Microsoft Microsoft Certifications AZ-204 Questions & Answers

• Question 311:

  You develop and deploy an Azure App Service web app named App1. You create a new Azure Key Vault named Vault 1. You import several API keys, passwords, certificates, and cryptographic keys into Vault1.

  You need to grant App1 access to Vault1 and automatically rotate credentials Credentials must not be stored in code.

  What should you do?

  A. Enable App Service authentication for Appt. Assign a custom RBAC role to Vault1.

  B. Add a TLS/SSL binding to App1.

  C. Assign a managed identity to App1.

  D. Upload a self-signed client certificate to Vault1. Update App1 to use the client certificate.

  Correct Answer: C

  To grant App1 access to Vault1 and automatically rotate credentials without storing them in code, you should assign a managed identity to App1. Managed identities for Azure resources enable Azure services to authenticate to other Azure

  resources without needing to manage the authentication details.

  After you enable a managed identity for App1, you can grant the identity access to Vault1 and use Azure Key Vault's built-in rotation feature to automatically rotate the credentials.

  Additionally, you can use Azure Key Vault's built-in rotation feature to automatically rotate the credentials.

• Question 312:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while

  others might not have a correct solution.

  After you answer a question in this question, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You are developing a solution that will be deployed to an Azure Kubernetes Service (AKS) cluster. The solution will include a custom VNet, Azure Container Registry images, and an Azure Storage account.

  The solution must allow dynamic creation and management of all Azure resources within the AKS cluster.

  You need to configure an AKS cluster for use with the Azure APIs.

  Solution: Enable the Azure Policy Add-on for Kubernetes to connect the Azure Policy service to the GateKeeper admission controller for the AKS cluster. Apply a built-in policy to the cluster.

  Does the solution meet the goal?

  A. Yes

  B. No

  Correct Answer: B

  Instead create an AKS cluster that supports network policy. Create and apply a network to allow traffic only from within a defined namespace

  References: https://docs.microsoft.com/en-us/azure/aks/use-network-policies

• Question 313:

  You manage a data processing application that receives requests from an Azure Storage queue. You need to manage access to the queue. You have the following requirements:

  1.

  Provide other applications access to the Azure queue.

  2.

  Ensure that you can revoke access to the queue without having to regenerate the storage account keys.

  3.

  Specify access at the queue level and not at the storage account level. Which type of shared access signature (SAS) should you use?

  A. Service SAS with a stored access policy

  B. Account SAS

  C. User Delegation SAS

  D. Service SAS with ad hoc SAS

  Correct Answer: A

  A service SAS is secured with the storage account key. A service SAS delegates access to a resource in only one of the Azure Storage services: Blob storage, Queue storage, Table storage, or Azure Files.

  Stored access policies give you the option to revoke permissions for a service SAS without having to regenerate the storage account keys.

  Incorrect Answers:

  Account SAS: Account SAS is specified at the account level. It is secured with the storage account key.

  User Delegation SAS: A user delegation SAS applies to Blob storage only.

  Reference:

  https://docs.microsoft.com/en-us/azure/storage/common/storage-sas-overview

• Question 314:

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You develop an HTTP triggered Azure Function app to process Azure Storage blob data. The app is triggered using an output binding on the blob.

  The app continues to time out after four minutes. The app must process the blob data.

  You need to ensure the app does not time out and processes the blob data.

  Solution: Update the functionTimeout property of the host.json project file to 10 minutes.

  Does the solution meet the goal?

  A. Yes

  B. No

  Correct Answer: B

  Instead pass the HTTP trigger payload into an Azure Service Bus queue to be processed by a queue trigger function and return an immediate HTTP success response.

  Note: Large, long-running functions can cause unexpected timeout issues. General best practices include:

  Whenever possible, refactor large functions into smaller function sets that work together and return responses fast. For example, a webhook or HTTP trigger function might require an acknowledgment response within a certain time limit; it's

  common for webhooks to require an immediate response. You can pass the HTTP trigger payload into a queue to be processed by a queue trigger function. This approach lets you defer the actual work and return an immediate response.

  Reference:

  https://docs.microsoft.com/en-us/azure/azure-functions/functions-best-practices

• Question 315:

  You deploy an Azure App Service web app. You create an app registration for the app in Azure Active Directory (Azure AD) and Twitter.

  The app must authenticate users and must use SSL for all communications. The app must use Twitter as the identity provider.

  You need to validate the Azure AD request in the app code.

  What should you validate?

