audits.Read) and the client requests delegated access using the App ID URI prefix. For background access, the API exposes an App Role, which is assigned to the client application and requires admin consent.

Adım Adım Çözüm

1
Analyze the user-interactive requirement.
The client application must act on behalf of the signed-in user to access the API. This requires a delegated permission (scope) such as api://<AuditAPI_App_ID>/Audits.Read.
Delegated permissions allow applications to run in the context of a signed-in user, honoring their permissions and identity.
2
Analyze the background service requirement.
The service runs automatically without user interaction. This requires application permissions (App Roles) instead of delegated scopes.
Application permissions are used by daemon services or background tasks that run without a signed-in user.
3
Determine consent requirements.
Application permissions always require administrator consent, whereas delegated permissions for custom APIs may be consented to by users or administrators depending on the organization's policies.
Since application permissions grant access to data across the directory or service without user intervention, they carry higher risk and require admin approval.

Anahtar Kavram

Microsoft Entra ID delegated permissions (scopes) vs. application permissions (App Roles) and consent requirements.
Soru 7Soru →

You are configuring policies in Azure API Management (APIM) for a secure backend API. You must configure the policy to meet the following requirements:

1. Obtain an Entra ID token using the APIM instance's system-assigned managed identity for the database resource https://database.windows.net/ and use it to authenticate to the backend.
2. Retrieve an API key from Azure Key Vault using an APIM named value named kv-backend-key and send it to the backend in an HTTP header named X-API-Key.

Which two of the following XML snippets represent correct policy configurations that must be placed in the policy file to meet these requirements?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: <authentication-managed-identity resource="https://database.windows.net/" /> placed in the <inbound> section; <set-header name="X-API-Key" exists-action="override">
<value>{{kv-backend-key}}</value>
</set-header> placed in the <inbound> section

Cevap

The correct policy configurations require placing the authentication-managed-identity policy without a client ID inside the inbound section, and placing the set-header policy referencing the kv-backend-key named value in double curly braces inside the inbound section.
To authenticate with a system-assigned managed identity, the client-id attribute must be omitted from the authentication-managed-identity policy, and it must be placed in the inbound block so that it runs before the request reaches the backend. The custom header containing the secret is set in the inbound block using set-header and naming the target header, referencing the named value with double curly braces.

Adım Adım Çözüm

1
Determine the authentication mechanism.
Use <authentication-managed-identity resource="https://database.windows.net/" /> since omitting the client-id defaults to the system-assigned managed identity.
The system-assigned managed identity is requested, so no specific client ID should be declared.
2
Determine the proper placement for authentication.
Place the authentication-managed-identity snippet in the <inbound> section.
Authentication must occur before the gateway forwards the request to the backend service.
3
Determine how to reference the Named Value in the header.
Use the <set-header> policy with value referencing {{kv-backend-key}} inside the <inbound> section.
Named values in API Management are referenced using double curly braces to fetch the key vault secret dynamically.

Anahtar Kavram

API Management policies are configured in specific pipeline stages (inbound, backend, outbound, on-error) and can leverage system-assigned managed identities and named values to secure backend communication.
Tahmini Süre:1m 30s
Soru 8Soru →

You are developing a .NET background service using the Azure.Messaging.ServiceBus SDK to process payroll update messages from an Azure Service Bus queue named payroll-queue. The queue has sessions enabled.

The service must meet the following requirements:
- Process messages in the exact order they were sent within each session.
- Ensure that no message is lost if the background service encounters an unhandled exception during processing.
- Follow the principle of least privilege for security and access control.

Which two actions should you perform to implement these requirements? (Select two.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Call client.AcceptNextSessionAsync("payroll-queue") to obtain a session receiver.; Call receiver.CompleteMessageAsync(message) after the message is successfully processed.

Cevap

To implement these requirements, you must obtain a session-enabled receiver using the AcceptNextSessionAsync method, and settle each message by calling CompleteMessageAsync after successful processing.
Accepting the next session ensures that messages with the same session ID are processed in sequence by a single receiver instance. Completing the message manually under PeekLock mode guarantees that if an unhandled exception occurs before completion, the lock will release and another instance can retry the message, ensuring zero message loss.

