Microsoft Microsoft Certifications AZ-204 Questions & Answers

• Question 371:

  You develop a REST API. You implement a user delegation SAS token to communicate with Azure Blob storage.

  The token is compromised.

  You need to revoke the token.

  What are two possible ways to achieve this goal? Each correct answer presents a complete solution.

  NOTE: Each correct selection is worth one point.

  A. Revoke the delegation keys

  B. Delete the stored access policy.

  C. Regenerate the account key.

  D. Remove the role assignment for the security principle.

  Correct Answer: AB

  A: Revoke a user delegation SAS To revoke a user delegation SAS from the Azure CLI, call the az storage account revoke-delegation-keys command. This command revokes all of the user delegation keys associated with the specified storage account. Any shared access signatures associated with those keys are invalidated.

  B: To revoke a stored access policy, you can either delete it, or rename it by changing the signed identifier. Changing the signed identifier breaks the associations between any existing signatures and the stored access policy. Deleting or renaming the stored access policy immediately effects all of the shared access signatures associated with it.

  Reference: https://github.com/MicrosoftDocs/azure-docs/blob/master/articles/storage/blobs/storage-blob-user-delegation-sas-create-cli.md

  https://docs.microsoft.com/en-us/rest/api/storageservices/define-stored-access-policy#modifying-or-revoking-a-stored-access-policy

• Question 372:

  You are developing an Azure App Service REST API.

  The API must be called by an Azure App Service web app. The API must retrieve and update user profile information stored in Azure Active Directory (Azure AD).

  You need to configure the API to make the updates.

  Which two tools should you use? Each correct answer presents part of the solution

  NOTE: Each correct selection is worth one point.

  A. Microsoft Graph API

  B. Microsoft Authentication Library (MSAL)

  C. Azure API Management

  D. Microsoft Azure Security Center

  E. Microsoft Azure Key Vault SDK

  Correct Answer: AC

  A: You can use the Azure AD REST APIs in Microsoft Graph to create unique workflows between Azure AD resources and third-party services.

  Enterprise developers use Microsoft Graph to integrate Azure AD identity management and other services to automate administrative workflows, such as employee onboarding (and termination), profile maintenance, license deployment, and more.

  C: API Management (APIM) is a way to create consistent and modern API gateways for existing back-end services.

  API Management helps organizations publish APIs to external, partner, and internal developers to unlock the potential of their data and services.

  Reference:

  https://docs.microsoft.com/en-us/graph/azuread-identity-access-management-concept-overview

• Question 373:

  You are developing an Azure function that connects to an Azure SQL Database instance. The function is triggered by an Azure Storage queue.

  You receive reports of numerous System.InvalidOperationExceptions with the following message:

  “Timeout expired. The timeout period elapsed prior to obtaining a connection from the pool. This may have occurred because all pooled connections were in use and max pool size was reached.”

  You need to prevent the exception.

  What should you do?

  A. In the host.json file, decrease the value of the batchSize option

  B. Convert the trigger to Azure Event Hub

  C. Convert the Azure Function to the Premium plan

  D. In the function.json file, change the value of the type option to queueScaling

  Correct Answer: A

  With the Premium plan the max outbound connections per instance is unbounded compared to the 600 active (1200 total) in a Consumption plan.

  Note: The number of available connections is limited partly because a function app runs in a sandbox environment. One of the restrictions that the sandbox imposes on your code is a limit on the number of outbound connections, which is currently 600 active (1,200 total) connections per instance. When you reach this limit, the functions runtime writes the following message to the logs: Host thresholds exceeded: Connections.

  Reference: https://docs.microsoft.com/en-us/azure/azure-functions/manage-connections https://docs.microsoft.com/en-us/azure/azure-functions/functions-scale#service-limits

• Question 374:

  You develop Azure solutions.

  A .NET application needs to receive a message each time an Azure virtual machine finishes processing data. The messages must NOT persist after being processed by the receiving application.

  You need to implement the .NET object that will receive the messages.

  Which object should you use?

  A. QueueClient

  B. SubscriptionClient

  C. TopicClient

  D. CloudQueueClient

  Correct Answer: A

  A queue allows processing of a message by a single consumer. Need a CloudQueueClient to access the Azure VM.

