Develop Azure Compute Solutions

You are developing a document approval workflow using Azure Durable Functions in C# (.NET Isolated). The workflow must wait for an external approval event named `DocumentApproved` for up to $24$ hours. If the event is received within $24$ hours, the document is processed. If the $24$-hour limit is reached without receiving the event, the document must be marked as expired. You write the following orchestrator function code:

csharp
[Function("ApprovalOrchestrator")]
public static async Task Run(
[OrchestrationTrigger] TaskOrchestrationContext context)
{
var approvalTask = context.WaitForExternalEvent<bool>("DocumentApproved");
var timeoutTask = Task.Delay(TimeSpan.FromHours(24));

var completedTask = await Task.WhenAny(approvalTask, timeoutTask);
if (completedTask == approvalTask)
{
bool isApproved = approvalTask.Result;
await context.CallActivityAsync("ProcessDocument", isApproved);
}
else
{
await context.CallActivityAsync("ExpireDocument", null);
}
}

Which of the following describes the defect in this orchestrator code?

A developer needs to push a locally built container image to an Azure Container Registry (ACR) named contosoacr. The developer has already logged into their Azure account on their workstation using the Azure CLI command az login. However, when they attempt to push the image, they receive an authentication error from the Docker daemon.

Which of the following Azure CLI commands should the developer run to authenticate the local Docker daemon to the registry?

You are developing a serverless API using Azure Functions. The API must scale automatically to handle traffic spikes, but it requires that instances are pre-warmed to completely avoid cold-start latency. Which hosting plan should you select?

You are deploying an ASP.NET Core web application to an Azure App Service Web App named app-prod-01. The application requires a secret named DbConnectionString stored in an Azure Key Vault named kv-prod-01. The Web App has a system-assigned managed identity that is already configured with a GET access policy on the key vault. You must configure the application settings in the Web App to reference the Key Vault secret without modifying the code. Which configuration format must you use for the value of the DbConnectionString application setting?

You are configuring an Azure Function App that runs on a Consumption hosting plan. You need to increase the execution timeout limit for all functions in the app to the maximum allowable duration under this hosting plan.

Which configuration should you apply to the host.json file?

Your company deploys an Azure App Service web app named webapp-prod. The web app must retrieve a database connection string securely from an Azure Key Vault named kv-prod. You configure a user-assigned managed identity named id-webapp for webapp-prod and grant it the Key Vault Secrets User role on kv-prod. You need to configure the App Service application settings so that the web app can retrieve the latest version of the secret named DbConnectionString using the user-assigned identity. Which of the following configurations should you apply to the App Service application settings?

You are configuring a continuous integration pipeline in GitHub Actions to build and push a container image to an Azure Container Registry (ACR) named contosoacr.azurecr.io. The runner does not have the Azure CLI installed, but has the Docker CLI installed. You have created an Azure Active Directory (Azure AD) service principal with the AcrPush role.

You need to authenticate the Docker CLI on the runner to contosoacr.azurecr.io using the service principal credentials.

Which command should you execute in the pipeline runner?

You are a developer managing container images in Azure. You need to copy a container image named application:v1 from a development Azure Container Registry named devreg to a production Azure Container Registry named prodreg. Both registries are in the same Azure subscription. To save network bandwidth and time, you want to perform this copy directly from registry to registry, without downloading the image to your local workspace or requiring a local Docker installation. Which Azure CLI command should you run?

You are designing an automated deployment for a batch processing workload using Azure Container Instances (ACI). The workload has the following requirements:

1. It must run two containers: a file downloader (producer) and a data analyzer (consumer).
2. Both containers must share a temporary directory that only needs to persist during the lifecycle of the container group.
3. The container images are hosted in a private Azure Container Registry (ACR).
4. The consumer container must securely retrieve a database connection string from an Azure Key Vault.
5. The container group must be deployed inside a subnet of an existing Azure Virtual Network to connect to a private database.

Which three actions should you perform to meet these requirements?

Your company is deploying a web application to Azure App Service. The application requires a database connection string that is stored securely as a secret named 'db-conn' in an Azure Key Vault named 'kv-prod'. You need to configure the web app's application settings to reference this Key Vault secret using its name. Which value should you use for the application setting?

You are configuring a CI/CD pipeline script to push container images to an Azure Container Registry (ACR) named `myregistry`. The script runs in a lightweight container context where only the Docker CLI is available for the build and push steps. To authenticate, you have already retrieved a Microsoft Entra ID access token for the registry using the Azure CLI and stored it in a variable named `$TOKEN`.

