Microsoft Microsoft Certifications AZ-204 Questions & Answers

• Question 181:

  DRAG DROP

  You are preparing to deploy an application to an Azure Kubernetes Service (AKS) cluster.

  The application must only be available from within the VNet that includes the cluster.

  You need to deploy the application.

  How should you complete the deployment YAML? To answer, drag the appropriate YAML segments to the correct locations. Each YAML segment may be used once, more than once, or not at all. You may need to drag the split bar between

  panes or scroll to view content.

  NOTE: Each correct selection is worth one point.

  Select and Place:

  

  Correct Answer:

  

  To create an internal load balancer, create a service manifest named internal-lb.yaml with the service type LoadBalancer and the azure-load-balancer-internal annotation as shown in the following example:

  YAML:

  apiVersion: v1

  kind: Service

  metadata:

  name: internal-app

  annotations:

  service.beta.kubernetes.io/azure-load-balancer-internal: "true" spec:

  type: LoadBalancer

  ports:

  -port: 80 selector: app: internal-app

  References: https://docs.microsoft.com/en-us/azure/aks/internal-lb

• Question 182:

  DRAG DROP

  You develop and deploy a web app to Azure App Service in a production environment. You scale out the web app to four instances and configure a staging slot to support changes.

  You must monitor the web app in the environment to include the following requirements:

  1.

  Increase web app availability by re-routing requests away from instances with error status codes and automatically replace instances if they remain in an error state after one hour.

  2.

  Send web server logs, application logs, standard output and standard error messaging to an Azure Storage blob account.

  You need to configure Azure App Service.

  Which values should you use? To answer, drag the appropriate configuration value to the correct requirements. Each configuration value may be used once, more than....

  Select and Place:

  

  Correct Answer:

  

• Question 183:

  DRAG DROP

  You are developing a web service that will run on Azure virtual machines that use Azure Storage. You configure all virtual machines to use managed identities.

  You have the following requirements:

  1.

  Secret-based authentication mechanisms are not permitted for accessing an Azure Storage account.

  2.

  Must use only Azure Instance Metadata Service endpoints.

  You need to write code to retrieve an access token to access Azure Storage. To answer, drag the appropriate code segments to the correct locations. Each code segment may be used once or not at all. You may need to drag the split bar

  between panes or scroll to view content.

  NOTE: Each correct selection is worth one point.

  Select and Place:

  

  Correct Answer:

  

  Azure Instance Metadata Service endpoints "/oauth2/token"

  Box 1: http://169.254.169.254/metadata/identity/oauth2/token Sample request using the Azure Instance Metadata Service (IMDS) endpoint (recommended): GET 'http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02- 01andresource=https://management.azure.com/' HTTP/1.1 Metadata: true Box 2: JsonConvert.DeserializeObject>(payload); Deserialized token response; returning access code.

• Question 184:

  DRAG DROP

  You are developing a REST web service. Customers will access the service by using an Azure API Management instance.

  The web service does not correctly handle conflicts. Instead of returning an HTTP status code of 409, the service returns a status code of 500. The body of the status message contains only the word conflict.

  You need to ensure that conflicts produce the correct response.

  How should you complete the policy? To answer, drag the appropriate code segments to the correct locations. Each code segment may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.

  NOTE: Each correct selection is worth one point.

  Select and Place:

  

  Correct Answer:

  

  Box 1: on-error

  Policies in Azure API Management are divided into inbound, backend, outbound, and on- error.

  If there is no on-error section, callers will receive 400 or 500 HTTP response messages if an error condition occurs.

  Box 2: context

  Box 3: context

  Box 4: set-status

  The return-response policy aborts pipeline execution and returns either a default or custom response to the caller. Default response is 200 OK with no body. Custom response can be specified via a context variable or policy statements.

  Syntax:

  Box 5: on-error

• Question 185:

  DRAG DROP

  An organization plans to deploy Azure storage services.

  You need to configure shared access signature (SAS) for granting access to Azure Storage.

  Which SAS types should you use? To answer, drag the appropriate SAS types to the correct requirements. Each SAS type may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view

  content.

  NOTE: Each correct selection is worth one point.

  Select and Place:

  

  Correct Answer:

  

  Reference: https://docs.microsoft.com/en-us/azure/storage/common/storage-sas-overview

• Question 186:

  DRAG DROP

  You develop and deploy an Azure App Service web app. The web app accesses data in an Azure SQL database.

  You must update the web app to store frequently used data in a new Azure Cache for Redis Premium instance.

  You need to implement the Azure Cache for Redis features.

  Which feature should you implement? To answer, drag the appropriate feature to the correct requirements. Each feature may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view

  content.

  NOTE: Each correct selection is worth one point.

  Select and Place:

  

  Correct Answer:

  

  Reference: https://www.red-gate.com/simple-talk/development/dotnet-development/overview-of-azure-cache-for-redis/ https://docs.microsoft.com/en-us/azure/architecture/best-practices/caching

• Question 187:

  DRAG DROP

  You provision virtual machines (VMs) as development environments.

  One VM does not start. The VM is stuck in a Windows update process. You attach the OS disk for the affected VM to a recovery VM.

