Microsoft Microsoft Certifications AZ-204 Questions & Answers

• Question 111:

  HOTSPOT

  You are developing an ASP.NET Core app that includes feature flags which are managed by Azure App Configuration. You create an Azure App Configuration store named AppFeatureflagStore as shown in the exhibit:

  

  You must be able to use the feature in the app by using the following markup:

  

  You need to update the app to use the feature flag.

  Which values should you use? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Box 1: FeatureGate

  You can use the FeatureGate attribute to control whether a whole controller class or a specific action is enabled.

  Box 2: AddAzureAppConfiguration

  The extension method AddAzureAppConfiguration is used to add the Azure App Configuration Provider.

  Box 3: https://appfeatureflagstore.azconfig.io

  You need to request the access token with resource=https://.azconfig.io

  Reference:

  https://docs.microsoft.com/en-us/azure/azure-app-configuration/use-feature-flags-dotnet-core

  https://csharp.christiannagel.com/2020/05/19/azureappconfiguration/

  https://stackoverflow.com/questions/61899063/how-to-use-azure-app-configuration-rest-api

• Question 112:

  HOTSPOT

  You are developing a web application that will use Azure Storage. Older data will be less frequently used than more recent data.

  You need to configure data storage for the application. You have the following requirements:

  1.

  Retain copies of data for five years.

  2.

  Minimize costs associated with storing data that is over one year old.

  3.

  Implement Zone Redundant Storage for application data.

  What should you do? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Reference: https://docs.microsoft.com/en-us/azure/storage/blobs/storage-blob-storage-tiers https://docs.microsoft.com/en-us/azure/storage/common/storage-redundancy?toc=/azure/storage/blobs/toc.json

• Question 113:

  HOTSPOT

  You are developing a .NET application that communicates with Azure Storage.

  A message must be stored when the application initializes.

  You need to implement the message.

  How should you complete the code segment? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Reference: https://docs.microsoft.com/en-us/azure/storage/queues/storage-dotnet-how-to-use-queues?tabs=dotnetv11

• Question 114:

  HOTSPOT

  You develop a containerized application. You plan to deploy the application to a new Azure Container instance by using a third-party continuous integration and continuous delivery (CI/CD) utility.

  The deployment must be unattended and include all application assets. The third-party utility must only be able to push and pull images from the registry. The authentication must be managed by Azure Active Directory (Azure AD). The solution must use the principle of least privilege.

  You need to ensure that the third-party utility can access the registry.

  Which authentication options should you use? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Box 1: Service principal

  Applications and container orchestrators can perform unattended, or "headless," authentication by using an Azure Active Directory (Azure AD) service principal.

  Incorrect Answers:

  1.

  Individual AD identity does not support unattended push/pull

  2.

  Repository-scoped access token is not integrated with AD identity

  3.

  Managed identity for Azure resources is used to authenticate to an Azure container registry from another Azure resource.

  Box 2: AcrPush AcrPush provides pull/push permissions only and meets the principle of least privilege. Incorrect Answers:

  1.

  AcrPull only allows pull permissions it does not allow push permissions.

  2.

  Owner and Contributor allow pull/push permissions but does not meet the principle of least privilege.

  Reference: https://docs.microsoft.com/en-us/azure/container-registry/container-registry-authentication?tabs=azure-cli https://docs.microsoft.com/en-us/azure/container-registry/container-registry-roles?tabs=azure-cli

• Question 115:

  HOTSPOT

  You are developing a web application that makes calls to the Microsoft Graph API. You register the application in the Azure portal and upload a valid X509 certificate.

  You create an appsettings.json file containing the certificate name, client identifier for the application, and the tenant identifier of the Azure Active Directory (Azure AD). You create a method named ReadCertificate to return the X509 certificate

  by name.

  You need to implement code that acquires a token by using the certificate.

  How should you complete the code segment? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Box 1: ConfidentialClientApplicationBuilder

  Here's the code to instantiate the confidential client application with a client secret:

  app = ConfidentialClientApplicationBuilder.Create(config.ClientId)

  .WithClientSecret(config.ClientSecret)

  .WithAuthority(new Uri(config.Authority))

  .Build();

  Box 2: scopes

  After you've constructed a confidential client application, you can acquire a token for the app by calling AcquireTokenForClient, passing the scope, and optionally forcing a refresh of the token.

  Sample code: result = await app.AcquireTokenForClient(scopes) .ExecuteAsync();

  Reference: https://docs.microsoft.com/en-us/azure/active-directory/develop/scenario-daemon-app-configuration https://docs.microsoft.com/en-us/azure/active-directory/develop/scenario-daemon-acquire-token

• Question 116:

  HOTSPOT

  You have developed a Web App for your company. The Web App provides services and must run in multiple regions.