  Incorrect Answers:

  B, C: In contrast to queues, topics and subscriptions provide a one-to-many form of communication in a publish and subscribe pattern. It's useful for scaling to large numbers of recipients.

  Reference:

  https://docs.microsoft.com/en-us/azure/service-bus-messaging/service-bus-queues-topics-subscriptions

• Question 375:

  Your company is developing an Azure API hosted in Azure.

  You need to implement authentication for the Azure API to access other Azure resources. You have the following requirements:

  1.

  All API calls must be authenticated.

  2.

  Callers to the API must not send credentials to the API. Which authentication mechanism should you use?

  A. Basic

  B. Anonymous

  C. Managed identity

  D. Client certificate

  Correct Answer: C

  Azure Active Directory Managed Service Identity (MSI) gives your code an automatically managed identity for authenticating to Azure services, so that you can keep credentials out of your code.

  Note: Use the authentication-managed-identity policy to authenticate with a backend service using the managed identity. This policy essentially uses the managed identity to obtain an access token from Azure Active Directory for accessing

  the specified resource. After successfully obtaining the token, the policy will set the value of the token in the Authorization header using the Bearer scheme.

  Incorrect Answers:

  A: Use the authentication-basic policy to authenticate with a backend service using Basic authentication. This policy effectively sets the HTTP Authorization header to the value corresponding to the credentials provided in the policy.

  B: Anonymous is no authentication at all.

  D: Your code needs credentials to authenticate to cloud services, but you want to limit the visibility of those credentials as much as possible. Ideally, they never appear on a developer's workstation or get checked-in to source control. Azure Key Vault can store credentials securely so they aren't in your code, but to retrieve them you need to authenticate to Azure Key Vault. To authenticate to Key Vault, you need a credential! A classic bootstrap problem.

  Reference: https://azure.microsoft.com/en-us/blog/keep-credentials-out-of-code-introducing-azure-ad-managed-service-identity/

  https://docs.microsoft.com/en-us/azure/api-management/api-management-authentication-policies

• Question 376:

  You are developing an Azure messaging solution.

  You need to ensure that the solution meets the following requirements:

  1. Provide transactional support.

  2. Provide duplicate detection.

  3. Store the messages for an unlimited period of time.

  Which two technologies will meet the requirements? Each correct answer presents a complete solution. NOTE: Each correct selection is worth one point.

  A. Azure Service Bus Topic

  B. Azure Service Bus Queue

  C. Azure Storage Queue

  D. Azure Event Hub

  Correct Answer: AB

  The Azure Service Bus Queue and Topic has duplicate detection. Enabling duplicate detection helps keep track of the application-controlled MessageId of all messages sent into a queue or topic during a specified time window. Incorrect Answers:

  C: There is just no mechanism that can query a Storage queue and find out if a message with the same contents is already there or was there before.

  D: Azure Event Hub does not have duplicate detection

  Reference: https://docs.microsoft.com/en-us/azure/service-bus-messaging/duplicate-detection

• Question 377:

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You develop a software as a service (SaaS) offering to manage photographs. Users upload photos to a web service which then stores the photos in Azure Storage Blob storage. The storage account type is General-purpose V2.

  When photos are uploaded, they must be processed to produce and save a mobile-friendly version of the image. The process to produce a mobile-friendly version of the image must start in less than one minute.

  You need to design the process that starts the photo processing.

  Solution: Create an Azure Function app that uses the Consumption hosting model and that is triggered from the blob upload.

  Does the solution meet the goal?

  A. Yes

  B. No

  Correct Answer: A

  In the Consumption hosting plan, resources are added dynamically as required by your functions.

  Reference: https://docs.microsoft.com/en-us/azure/azure-functions/functions-create-storage-blob-triggered-function

• Question 378:

  You are creating a hazard notification system that has a single signaling server which triggers audio and visual alarms to start and stop.

  You implement Azure Service Bus to publish alarms. Each alarm controller uses Azure Service Bus to receive alarm signals as part of a transaction. Alarm events must be recorded for audit purposes. Each transaction record must include

  information about the alarm type that was activated.

  You need to implement a reply trail auditing solution.

  Which two actions should you perform? Each correct answer resents part of the solution.

  NOTE: Each correct selection is worth one point.