Adım Adım Çözüm

1
Establish session-based message retrieval.
Call AcceptNextSessionAsync on the ServiceBusClient.
Because the queue has sessions enabled, standard receivers cannot read from it. A session receiver locks a specific session and ensures messages within that session are received sequentially.
2
Settle messages reliably to prevent data loss.
Process the message using the default PeekLock mode, then call CompleteMessageAsync.
PeekLock locks the message temporarily. If the processing fails or an unhandled exception occurs, the lock expires and the message is returned to the queue. Explicitly completing it deletes it only after successful execution.
3
Apply least privilege authentication.
Ensure the identity or token uses Listen-only permissions, and has Get permission on the Key Vault secrets.
Receiving messages requires only Listen permissions, and reading secrets from Key Vault requires Get permissions, maintaining a secure design.

Anahtar Kavram

Azure Service Bus sessions enable FIFO message ordering within a session context, which must be paired with PeekLock receive mode and explicit message settlement to ensure transactional reliability and prevent message loss.
Soru 9Soru →

You are designing an integration solution that uses Azure Queue Storage to process order messages. The application client must occasionally submit order details that exceed 64 KB64\text{ KB} up to a maximum of 1 MB1\text{ MB}. Additionally, the client requires temporary access to add messages to the queue, and this access must expire after 15 minutes15\text{ minutes}.

Which two actions should you perform? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Store payloads that exceed 64 KB64\text{ KB} in Azure Blob Storage, and write the blob reference URL to the queue message.; Generate a service-level Shared Access Signature (SAS) token configured with only the Add permission and an expiration time of 15 minutes15\text{ minutes}.

Cevap

Store payloads that exceed 64 KB64\text{ KB} in Azure Blob Storage, writing the blob reference URL to the queue message, and generate a service-level SAS token configured with only the Add permission and an expiration time of 15 minutes15\text{ minutes}.
To handle message sizes larger than 64 KB64\text{ KB} (such as the 1 MB1\text{ MB} payloads), you must use the Claim Check pattern: save the payload to Azure Blob Storage and write the corresponding blob URL to the queue message. To provide the client application with secure, temporary, and limited access to write messages to the queue, you should generate a service-level SAS token configured with the Add permission only, expiring after 15 minutes15\text{ minutes}.

Adım Adım Çözüm

1
Evaluate the message size requirement.
Identify that because some payloads are up to 1 MB1\text{ MB} (which exceeds the Azure Queue Storage limit of 64 KB64\text{ KB}), a workaround is required.
Azure Queue Storage cannot directly store messages larger than 64 KB64\text{ KB}.
2
Implement the Claim Check pattern.
Store the larger payload in Azure Blob Storage, and put its reference URL in the queue message.
This allows referencing large datasets while staying within the 64 KB64\text{ KB} queue message size limit.
3
Determine the authentication mechanism for temporary write-only client access.
Create a service-level SAS token targeting the specific queue with the Add permission and an expiration window of 15 minutes15\text{ minutes}.
This implements the principle of least privilege (only write access to the queue) and enforces the temporal constraint.

Anahtar Kavram

Handling large queue messages using the Claim Check pattern and securing queue access using least-privilege SAS tokens.
Soru 10Soru →

You are designing an automated deployment for a batch processing workload using Azure Container Instances (ACI). The workload has the following requirements:

1. It must run two containers: a file downloader (producer) and a data analyzer (consumer).
2. Both containers must share a temporary directory that only needs to persist during the lifecycle of the container group.
3. The container images are hosted in a private Azure Container Registry (ACR).
4. The consumer container must securely retrieve a database connection string from an Azure Key Vault.
5. The container group must be deployed inside a subnet of an existing Azure Virtual Network to connect to a private database.

