Microsoft Microsoft Certifications AZ-204 Questions & Answers

• Question 21:

  You need to test the availability of the corporate website.

  Which two test types can you use? Each correct answer presents a complete solution. NOTE: Each correct selection is worth one point.

  A. Standard

  B. URL ping

  C. Custom testing using the TrackAvailability API method

  D. Multi-step

  Correct Answer: AC

  Note: Corporate website, Implement monitoring by using Application Insights and availability web tests including SSL certificate validity and custom header value verification.

  A: Standard tests are a single request test that is similar to the URL ping test but more advanced. In addition to validating whether an endpoint is responding and measuring the performance, Standard tests also includes SSL certificate

  validity, proactive lifetime check, HTTP request verb (for example GET,HEAD,POST, etc.), custom headers, and custom data associated with your HTTP request.

  C: You can create an Azure Function with TrackAvailability() that will run periodically according to the configuration given in TimerTrigger function with your own business logic. The results of this test will be sent to your Application Insights

  resource, where you will be able to query for and alert on the availability results data. This allows you to create customized tests similar to what you can do via Availability Monitoring in the portal. Customized tests will allow you to write more

  complex availability tests than is possible using the portal UI, monitor an app inside of your Azure VNET, change the endpoint address, or create an availability test even if this feature is not available in your region.

  Incorrect:

  *

  URL ping

  The name URL ping test is a bit of a misnomer. These tests don't use the Internet Control Message Protocol (ICMP) to check your site's availability. Instead, they use more advanced HTTP request functionality to validate whether an endpoint

  is responding. They measure the performance associated with that response. They also add the ability to set custom success criteria, coupled with more advanced features like parsing dependent requests and allowing for retries.

  *

  Multi-step

  You can monitor a recorded sequence of URLs and interactions with a website via multi-step web tests.

  Multi-step web tests depend on Visual Studio webtest files. It was announced that Visual Studio 2019 will be the last version with webtest functionality. It's important to understand that while no new features will be added, webtest functionality

  in Visual Studio 2019 is still currently supported and will continue to be supported during the support lifecycle of the product.

  We recommend using the TrackAvailability to submit custom availability tests instead of Multi-step web tests. This is the long term supported solution for multi request or authentication test scenarios. With TrackAvailability() and custom availability tests, you can run tests on any compute you want and use C# to easily author new tests.

  Reference: https://learn.microsoft.com/en-us/azure/azure-monitor/app/availability-standard-tests

• Question 22:

  You are developing several microservices to run on Azure Container Apps for a company. External TCP ingress traffic from the internet has been enabled for the microservices.

  The company requires that the microservices must scale based on an Azure Event Hub trigger.

  You need to scale the microservices by using a custom scaling rule.

  Which two Kubernetes Event-driven Autoscaling (KEDA) trigger fields should you use? Each correct answer presents part of the solution.

  NOTE: Each correct selection is worth one point.

  A. metadata

  B. type

  C. authenticationRef

  D. name

  E. metricType

  Correct Answer: AB

  Explanation: Example This example shows how to convert an Azure Service Bus scaler to a Container Apps scale rule, but you use the same process for any other ScaledObject-based KEDA scaler specification. For authentication, KEDA scaler authentication parameters convert into Container Apps secrets. From the KEDA scaler specification, find the type value. triggers:

  -type: azure-servicebus

  metadata:

  queueName: my-queue

  namespace: service-bus-namespace

  messageCount: "5"

  Reference: https://learn.microsoft.com/en-us/azure/container-apps/scale-app

• Question 23:

  You need to grant access to the retail store location data for the inventory service development effort. What should you use?

  A. Azure AD access token

  B. Azure RBAC role

  C. Shared access signature (SAS) token

  D. Azure AD ID token

  E. Azure AD refresh token

  Correct Answer: C

  A shared access signature (SAS) provides secure delegated access to resources in your storage account. With a SAS, you have granular control over how a client can access your data. For example:

  What resources the client may access.

  What permissions they have to those resources.

  How long the SAS is valid.

  Note: Inventory services:

  The company has contracted a third-party to develop an API for inventory processing that requires access to a specific blob within the retail store storage account for three months to include read-only access to the data. Reference: https://docs.microsoft.com/en-us/azure/storage/common/storage-sas-overview

• Question 24:

  You are developing several Azure API Management (APIM) hosted APIs.

  You must make several minor and non-breaking changes to one of the APIs. The API changes include the following requirements:

  Must not disrupt callers of the API.

  Enable roll back if you find issues.

  Documented to enable developers to understand what is new.