  A. ID token header

  B. ID token signature

  C. HTTP response code

  D. Tenant ID

  Correct Answer: A

  Reference: https://docs.microsoft.com/en-us/azure/storage/common/storage-auth-aad-app?tabs=dotnet

• Question 316:

  A development team is creating a new REST API. The API will store data in Azure Blob storage. You plan to deploy the API to Azure App Service.

  Developers must access the Azure Blob storage account to develop the API for the next two months. The Azure Blob storage account must not be accessible by the developers after the two-month time period.

  You need to grant developers access to the Azure Blob storage account.

  What should you do?

  A. Generate a shared access signature (SAS) for the Azure Blob storage account and provide the SAS to all developers.

  B. Create and apply a new lifecycle management policy to include a last accessed date value. Apply the policy to the Azure Blob storage account.

  C. Provide all developers with the access key for the Azure Blob storage account. Update the API to include the Coordinated Universal Time (UTC) timestamp for the request header.

  D. Grant all developers access to the Azure Blob storage account by assigning role-based access control (RBAC) roles.

  Correct Answer: A

  Reference: https://docs.microsoft.com/en-us/azure/storage/common/storage-sas-overview

• Question 317:

  You develop and deploy an Azure App Service web app. The app is deployed to multiple regions and uses Azure Traffic Manager. Application Insights is enabled for the app.

  You need to analyse app uptime for each month.

  Which two solutions will achieve the goal? Each correct answer presents part of the solution.

  NOTE: Each correct selection is worth one point.

  A. Azure Monitor logs

  B. Application Insights alerts

  C. Azure Monitor metrics

  D. Application Insights web tests

  Correct Answer: AB

  Reference: https://azure.microsoft.com/en-us/blog/creating-a-web-test-alert-programmatically-with-application-insights/

• Question 318:

  You are developing a web application that uses Azure Cache for Redis. You anticipate that the cache will frequently fill and that you will need to evict keys.

  You must configure Azure Cache for Redis based on the following predicted usage pattern: A small subset of elements will be accessed much more often than the rest.

  You need to configure the Azure Cache for Redis to optimize performance for the predicted usage pattern.

  Which two eviction policies will achieve the goal?

  NOTE: Each correct selection is worth one point.

  A. noeviction

  B. allkeys-lru

  C. volatile-lru

  D. allkeys-random

  E. volatile-ttl

  F. volatile-random

  Correct Answer: BD

  B: The allkeys-lru policy evict keys by trying to remove the less recently used (LRU) keys first, in order to make space for the new data added. Use the allkeys-lru policy when you expect a power-law distribution in the popularity of your requests, that is, you expect that a subset of elements will be accessed far more often than the rest.

  C: volatile-lru: evict keys by trying to remove the less recently used (LRU) keys first, but only among keys that have an expire set, in order to make space for the new data added.

  Note: The allkeys-lru policy is more memory efficient since there is no need to set an expire for the key to be evicted under memory pressure.

  Reference:

  https://redis.io/topics/lru-cache

• Question 319:

  You are developing a web application that runs as an Azure Web App. The web application stores data in Azure SQL Database and stores files in an Azure Storage account. The web application makes HTTP requests to external services as part of normal operations.

  The web application is instrumented with Application Insights. The external services are OpenTelemetry compliant.

  You need to ensure that the customer ID of the signed in user is associated with all operations throughout the overall system.

  What should you do?

  A. Add the customer ID for the signed in user to the CorrelationContext in the web application

  B. On the current SpanContext, set the TraceId to the customer ID for the signed in user

  C. Set the header Ocp-Apim-Trace to the customer ID for the signed in user

  D. Create a new SpanContext with the TraceFlags value set to the customer ID for the signed in user

  Correct Answer: A

  Reference: https://docs.microsoft.com/en-us/azure/azure-monitor/app/correlation

• Question 320:

  You develop and deploy a web application to Azure App Service. The application accesses data stored in an Azure Storage account. The account contains several containers with several blobs with large amounts of data. You deploy all

  Azure resources to a single region.

  You need to move the Azure Storage account to the new region. You must copy all data to the new region.

  What should you do first?

  A. Export the Azure Storage account Azure Resource Manager template

  B. Initiate a storage account failover

  C. Configure object replication for all blobs

  D. Use the AzCopycommand line tool

  E. Create a new Azure Storage account in the current region

  F. Create a new subscription in the current region

  Correct Answer: A

  To move a storage account, create a copy of your storage account in another region. Then, move your data to that account by using AzCopy, or another tool of your choice and finally, delete the resources in the source region.

  To get started, export, and then modify a Resource Manager template.

  Reference:

  https://docs.microsoft.com/en-us/azure/storage/common/storage-account-move?tabs=azure-portal