Which three actions should you perform to meet these requirements?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Delegate the target subnet within the Azure Virtual Network to the Microsoft.ContainerInstance/containerGroups service before deployment.; Configure a shared volume of type emptyDir in the container group YAML definition and mount it to both the producer and consumer containers.; Create a user-assigned managed identity, grant it the AcrPull role on the Azure Container Registry, and configure the container group to pull images using this identity.

Cevap

To deploy the solution, you must delegate the virtual network subnet to the container group service, configure an emptyDir volume for ephemeral shared storage, and configure a user-assigned managed identity with the AcrPull role on the private Azure Container Registry to authorize the image pull.
Delegating the subnet to the ACI service is required for VNet integration. Using an emptyDir volume provides shared, ephemeral file storage between containers in the same container group. Using a user-assigned managed identity with the AcrPull role is required because system-assigned identities do not exist in time to authorize the initial image pull during deployment.

Adım Adım Çözüm

1
Configure the virtual network by delegating a subnet to the Microsoft.ContainerInstance/containerGroups service resource type.
The subnet is reserved and configured to host Azure Container Instance container groups.
VNet integration for ACI requires a dedicated subnet that does not host other resource types.
2
Create a user-assigned managed identity and assign it the AcrPull role on the private Azure Container Registry.
The identity has the permission to pull images from the registry.
Since ACI must pull the image before creating the container group, a pre-existing user-assigned identity is required for authentication.
3
Define the container group in YAML or an ARM template, configuring an emptyDir volume and mounting it to both containers.
The containers share a temporary folder that persists for the lifecycle of the container group.
An emptyDir volume provides a shared, non-persistent directory suitable for temporary multi-container processing workloads.

Anahtar Kavram

Azure Container Instances networking, volumes, and private registry authentication
Soru 11Soru →

You are managing container images in an Azure Container Registry (ACR) named `contosoregistry`. You need to configure the registry to meet the following requirements for an image named `payment-service:v2`:

* Prevent the image from being deleted.
* Prevent the image from being overwritten by subsequent build pipelines.
* Allow deployments to continue pulling the image.

Which two Azure CLI commands should you run to meet these requirements? (Select two.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: az acr repository update --name contosoregistry --image payment-service:v2 --delete-enabled false; az acr repository update --name contosoregistry --image payment-service:v2 --write-enabled false

Cevap

Run `az acr repository update` with `--delete-enabled false` to prevent deletion and `--write-enabled false` to prevent overwriting, while ensuring read operations are not disabled.
To protect a container image in Azure Container Registry from deletion, you must disable delete operations using the `--delete-enabled false` parameter. To protect it from being overwritten (which is a write operation), you must disable write operations using the `--write-enabled false` parameter. Since pulling requires read access, the `--read-enabled` parameter must not be disabled.

Adım Adım Çözüm

1
Disable delete operations on the specific image tag
The command `az acr repository update --name contosoregistry --image payment-service:v2 --delete-enabled false` is executed, preventing the image from being deleted.
This directly fulfills the requirement to prevent accidental deletion.
2
Disable write operations on the specific image tag
The command `az acr repository update --name contosoregistry --image payment-service:v2 --write-enabled false` is executed, preventing the image from being overwritten.
This directly fulfills the requirement to prevent subsequent build pipelines from overwriting the image.
3
Ensure read operations remain enabled
Do not set `--read-enabled false`.
This ensures the image can still be pulled for deployments.

Anahtar Kavram

Locking container images in Azure Container Registry (ACR) to enforce immutability and prevent deletion or overwriting.
Tahmini Süre:2m 0s
Soru 12Soru →

You need to build a container image and push it to an Azure Container Registry named `acrdemo` using the Azure CLI. You want to run the build in Azure Container Registry (ACR) without using a local container engine or daemon. The Dockerfile is located in your current local directory. Which two parameters or arguments must you specify in the `az acr build` command?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: The --registry parameter (or -r) followed by the registry name; The path to the source directory, such as a period (.) to represent the current directory

Cevap

To build an image using Azure Container Registry Tasks from a local directory, you must run the 'az acr build' command and specify the registry name (using the --registry parameter) and the path to the source files (such as the current directory '.').
To run the az acr build command, you must specify the destination registry via the --registry parameter and the source directory path (such as the period representing the current directory). The command sends the source context to the registry, builds the image, and pushes it automatically.