  A. Assign the value of the hazard message SessionID property to the ReplyToSessionId property.

  B. Assign the value of the hazard message MessageId property to the DevileryCount property.

  C. Assign the value of the hazard message SessionID property to the SequenceNumber property.

  D. Assign the value of the hazard message MessageId property to the CorrelationId property.

  E. Assign the value of the hazard message SequenceNumber property to the DeliveryCount property.

  F. Assign the value of the hazard message MessageId property to the SequenceNumber property.

  Correct Answer: AD

  D: CorrelationId: Enables an application to specify a context for the message for the purposes of correlation; for example, reflecting the MessageId of a message that is being replied to.

  A: ReplyToSessionId: This value augments the ReplyTo information and specifies which SessionId should be set for the reply when sent to the reply entity.

  Incorrect Answers:

  B, E: DeliveryCount

  Number of deliveries that have been attempted for this message. The count is incremented when a message lock expires, or the message is explicitly abandoned by the receiver. This property is read-only.

  C, E: SequenceNumber

  The sequence number is a unique 64-bit integer assigned to a message as it is accepted and stored by the broker and functions as its true identifier. For partitioned entities, the topmost 16 bits reflect the partition identifier. Sequence numbers

  monotonically increase and are gapless. They roll over to 0 when the 48-64 bit range is exhausted. This property is read-only.

  Reference: https://docs.microsoft.com/en-us/azure/service-bus-messaging/service-bus-messages-payloads

• Question 379:

  You develop a gateway solution for a public facing news API. The news API back end is implemented as a RESTful service and uses an OpenAPI specification.

  You need to ensure that you can access the news API by using an Azure API Management service instance.

  Which Azure PowerShell command should you run?

  A. Import-AzureRmApiManagementApi -Context $ApiMgmtContext -SpecificationFormat "Swagger" -SpecificationPath $SwaggerPath -Path $Path

  B. New-AzureRmApiManagementBackend -Context $ApiMgmtContext-Url $Url -Protocol http

  C. New-AzureRmApiManagement -ResourceGroupName $ResourceGroup -Name $Name 璍ocation $Location -Organization $Org -AdminEmail $AdminEmail

  D. New-AzureRmApiManagementBackendProxy -Url $ApiUrl

  Correct Answer: D

  New-AzureRmApiManagementBackendProxy creates a new Backend Proxy Object which can be piped when creating a new Backend entity. Example: Create a Backend Proxy In-Memory Object

  PS C:\>$secpassword = ConvertTo-SecureString "PlainTextPassword" -AsPlainText -Force PS C:\>$proxyCreds = New-Object System.Management.Automation.PSCredential ("foo", $secpassword) PS C:\>$credential = New-AzureRmApiManagementBackendProxy -Url "http://12.168.1.1:8080" - ProxyCredential $proxyCreds PS C:\>$apimContext = New-AzureRmApiManagementContext -ResourceGroupName "Api-Default- WestUS" -ServiceName "contoso" PS C:\>$backend = New-AzureRmApiManagementBackend -Context $apimContext -BackendId 123 -Url 'https://contoso.com/awesomeapi' -Protocol http -Title "first backend" -SkipCertificateChainValidation $true -Proxy $credential

  Description "backend with proxy server" Creates a Backend Proxy Object and sets up Backend Incorrect Answers:

  A: The Import-AzureRmApiManagementApi cmdlet imports an Azure API Management API from a file or a URL in Web Application Description Language (WADL), Web Services Description Language (WSDL), or Swagger format.

  B: New-AzureRmApiManagementBackend creates a new backend entity in Api Management.

  C: The New-AzureRmApiManagement cmdlet creates an API Management deployment in Azure API Management.

  Reference:

  https://docs.microsoft.com/en-us/powershell/module/azurerm.apimanagement/new- azurermapimanagementbackendproxy?view=azurermps-6.13.0

• Question 380:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while

  others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You are developing a medical records document management website. The website is used to store scanned copies of patient intake forms.

  If the stored intake forms are downloaded from storage by a third party, the contents of the forms must not be compromised.

  You need to store the intake forms according to the requirements.

  Solution:

  1. Create an Azure Cosmos DB database with Storage Service Encryption enabled.

  2. Store the intake forms in the Azure Cosmos DB database. Does the solution meet the goal?

  A. Yes

  B. No

  Correct Answer: B

  Instead use an Azure Key vault and public key encryption. Store the encrypted from in Azure Storage Blob storage.