  Tested before publishing.

  You need to update the API. What should you do?

  A. Configure and apply header-based versioning.

  B. Create and publish a product.

  C. Configure and apply a custom policy.

  D. Add a new revision to the API.

  E. Configure and apply query string-based versioning.

  Correct Answer: E

  Explanation:

  Versioning schemes

  Different API developers have different requirements for versioning. Azure API Management doesn't prescribe a single approach to versioning, but instead provides several options.

  Path-based versioning

  Header-based versioning

  When the header versioning scheme is used, the version identifier needs to be included in an HTTP request header for any API requests. You can specify the name of the HTTP request header.

  Query string-based versioning

  When the query string versioning scheme is used, the version identifier needs to be included in a query string parameter for any API requests. You can specify the name of the query string parameter.

  Note: Versions in Azure API Management

  Versions allow you to present groups of related APIs to your developers. You can use versions to handle breaking changes in your API safely. Clients can choose to use your new API version when they're ready, while existing clients continue

  to use an older version. Versions are differentiated through a version identifier (which is any string value you choose), and a versioning scheme allows clients to identify which version of an API they want to use.

  For most purposes, each API version can be considered its own independent API. Two different API versions might have different sets of operations and different policies.

  With versions you can:

  Publish multiple versions of your API at the same time.

  Use a path, query string, or header to differentiate between versions.

  Use any string value you wish to identify your version, which could be a number, a date, or a name.

  Show your API versions grouped together on the developer portal.

  Take an existing (non-versioned) API, and create a new version of it without breaking existing clients.

  Reference: https://learn.microsoft.com/en-us/azure/api-management/api-management-versions

• Question 25:

  A company is developing a solution that allows smart refrigerators to send temperature information to a central location.

  The solution must receive and store messages until they can be processed. You create an Azure Service Bus instance by providing a name, pricing tier, subscription, resource group, and location.

  You need to complete the configuration.

  Which Azure CLI or PowerShell command should you run?

  

  A. Option A

  B. Option B

  C. Option C

  D. Option D

  Correct Answer: D

  Explanation:

  A service bus instance has already been created (Step 2 below). Next is step 3, Create a Service Bus queue.

  Note:

  Steps:

  Step 1: # Create a resource group

  resourceGroupName="myResourceGroup"

  az group create --name $resourceGroupName --location eastus

  Step 2: # Create a Service Bus messaging namespace with a unique name

  namespaceName=myNameSpace$RANDOM

  az servicebus namespace create --resource-group $resourceGroupName --name $namespaceName --location eastus

  Step 3: # Create a Service Bus queue

  az servicebus queue create --resource-group $resourceGroupName --namespace-name $namespaceName --name BasicQueue

  Step 4: # Get the connection string for the namespace

  connectionString=$(az servicebus namespace authorization-rule keys list --resource-group $resourceGroupName --namespace-name $namespaceName --name RootManageSharedAccessKey --query primaryConnectionString --output tsv)

  Reference:

  https://docs.microsoft.com/en-us/azure/service-bus-messaging/service-bus-quickstart-cli

• Question 26:

  You are developing several Azure API Management (APIM) hosted APIs.

  You must inspect request processing of the APIs in APIM. Requests to APIM by using a REST client must also be included. The request inspection must include the following information:

  requests APIM sent to the API backend and the response it received

  policies applied to the response before sending back to the caller errors that occurred during the processing of the request and the policies applied to the errors original request APIM received from the caller and the policies applied to the request

  You need to inspect the APIs.

  Which three actions should you do? Each correct answer presents part of the solution.

  NOTE: Each correct selection is worth one point.

  A. Enable the Allow tracing setting for the subscription used to inspect the API.

  B. Add the Ocp-Apim-Trace header value to the API call whit a value set to true.

  C. Add the Ocp-Apim-Subscription-Key header value to the key for a subscription that allows access to the API.

  D. Create and configure a custom policy. Apply the policy to the inbound policy section with a global scope.

  E. Create and configure a custom policy. Apply the policy to the outbound policy section with an API scope.

  Correct Answer: ACE

  Explanation:

  A: To trace request processing, you must enable the Allow tracing setting for the subscription used to debug your API.

  C: Use a subscription key

  A subscriber can use an API Management subscription key in one of two ways:

  Add the Ocp-Apim-Subscription-Key HTTP header to the request, passing the value of a valid subscription key.

  Include the subscription-key query parameter and a valid value in the URL. The query parameter is checked only if the header isn't present.

  E:

  Outbound - Shows the policies applied to the response before sending back to the caller.