Adım Adım Çözüm

1
Ensure the Azure CLI is logged in and has access to the target Azure Container Registry.
Your active command-line session is authenticated with Azure.
The build command uses the CLI session's context automatically, eliminating the need for a separate login parameter.
2
Identify the target container registry and the directory containing the Dockerfile.
You have the registry name (acrdemo) and the source directory path (e.g., '.').
These two arguments are mandatory inputs for the az acr build command.
3
Construct and run the command: az acr build --registry acrdemo .
The local source context is packaged, sent to the ACR instance, built according to the Dockerfile, and the resulting image is pushed to the registry.
This executes the remote build without requiring a local Docker container engine.

Anahtar Kavram

Azure Container Registry (ACR) Tasks allow developers to offload container image builds to Azure, removing the need for a local Docker installation. The 'az acr build' command requires the target registry name and the source directory context to run.
Soru 13Soru →

You are planning a serverless processing solution using Azure Functions. You need to configure the hosting plans and execution patterns for your function app. Which of the following statements are correct? (Select TWO)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: The Premium plan provides pre-warmed instances to avoid cold-start latency and supports virtual network integration.; To implement a stateful workflow where multiple functions run in a sequence (function chaining), you should use Durable Functions.

Cevap

The Premium plan provides pre-warmed instances and VNet integration, and Durable Functions should be used to implement stateful workflows such as function chaining.
The Premium plan is correct because it offers pre-warmed instances to eliminate cold start and supports VNet integration. Durable Functions is correct because it is specifically designed to manage state and coordinate workflows like function chaining.

Adım Adım Çözüm

1
Evaluate the execution timeout requirements of the application.
Identify that the Consumption plan is limited to a maximum execution duration of 10 minutes, making it incorrect for 30-minute workloads.
Ensures the correct hosting plan is selected based on workload runtime constraints.
2
Analyze how stateful workflows should be implemented in Azure Functions.
Determine that direct chaining of stateless functions via HTTP triggers is an anti-pattern, whereas Durable Functions provides first-class support for stateful orchestration.
Ensures proper design patterns are followed for sequence processing.
3
Assess the capabilities of the Premium hosting plan.
Verify that the Premium plan offers pre-warmed instances to prevent cold starts and allows virtual network integration.
Confirms the Premium plan satisfies the performance and network isolation requirements.

Anahtar Kavram

Azure Functions hosting plans and stateful orchestration using Durable Functions
Soru 14Soru →

You are configuring an Azure App Service web app to securely retrieve database credentials from an Azure Key Vault. The solution must use a system-assigned managed identity to access the Key Vault without storing any credentials in the application code or settings.

Which two configuration steps should you perform?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Enable a system-assigned managed identity for the App Service web app.; Create an access policy in the Key Vault that grants the web app's identity Secret Get permissions.

Cevap

Enable a system-assigned managed identity for the App Service web app, and create an access policy in the Key Vault that grants the web app's identity Secret Get permissions.
To retrieve secrets securely, you must first enable a system-assigned managed identity on the App Service web app so it can authenticate to Azure resources. Second, you must authorize this identity in the Key Vault by creating an access policy that grants it Get permissions on secrets.

Adım Adım Çözüm

1
Enable the system-assigned managed identity on the web app.
The web app is registered in Microsoft Entra ID and gets a service principal identity.
This establishes a secure identity that the web app can use to authenticate with Key Vault without credentials.
2
Configure permissions on the Key Vault.
The managed identity is granted Get permissions on Key Vault secrets.
This authorizes the web app's identity to retrieve the specific secret values from Key Vault.

Anahtar Kavram

Configuring Azure App Service to securely access Key Vault secrets using managed identities
Soru 15Soru →

You are configuring a self-hosted runner on an Azure Virtual Machine to build and push container images to an Azure Container Registry (ACR) named devregistry2026. You want to use a user-assigned managed identity to authenticate the Virtual Machine runner to the registry. Which two actions should you perform?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Assign the AcrPush role to the user-assigned managed identity.; Run the az login --identity command on the Virtual Machine.