  You want to be notified whenever the Web App uses more than 85 percent of the available CPU cores over a 5 minute period. Your solution must minimize costs.

  Which command should you use? To answer, select the appropriate settings to the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Reference: https://docs.microsoft.com/sv-se/cli/azure/monitor/metrics/alert

• Question 117:

  HOTSPOT

  You are developing an application that uses a premium block blob storage account. You are optimizing costs by automating Azure Blob Storage access tiers.

  You apply the following policy rules to the storage account. You must determine the implications of applying the rules to the data. (Line numbers are included for reference only.)

  

  For each of the following statements, select Yes if the statement is true. Otherwise, select No.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Box 1: Yes

  

  Box 2: Yes Box 3: Yes Box 4: Yes

  

  

• Question 118:

  HOTSPOT

  You have an Azure Web app that uses Cosmos DB as a data store. You create a CosmosDB container by running the following PowerShell script:

  $resourceGroupName = "testResourceGroup"$accountName = "testCosmosAccount" $databaseName = "testDatabase" $containerName = "testContainer" $partitionKeyPath = "/EmployeeId"$autoscaleMaxThroughput = 5000

  New-AzCosmosDBSqlContainer

  -ResourceGroupName $resourceGroupName

  -AccountName $accountName

  -DatabaseName $databaseName

  -Name $containerName

  -PartitionKeyKind Hash

  -PartitionKeyPath $partitionKeyPath

  -AutoscaleMaxThroughput $autoscaleMaxThroughput

  You create the following queries that target the container:

  SELECT * FROM c WHERE c.EmployeeId > '12345'SELECT * FROM c WHERE c.UserID = '12345'

  For each of the following statements, select Yes if the statement is true. Otherwise, select No.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Box 1: No

  You set the highest, or maximum RU/s Tmax you don't want the system to exceed. The system automatically scales the throughput T such that 0.1* Tmax <= T <= Tmax.

  In this example we have autoscaleMaxThroughput = 5000, so the minimum throughput for the container is 500 R/Us.

  Box 2: No

  First query: SELECT * FROM c WHERE c.EmployeeId > '12345'

  Here's a query that has a range filter on the partition key and won't be scoped to a single physical partition. In order to be an in-partition query, the query must have an equality filter that includes the partition key:

  SELECT * FROM c WHERE c.DeviceId > 'XMS-0001'

  Box 3: Yes

  Example of In-partition query:

  Consider the below query with an equality filter on DeviceId. If we run this query on a container partitioned on DeviceId, this query will filter to a single physical partition.

  SELECT * FROM c WHERE c.DeviceId = 'XMS-0001'

  Reference:

  https://docs.microsoft.com/en-us/azure/cosmos-db/how-to-choose-offer

  https://docs.microsoft.com/en-us/azure/cosmos-db/how-to-query-container

• Question 119:

  HOTSPOT

  You have an Azure Active Directory (Azure AD) tenant.

  You want to implement multi-factor authentication by making use of a conditional access policy. The conditional access policy must be applied to all users when they access the Azure portal.

  Which three settings should you configure? To answer, select the appropriate settings to the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Box 1:

  The conditional access policy must be applied or assigned to Users and Groups.

  Box 2:

  The conditional access policy must be applied when users access the Azure portal, which is a cloud app. That is: Microsoft Azure Management

  Box 3:

  Access control must require multi-factor authentication when granting access.

  Reference:

  https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/app-based-mfa

• Question 120:

  HOTSPOT

  You are creating an app that uses Event Grid to connect with other services. Your app's event data will be sent to a serverless function that checks compliance. This function is maintained by your company.

  You write a new event subscription at the scope of your resource. The event must be invalidated after a specific period of time.

  You need to configure Event Grid.

  What should you do? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Box 1: SAS tokens

  Custom topics use either Shared Access Signature (SAS) or key authentication. Microsoft recommends SAS, but key authentication provides simple programming, and is compatible with many existing webhook publishers.

  In this case we need the expiration time provided by SAS tokens.

  Box 2: ValidationCode handshake

  Event Grid supports two ways of validating the subscription: ValidationCode handshake (programmatic) and ValidationURL handshake (manual).

  If you control the source code for your endpoint, this method is recommended.

  Incorrect Answers:

  ValidationURL handshake (manual): In certain cases, you can't access the source code of the endpoint to implement the ValidationCode handshake. For example, if you use a third-party service (like Zapier or IFTTT), you can't

  programmatically respond with the validation code.

  Reference:

  https://docs.microsoft.com/en-us/azure/event-grid/security-authentication