  Note: API request with a subscription key

  When API Management receives an API request from a client with a subscription key, it handles the request according to these rules:

  1.

  Check if it's a valid key associated with an active subscription, either:

  A subscription scoped to the API

  A subscription scoped to a product that's assigned to the API

  A subscription scoped to all APIs

  The service-scoped subscription (built-in all access subscription)

  If a valid key for an active subscription at an appropriate scope is provided, access is allowed. Policies are applied depending on the configuration of the policy definition at that scope.

  2.

  Otherwise, access is denied (401 Access denied error).

  Incorrect:

  Not D: Inbound - Shows the original request API Management received from the caller and the policies applied to the request.

  Reference: https://learn.microsoft.com/en-us/azure/api-management/api-management-howto-api-inspector https://learn.microsoft.com/en-us/azure/api-management/api-management-subscriptions

• Question 27:

  You are developing several Azure API Management (APIM) hosted APIs.

  The APIs have the following requirements:

  Require a subscription key to access all APIs.

  Include terms of use that subscribers must accept to use the APIs.

  Administrators must review and accept or reject subscription attempts.

  Limit the count of multiple simultaneous subscriptions.

  You need to implement the APIs.

  What should you do?

  A. Configure and apply header-based versioning.

  B. Create and publish a product.

  C. Configure and apply query string-based versioning.

  D. Add a new revision to all APIs. Make the revisions current and add a change log entry.

  Correct Answer: C

  Explanation:

  Versions in Azure API Management

  Versions allow you to present groups of related APIs to your developers. You can use versions to handle breaking changes in your API safely. Clients can choose to use your new API version when they're ready, while existing clients continue

  to use an older version. Versions are differentiated through a version identifier (which is any string value you choose), and a versioning scheme allows clients to identify which version of an API they want to use.

  For most purposes, each API version can be considered its own independent API. Two different API versions might have different sets of operations and different policies.

  With versions you can:

  Publish multiple versions of your API at the same time.

  Use a path, query string, or header to differentiate between versions.

  Use any string value you wish to identify your version, which could be a number, a date, or a name.

  Show your API versions grouped together on the developer portal.

  Take an existing (non-versioned) API, and create a new version of it without breaking existing clients.

  Query string-based versioning

  When the query string versioning scheme is used, the version identifier needs to be included in a query string parameter for any API requests. You can specify the name of the query string parameter.

  The format of an API request URL when using query string-based versioning is: https://{yourDomain}/{apiName}/{operationId}?{queryStringParameterName}={versionIdentifier}.

  For example, https://apis.contoso.com/products?api-version=v1 and https://apis.contoso.com/products?api-version=v2 could refer to the same products API but to versions v1 and v2 respectively.

  Note: Use a subscription key

  A subscriber can use an API Management subscription key in one of two ways:

  Add the Ocp-Apim-Subscription-Key HTTP header to the request, passing the value of a valid subscription key.

  Include the subscription-key query parameter and a valid value in the URL. The query parameter is checked only if the header isn't present.

  Note: In Azure API Management, subscriptions are the most common way for API consumers to access APIs published through an API Management instance.

  What are subscriptions?

  By publishing APIs through API Management, you can easily secure API access using subscription keys. Developers who need to consume the published APIs must include a valid subscription key in HTTP requests when calling those APIs.

  Without a valid subscription key, the calls are:

  Rejected immediately by the API Management gateway.

  Not forwarded to the back-end services.

  To access APIs, developers need a subscription and a subscription key. A subscription is a named container for a pair of subscription keys.

  In addition,

  Developers can get subscriptions without needing approval from API publishers. API publishers can create subscriptions directly for API consumer

  Reference: https://learn.microsoft.com/en-us/azure/api-management/api-management-versions

• Question 28:

  You have an Azure API Management (APIM) Standard tier instance named APIM1 that uses a managed gateway.

  You plan to use APIM1 to publish an API named API1 that uses a backend database that supports only a limited volume of requests per minute. You also need a policy for API1 that will minimize the possibility that the number of requests to the backend database from an individual IP address you specify exceeds the supported limit.

  You need to identify a policy for API1 that will meet the requirements.

  Which policy should you use?

  A. ip-filter

  B. quota-by-key

  C. rate-limit-by-key

  D. rate-limit

  Correct Answer: C

  Explanation:

  rate-limit-by-key

  Limit call rate by key

  The rate-limit-by-key policy prevents API usage spikes on a per key basis by limiting the call rate to a specified number per a specified time period. The key can have an arbitrary string value and is typically provided using a policy expression.