Cevap

Assign the AcrPush role to the user-assigned managed identity and run the az login --identity command on the Virtual Machine.
To push container images to Azure Container Registry using a user-assigned managed identity, you must assign the AcrPush role to the identity to grant the necessary write permissions. Additionally, you must run the az login --identity command to authenticate the CLI context on the Virtual Machine using the associated managed identity.

Adım Adım Çözüm

1
Assign the AcrPush role to the user-assigned managed identity for the target Azure Container Registry resource.
The identity is granted write/push permissions to the registry.
Permissions must be explicitly granted using Azure Role-Based Access Control (RBAC) to allow the identity to push images.
2
Run the az login --identity command on the Virtual Machine runner.
The Azure CLI session is authenticated using the managed identity credentials.
This establishes the security context so that subsequent registry interactions are authenticated.

Anahtar Kavram

Azure Container Registry authentication using user-assigned managed identities and Azure RBAC roles.
Soru 16Soru →

An organization is deploying an Azure Function App on a Consumption plan to process messages from an Azure Queue Storage queue. To avoid overwhelming a downstream legacy database, you must implement the following constraints:

1. Restrict the maximum scale-out of the function app instances to a specific limit.
2. Control the maximum number of messages that a single instance can process concurrently.

Which two configurations should you apply to meet these requirements?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configure the batchSize property inside the queues section of the host.json file.; Add the WEBSITE_MAX_DYNAMIC_APPLICATION_SCALE_OUT application setting and set it to the maximum instance limit.

Cevap

Configure the batchSize property inside the queues section of the host.json file, and add the WEBSITE_MAX_DYNAMIC_APPLICATION_SCALE_OUT application setting set to the maximum instance limit.
To limit scaling and concurrency, you must configure two separate levels: the overall instance count and the concurrency per instance. The setting for the overall instance count on dynamic plans (Consumption/Premium) is the WEBSITE_MAX_DYNAMIC_APPLICATION_SCALE_OUT application setting. The concurrency per instance for Queue Storage triggers is controlled by configuring the batchSize setting within the queues configuration of host.json.

Adım Adım Çözüm

1
Identify the mechanism to limit instance scale-out for a Consumption plan function app.
The WEBSITE_MAX_DYNAMIC_APPLICATION_SCALE_OUT application setting controls the maximum scale-out limit for dynamic hosting plans.
By default, Consumption plans can scale out to many instances, which might overwhelm downstream systems. Setting WEBSITE_MAX_DYNAMIC_APPLICATION_SCALE_OUT limits this scale-out behavior.
2
Identify the configuration file and property for managing queue trigger concurrency on a single instance.
The queues extension in the host.json file contains the batchSize property, which controls how many messages are retrieved and processed concurrently per instance.
Queue trigger concurrency is managed globally for the function app via the host.json configuration file under the extensions/queues path.

Anahtar Kavram

Azure Functions scaling limits and queue trigger concurrency configuration.
Soru 17Soru →

You are configuring an Azure App Service web app named `prod-webapp` to retrieve a database connection string from an Azure Key Vault named `prod-vault`. The secret in the Key Vault is named `DbConnectionString`. The web app must retrieve the secret using a user-assigned managed identity named `app-identity` (resource ID: `/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/myRG/providers/Microsoft.ManagedIdentity/userAssignedIdentities/app-identity`). No system-assigned identity is enabled on the web app. Which two of the following configurations are required to ensure the web app can successfully retrieve the secret? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Set the `DbConnectionString` application setting to `@Microsoft.KeyVault(SecretUri=https://prod-vault.vault.azure.net/secrets/DbConnectionString/)`; Configure the web app's `keyVaultReferenceIdentity` property to the resource ID of the `app-identity` user-assigned managed identity.

