Microsoft Microsoft Certifications AZ-204 Questions & Answers

• Question 341:

  This question requires that you evaluate the underlined text to determine if it is correct.

  Your Azure Active Directory Azure (Azure AD) tenant has an Azure subscription linked to it.

  Your developer has created a mobile application that obtains Azure AD access tokens using the OAuth 2 implicit grant type.

  The mobile application must be registered in Azure AD.

  You require a redirect URI from the developer for registration purposes.

  Instructions: Review the underlined text. If it makes the statement correct, select "No change is needed." If the statement is incorrect, select the answer choice that makes the statement correct.

  A. No change required.

  B. a secret

  C. a login hint

  D. a client ID

  Correct Answer: A

  For Native Applications you need to provide a Redirect URI, which Azure AD will use to return token responses.

  Reference: https://docs.microsoft.com/en-us/azure/active-directory/develop/v1-protocols-oauth-code

• Question 342:

  You are creating an Azure key vault using PowerShell. Objects deleted from the key vault must be kept for a set period of 90 days. Which two of the following parameters must be used in conjunction to meet the requirement? (Choose two.)

  A. EnabledForDeployment

  B. EnablePurgeProtection

  C. EnabledForTemplateDeployment

  D. EnableSoftDelete

  Correct Answer: BD

  Reference: https://docs.microsoft.com/en-us/powershell/module/azurerm.keyvault/new-azurermkeyvault

  https://docs.microsoft.com/en-us/azure/key-vault/key-vault-ovw-soft-delete

• Question 343:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while

  others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  Your company has an Azure Active Directory (Azure AD) environment. Users occasionally connect to Azure AD via the Internet.

  You need to ensure that users who connect to Azure AD via the internet using an unidentified IP address, are automatically instructed to change their passwords.

  Solution: You configure the use of Azure Key Vault.

  Does the solution meet the goal?

  A. Yes

  B. No

  Correct Answer: B

  Reference: https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/howto-sign-in-risk-policy

• Question 344:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while

  others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  Your company has an Azure Active Directory (Azure AD) environment. Users occasionally connect to Azure AD via the Internet.

  You need to ensure that users who connect to Azure AD via the internet using an unidentified IP address, are automatically instructed to change their passwords.

  Solution: You configure the use of Azure AD Identity Protection.

  Does the solution meet the goal?

  A. Yes

  B. No

  Correct Answer: A

  Reference: https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/howto-sign-in-risk-policy

• Question 345:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while

  others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  Your company has an Azure Active Directory (Azure AD) environment. Users occasionally connect to Azure AD via the Internet.

  You need to ensure that users who connect to Azure AD via the internet using an unidentified IP address, are automatically instructed to change their passwords.

  Solution: You configure the use of Azure AD Privileged Identity Management.

  Does the solution meet the goal?

  A. Yes

  B. No

  Correct Answer: B

  Reference: https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/howto-sign-in-risk-policy

• Question 346:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while

  others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You are developing a mobile app that uses an Azure SQL Database named Weyland.

  The database contains a table names Customers that has a field named email_address.

  You want to implement dynamic data masking to hide the data in the email_address field.

  Solution: You run the Set-AzSqlDatabaseDataMaskingPolicy -DatabaseName "Weyland" Powershell cmdlet

  Does the solution meet the goal?

  A. Yes

  B. No

  Correct Answer: B

  The Set-AzSqlDatabaseDataMaskingPolicy cmdlet sets the masking policy for the database but does not set the masking rule.

  Note: Masking is enabled by default.

  Reference:

  https://docs.microsoft.com/en-us/azure/azure-sql/database/dynamic-data-masking-overview

  https://docs.microsoft.com/en-us/powershell/module/az.sql/set-azsqldatabasedatamaskingrule?view=azps- 4.2.0

• Question 347:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while

  others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You are developing a mobile app that uses an Azure SQL Database named Weyland.

  The database contains a table names Customers that has a field named email_address.

  You want to implement dynamic data masking to hide the data in the email_address field.

  Solution: You run the Set-AzSqlDatabaseDataMaskingRule

  -DatabaseName "Weyland" -SchemaName "dbo"

  -TableName "Customers" -ColumnName "email_address"

  -MaskingFunction "email" Powershell cmdlet

  Does the solution meet the goal?

  A. Yes

  B. No

  Correct Answer: A

  Reference:

  https://docs.microsoft.com/en-us/powershell/module/az.sql/Set-AzSqlDatabaseDataMaskingRule? view=azps-4.2.0

• Question 348:

  You are developing an e-Commerce Web App.

  You want to use Azure Key Vault to ensure that sign-ins to the e-Commerce Web App are secured by using Azure App Service authentication and Azure Active Directory (AAD).

  What should you do on the e-Commerce Web App?

  A. Run the az keyvault secret command.

  B. Enable Azure AD Connect.

  C. Enable Managed Service Identity (MSI).

  D. Create an Azure AD service principal.

  Correct Answer: C

  A managed identity from Azure Active Directory allows your app to easily access other AAD-protected resources such as Azure Key Vault.

  Reference:

  https://docs.microsoft.com/en-us/azure/app-service/overview-managed-identity

  https://docs.microsoft.com/en-us/samples/azure-samples/app-service-msi-keyvault-dotnet/keyvault-msi- appservice-sample/

• Question 349:

  You are developing a web app that uses Azure Active Directory (Azure AD) for authentication.

  You want to configure the web app to use multifactor authentication.

  What should you do?

  A. Enable mobile app authentication.

  B. In Azure AD conditional access, enable the baseline policy.

  C. In Azure AD, create a conditional access policy.

  D. Install the Azure Multi-Factor Authentication Server.

  Correct Answer: C

  MFA is enabled by conditional access policy. It is the most flexible means to enable two-step verification for your users. Enabling using conditional access policy only works for Azure MFA in the cloud and is a premium feature of Azure AD.

  Reference: https://docs.microsoft.com/en-us/azure/active-directory/authentication/howto-mfa-getstarted

• Question 350:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while

  others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You are developing a mobile app that uses an Azure SQL Database named Weyland.

  The database contains a table names Customers that has a field named email_address.

  You want to implement dynamic data masking to hide the data in the email_address field.

  Solution: You run the follows transact-SQL statement:

  ALTER TABLE [dbo].[Weyland].[Customers]

  ALTER COLUMN [email_address]

  ADD MASKED WITH (FUNCTION = 'email()')

  Does the solution meet the goal?

  A. Yes

  B. No

  Correct Answer: A

  Reference: https://docs.microsoft.com/en-us/sql/t-sql/statements/alter-table-transact-sql?view=sql-server-ver15

  https://docs.microsoft.com/en-us/sql/relational-databases/security/dynamic-data-masking?view=sql-server- ver15