  Optional increment condition can be added to specify which requests should be counted towards the limit. When this call rate is exceeded, the caller receives a 429 Too Many Requests response status code.

  Example

  In the following example, the rate limit of 10 calls per 60 seconds is keyed by the caller IP address. After each policy execution, the remaining calls allowed in the time period are stored in the variable remainingCallsPerIP.

  XML

  renewal-period="60"

  increment-condition="@(context.Response.StatusCode == 200)"

  counter-key="@(context.Request.IpAddress)"

  remaining-calls-variable-name="remainingCallsPerIP"/>

  Note: Rate limits and quotas

  Rate limits and quotas are used for different purposes. Rate limits

  Rate limits are usually used to protect against short and intense volume bursts. For example, if you know your backend service has a bottleneck at its database with a high call volume, you could set a rate-limit-by-key policy to not allow high call volume by using this setting.

  Quotas

  Quotas are usually used for controlling call rates over a longer period of time. For example, they can set the total number of calls that a particular subscriber can make within a given month.

  Incorrect:

  *

  quota-by-key The quota-by-key policy enforces a renewable or lifetime call volume and/or bandwidth quota, on a per key basis. The key can have an arbitrary string value and is typically provided using a policy expression. Optional increment condition can be added to specify which requests should be counted towards the quota. If multiple policies would increment the same key value, it is incremented only once per request. When the quota is exceeded, the caller receives a 403 Forbidden response status code, and the response includes a Retry-After header whose value is the recommended retry interval in seconds.

  *

  rate-limit Limit call rate by subscription The rate-limit policy prevents API usage spikes on a per subscription basis by limiting the call rate to a specified number per a specified time period. When the call rate is exceeded, the caller receives a 429 Too Many Requests response status code.

  Reference: https://learn.microsoft.com/en-us/azure/api-management/rate-limit-by-key-policy https://learn.microsoft.com/en-us/azure/api-management/api-management-sample-flexible-throttling#rate-limits-and-quotas https://learn.microsoft.com/en-us/azure/api-management/rate-limit-policy

• Question 29:

  You need to access data from the user claim object in the e-commerce web app. What should you do first?

  A. Write custom code to make a Microsoft Graph API call from the e-commerce web app.

  B. Assign the Contributor RBAC role to the e-commerce web app by using the Resource Manager create role assignment API.

  C. Update the e-commerce web app to read the HTTP request header values.

  D. Using the Azure CLI, enable Cross-origin resource sharing (CORS) from the e-commerce checkout API to the e-commerce web app.

  Correct Answer: C

  Methods to Get User Identity and Claims in a .NET Azure Functions App include: ClaimsPrincipal from the Request Context

  The ClaimsPrincipal object is also available as part of the request context and can be extracted from the HttpRequest.HttpContext.

  User Claims from the Request Headers.

  App Service passes user claims to the app by using special request headers.

  If your user is signed in properly the claims should be in the header of all requests which should allow you to retrieve the claims using claims principal, i shouldnt need to write extra code to hit an api for all that information

  Reference:

  https://levelup.gitconnected.com/four-alternative-methods-to-get-user-identity-and-claims-in-a-net-azure-functions-app-df98c40424bb

• Question 30:

  You need to support the requirements for the Shipping Logic App. What should you use?

  A. Azure Active Directory Application Proxy

  B. Site-to-Site (S2S) VPN connection

  C. On-premises Data Gateway

  D. Point-to-Site (P2S) VPN connection

  Correct Answer: C

  Before you can connect to on-premises data sources from Azure Logic Apps, download and install the on-premises data gateway on a local computer. The gateway works as a bridge that provides quick data transfer and encryption between

  data sources on premises (not in the cloud) and your logic apps.

  The gateway supports BizTalk Server 2016.

  Note: Microsoft have now fully incorporated the Azure BizTalk Services capabilities into Logic Apps and Azure App Service Hybrid Connections.

  Logic Apps Enterprise Integration pack bring some of the enterprise B2B capabilities like AS2 and X12, EDI standards support

  Scenario: The Shipping Logic app must meet the following requirements:

  1.

  Support the ocean transport and inland transport workflows by using a Logic App.

  2.

  Support industry-standard protocol X12 message format for various messages including vessel content details and arrival notices.

  3.

  Secure resources to the corporate VNet and use dedicated storage resources with a fixed costing model.

  4.

  Maintain on-premises connectivity to support legacy applications and final BizTalk migrations.

  Reference: https://docs.microsoft.com/en-us/azure/logic-apps/logic-apps-gateway-install