Cevap

To retrieve the secret successfully, you must configure the application setting using the correct Key Vault reference syntax `@Microsoft.KeyVault(SecretUri=...)` and configure the web app's `keyVaultReferenceIdentity` property to the resource ID of the user-assigned managed identity.
To retrieve a secret using a Key Vault reference in Azure App Service with a user-assigned managed identity, you must perform two main configurations: first, format the application setting value using the correct Key Vault reference syntax (e.g., using `@Microsoft.KeyVault(SecretUri=...)` or `@Microsoft.KeyVault(VaultName=...;SecretName=...)`). Second, configure the web app's `keyVaultReferenceIdentity` property to point to the resource ID of the user-assigned identity. This instructs the App Service to use that specific user-assigned identity to authenticate against the Key Vault.

Adım Adım Çözüm

1
Define the Application Setting `DbConnectionString` using the standard Key Vault reference format.
The setting references the secret URL `https://prod-vault.vault.azure.net/secrets/DbConnectionString/`.
This tells the App Service runtime to resolve the value from Key Vault rather than storing it in plain text.
2
Configure the App Service Web App to use the user-assigned identity for resolving Key Vault references.
The web app's `keyVaultReferenceIdentity` configuration is set to the resource ID of `app-identity`.
Since a user-assigned managed identity is used, App Service needs to know which identity to present when fetching Key Vault references.

Anahtar Kavram

Configuring Key Vault references in Azure App Service using user-assigned managed identities.
Tahmini Süre:2m 0s
Soru 18Soru →

You are configuring an Azure App Service web app named `app-billing-prod` to retrieve database credentials from an Azure Key Vault named `kv-billing-prod` using a user-assigned managed identity named `id-billing-prod`.

Which two of the following actions must you perform to configure the web app to resolve Key Vault references using the user-assigned managed identity?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Set the Key Vault reference identity configuration of the web app to the resource ID of `id-billing-prod`.; Create a Key Vault access policy in `kv-billing-prod` that grants the Secret Get permission to `id-billing-prod`.

Cevap

To configure the web app to resolve Key Vault references using a user-assigned managed identity, you must set the web app's Key Vault reference identity configuration to the resource ID of the user-assigned identity, and create an access policy in the Key Vault that grants the Secret Get permission to the user-assigned managed identity.
To resolve Key Vault references using a user-assigned managed identity, the App Service needs to know which identity to use, and that identity must have read access to the secrets. This is accomplished by setting the Key Vault reference identity configuration of the web app to the user-assigned identity's resource ID, and creating a Key Vault access policy that grants the Secret Get permission to that user-assigned identity.

Adım Adım Çözüm

1
Assign the user-assigned managed identity to the Web App and configure the Key Vault reference identity setting.
The App Service's keyVaultReferenceIdentity property is set to the resource ID of the user-assigned managed identity.
By default, App Service attempts to resolve Key Vault references using its system-assigned identity. Specifying the keyVaultReferenceIdentity setting tells App Service to use the user-assigned identity instead.
2
Grant the user-assigned managed identity permissions in the Key Vault.
An access policy (or RBAC assignment) is created granting the Secret Get permission to the user-assigned managed identity.
The configured identity must have access rights to retrieve secrets from the target Key Vault for reference resolution to succeed.

Anahtar Kavram

Configuring Key Vault references with user-assigned managed identity in Azure App Service
Soru 19Soru →

A financial services company is deploying an event-driven application using Azure Functions V4. The application includes a function that processes incoming queue messages from an Azure Service Bus namespace. The security architecture mandates that the Function App must connect to the Service Bus namespace using its system-assigned managed identity, completely eliminating the use of connection strings, shared access signature (SAS) keys, or secrets. The Service Bus trigger in the function code is configured with Connection = "ServiceBusConnection". Which of the following configuration steps must be implemented to establish this identity-based connection? (Select TWO)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Assign the Azure Service Bus Data Receiver role to the system-assigned managed identity of the Function App.; Add an application setting named ServiceBusConnection__fullyQualifiedNamespace and set its value to the fully qualified domain name of the Service Bus namespace.