  You need to correct the issue.

  In which order should you perform the actions? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

  Select and Place:

  

  Correct Answer:

  

  Remove the update that causes the problem

  1.

  Take a snapshot of the OS disk of the affected VM as a backup.

  2.

  Attach the OS disk to a recovery VM.

  3.

  Once the OS disk is attached on the recovery VM, run diskmgmt.msc to open Disk Management, and ensure the attached disk is ONLINE.

  4.

  (Step 1) Open an elevated command prompt instance (Run as administrator). Run the following command to get the list of the update packages that are on the attached OS disk: dism /image::\ /get-packages > c:\temp\Patch_level

  5.

  (Step 2) Open the C:\temp\Patch_level.txt file, and then read it from the bottom up. Locate the update that's in Install Pending or Uninstall Pending state.

  6.

  Remove the update that caused the problem: dism /Image::\ /Remove-Package /PackageName:

  7.

  (Step 4) Detach the OS disk and recreate the VM. Then check whether the issue is resolved.

  Reference: https://docs.microsoft.com/en-us/troubleshoot/azure/virtual-machines/troubleshoot-stuck-updating-boot-error

• Question 188:

  DRAG DROP

  You are developing an Azure solution to collect inventory data from thousands of stores located around the world. Each store location will send the inventory data hourly to an Azure Blob storage account for processing.

  The solution must meet the following requirements:

  1.

  Begin processing when data is saved to Azure Blob storage.

  2.

  Filter data based on store location information.

  3.

  Trigger an Azure Logic App to process the data for output to Azure Cosmos DB.

  4.

  Enable high availability and geographic distribution.

  5.

  Allow 24-hours for retries.

  6.

  Implement an exponential back off data processing.

  You need to configure the solution.

  What should you implement? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Select and Place:

  

  Correct Answer:

  

  Box 1: Azure Event Grid

  Blob storage events are pushed using Azure Event Grid to subscribers such as Azure Functions, Azure Logic Apps, or even to your own http listener. Event Grid provides reliable event delivery to your applications through rich retry policies

  and dead-lettering.

  Box 2: Azure Logic App

  Event Grid uses event subscriptions to route event messages to subscribers. This image illustrates the relationship between event publishers, event subscriptions, and event handlers.

  

  Box 3: Azure Service Bus

  The Event Grid service doesn't store events. Instead, events are stored in the Event Handlers, including ServiceBus, EventHubs, Storage Queue, WebHook endpoint, or many other supported Azure Services.

  Reference:

  https://docs.microsoft.com/en-us/azure/storage/blobs/storage-blob-event-overview

  https://docs.microsoft.com/en-us/java/api/overview/azure/messaging-eventgrid-readme

• Question 189:

  DRAG DROP

  You develop an application. You plan to host the application on a set of virtual machines (VMs) in Azure.

  You need to configure Azure Monitor to collect logs from the application.

  Which four actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

  Select and Place:

  

  Correct Answer:

  

  Step 1: Create a Log Analytics workspace.

  First create the workspace.

  Step 2: Add a VMInsights solution.

  Before a Log Analytics workspace can be used with VM insights, it must have the VMInsights solution installed.

  Step 3: Install agents on the VM and VM scale set to be monitored.

  Prior to onboarding agents, you must create and configure a workspace. Install or update the Application Insights Agent as an extension for Azure virtual machines and VM scalet sets.

  Step 4: Create an Application Insights resource

  Sign in to the Azure portal, and create an Application Insights resource.

  

  Once a workspace-based Application Insights resource has been created, configuring monitoring is relatively straightforward.

  Reference: https://docs.microsoft.com/en-us/azure/azure-monitor/vm/vminsights-configure-workspace https://docs.microsoft.com/en-us/azure/azure-monitor/app/create-workspace-resource

• Question 190:

  DRAG DROP

  You are developing an Azure-hosted application that must use an on-premises hardware security module (HSM) key.

  The key must be transferred to your existing Azure Key Vault by using the Bring Your Own Key (BYOK) process.

  You need to securely transfer the key to Azure Key Vault.

  Which four actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

  Select and Place:

  

  Correct Answer:

  

  To perform a key transfer, a user performs following steps:

  1.

  Generate KEK.

  2.

  Retrieve the public key of the KEK.

  3.

  Using HSM vendor provided BYOK tool - Import the KEK into the target HSM and exports the Target Key protected by the KEK.

  4.

  Import the protected Target Key to Azure Key Vault.

  Step 1: Generate a Key Exchange Key (KEK).

  Step 2: Retrieve the Key Exchange Key (KEK) public key.

  Step 3: Generate a key transfer blob file by using the HSM vendor-provided tool.

  Generate key transfer blob using HSM vendor provided BYOK tool Step 4: Run the az keyvault key import command

  Upload key transfer blob to import HSM-key.

  Customer will transfer the Key Transfer Blob (".byok" file) to an online workstation and then run a az keyvault key import command to import this blob as a new HSM-backed key into Key Vault.

  To import an RSA key use this command:

  az keyvault key import Reference: https://docs.microsoft.com/en-us/azure/key-vault/keys/byok-specification