You need to run the `docker login` command to authenticate the local Docker daemon to the registry using this token.

Which command should you run?

An organization is designing a serverless background processing solution using Azure Functions V4 to process large batches of files uploaded to an Azure Blob Storage container. The solution must satisfy the following constraints:
- Individual file processing operations are CPU-intensive and can take up to 15 minutes to complete.
- The function app must connect securely to an Azure SQL Database that is restricted to a private virtual network.
- The system must dynamically scale out the number of instances to handle sudden, unpredictable spikes in upload volume, and scale back down when idle.
- Cold start latency must be minimized for initial requests after periods of inactivity.

Which hosting plan should the organization choose to deploy the Azure Function app?

You are configuring an Azure Container Registry (ACR) task named `build-task` in a registry named `myregistry`. The task must build a container image from a remote GitHub repository and push it to `myregistry`. The build process requires pulling a private base image from an external Azure Container Registry named `sharedregistry.azurecr.io`.

You create a user-assigned managed identity named `task-identity` and assign it the `AcrPull` role on `sharedregistry.azurecr.io`.

You associate the identity with the task by running the following command:
azurecli
az acr task create \
--registry myregistry \
--name build-task \
--image myimage:latest \
--context https://github.com/myorg/myrepo.git#main \
--file Dockerfile \
--assign-identity /subscriptions/00000000-0000-0000-0000-000000000000/resourcegroups/myrg/providers/Microsoft.ManagedIdentity/userAssignedIdentities/task-identity

When the task executes, the build fails during the base image pull from `sharedregistry.azurecr.io` with an HTTP 401 Unauthorized error.

Which command should you execute to enable the task to authenticate successfully to the external registry?

You are designing an Azure Function app (Runtime version 4.x) that processes sensitive financial transactions from an Azure Service Bus queue. The function requires outbound connectivity to an Azure SQL Database secured behind a private endpoint in a virtual network (VNet). The transaction processing logic is resource-intensive, requiring up to 25 minutes to complete per batch, and must avoid any cold start latency to meet strict Service Level Agreements (SLAs). Additionally, you must ensure that the function app does not scale beyond 20 concurrent VM instances to prevent connection pool exhaustion on the database. Which hosting plan and scale configuration should you implement to meet these requirements?

You have an Azure App Service web app named app-contoso that runs in a Standard App Service plan. You need to configure a custom domain www.contoso.com for the web app and secure the domain using a free Azure App Service Managed Certificate.

Which four actions should you perform in sequence? To answer, arrange the actions in the correct order.

You are setting up a secure continuous integration (CI) pipeline to build and publish container images to an Azure Container Registry (ACR) named `acr2026`.

The pipeline must authenticate using an Azure Active Directory service principal named `sp-pipeline`. The service principal has just been created and has no permissions assigned.

You need to configure permissions, authenticate the pipeline runner, build a local image, and upload the image.

In which order should you perform the steps? To answer, arrange the actions in the correct sequence.

You need to configure local Git deployment for a new Azure App Service web app. Which sequence of steps should you perform? To answer, move all actions from the list of actions to the answer area and arrange them in the correct order.

You are developing a secure serverless solution using Azure Functions V4. You need to configure a Function App to retrieve a database connection string from an Azure Key Vault. The security team requires that you use a user-assigned managed identity rather than a system-assigned managed identity to access the Key Vault secrets.

Which five actions should you perform in sequence to configure the Function App? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

You are configuring an Azure Function App (Runtime version 4.x) to securely retrieve database credentials from Azure Key Vault. Security guidelines require the following constraints:
- You must use a user-assigned managed identity.
- You must not enable or use a system-assigned managed identity.
- The Azure Functions hosting platform must natively resolve the secrets without custom code.
- The configuration must follow the principle of least privilege, ensuring no intermediate state exposes unresolved secrets to the application runtime or results in service resolution failures.

In which order should you execute the configuration steps to successfully enable the Function App to resolve the Key Vault secrets?

An Azure App Service plan currently hosts a single instance of a web application. You configure a scale-out rule to add one instance to the plan when the average CPU usage exceeds $80\%$ for $10$ minutes. You need to configure a scale-in rule to remove one instance when the traffic decreases. Assuming the workload is distributed evenly across all instances after scaling out, which of the following is the maximum CPU threshold you should set for the scale-in rule to prevent autoscale flapping?