Cevap

To establish the identity-based connection, you must assign the Azure Service Bus Data Receiver role to the system-assigned managed identity of the Function App and add an application setting named ServiceBusConnection__fullyQualifiedNamespace set to the fully qualified domain name of the Service Bus namespace.
Establishing an identity-based connection requires configuring both the application host configuration and data-plane access. Specifying the ServiceBusConnection__fullyQualifiedNamespace setting directs the Function App to target the correct namespace without requiring secrets. Assigning the Azure Service Bus Data Receiver role ensures that the system-assigned managed identity has the necessary permission to consume messages from the queues within the namespace.

Adım Adım Çözüm

1
Assign the data-plane access role to the managed identity.
The system-assigned managed identity is granted the Azure Service Bus Data Receiver role on the Service Bus namespace level.
Azure Functions triggers require data-plane access to retrieve and process queue messages. Management-plane roles like Contributor are insufficient.
2
Configure the Connection setting using the fullyQualifiedNamespace suffix in the app settings.
The application setting ServiceBusConnection__fullyQualifiedNamespace is added with the value of the Service Bus namespace host name (e.g., mysbnamespace.servicebus.windows.net).
Azure Functions V4 uses the __fullyQualifiedNamespace suffix on the connection name prefix to resolve the endpoint when using an identity-based connection instead of a connection string.

Anahtar Kavram

Identity-based connections in Azure Functions V4
Soru 20Soru →

You are deploying a multi-container group to Azure Container Instances (ACI) using a YAML deployment file. The deployment consists of an application container and a logging sidecar container. The container images are hosted in a private Azure Container Registry (ACR). The application requires persistent storage provided by an Azure File share, and must authenticate to ACR using a user-assigned managed identity to avoid storing credentials in the YAML file. Which two of the following configuration blocks must you include in the YAML deployment definition to satisfy these requirements? (Select two.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: An 'identity' block at the container group root level with type 'UserAssigned' containing the managed identity's resource ID, and an 'imageRegistryCredentials' block specifying the ACR server and the identity's resource ID.; A 'volumes' block at the container group root level specifying the 'azureFile' details (shareName, storageAccountName, and storageAccountKey), and a 'volumeMounts' block inside the container definitions specifying the volume name and mountPath.

Cevap

To deploy the multi-container group with secure registry authentication and persistent storage, the YAML definition must contain a root-level identity block with the user-assigned identity resource ID coupled with an image registry credentials block pointing to that identity. Additionally, the Azure File share must be declared in a volumes block at the root and mapped to a volumeMounts block within the containers.
To pull container images from a private ACR using a user-assigned managed identity, the container group must have the identity enabled at the root level and referenced in the registry credentials block. To mount an Azure File share, the volume must be defined at the container group root level with the required storage account credentials and referenced in the container definitions under volume mounts.

Adım Adım Çözüm

1
Define the user-assigned managed identity under the root-level 'identity' property of the container group.
The identity is successfully associated with the ACI deployment.
Enables ACI to use the managed identity for interactions with other Azure resources.
2
Configure the 'imageRegistryCredentials' section in the YAML to reference the ACR server and map the 'identity' field to the user-assigned managed identity's resource ID.
ACI can authenticate with ACR during the container creation phase.
Allows ACI to pull the private container images securely without embedding registry passwords in the YAML file.
3
Define the volume using the 'azureFile' driver under the root-level 'volumes' array of the container group.
The volume representing the Azure File share is defined for the container group.
Provides the backend storage credentials and share configuration necessary for mounting.
4
Add a 'volumeMounts' block to the containers that need access to the persistent storage, linking them to the defined volume name and directory path.
The container filesystem accesses the persistent share at the specified path.
Exposes the mounted volume to the container runtimes.

Anahtar Kavram

Multi-container group configuration in ACI involving secure registry authentication via managed identity and persistent volume mounts.
Sayfa 1 / 14Sonraki
Tüm alıştırma soruları — Microsoft Azure Developer (AZ-204) | Examkin