Microsoft Microsoft Certifications AZ-204 Questions & Answers

• Question 441:

  You develop a gateway solution for a public facing news API. The news API back end is implemented as a RESTful service and uses an OpenAPI specification.

  You need to ensure that you can access the news API by using an Azure API Management service instance.

  Which Azure PowerShell command should you run?

  A. Import-AzureRmApiManagementApi –Context $ApiMgmtContext –SpecificationFormat "Swagger" -SpecificationPath $SwaggerPath –Path $Path

  B. New-AzureRmApiManagementBackend -Context $ApiMgmtContext -Url $Url -Protocol http

  C. New-AzureRmApiManagement –ResourceGroupName $ResourceGroup –Name $Name –Location $Location –Organization $Org –AdminEmail $AdminEmail

  D. New-AzureRmApiManagementBackendProxy –Url $ApiUrl

  Correct Answer: D

  New-AzureRmApiManagementBackendProxy creates a new Backend Proxy Object which can be piped when creating a new Backend entity.

  Example: Create a Backend Proxy In-Memory Object PS C:\>$secpassword = ConvertTo-SecureString "PlainTextPassword" -AsPlainText -Force PS C:\>$proxyCreds = New-Object System.Management.Automation.PSCredential ("foo", $secpassword) PS C:\>$credential = New-AzureRmApiManagementBackendProxy -Url "http://12.168.1.1:8080" -ProxyCredential $proxyCreds

  PS C:\>$apimContext = New-AzureRmApiManagementContext -ResourceGroupName "Api-Default-WestUS" -ServiceName "contoso"

  PS C:\>$backend = New-AzureRmApiManagementBackend -Context $apimContext -BackendId 123 -Url 'https://contoso.com/awesomeapi' -Protocol http -Title "first backend" -SkipCertificateChainValidation $true -Proxy $credential Description "backend with proxy server" Creates a Backend Proxy Object and sets up Backend

  Incorrect Answers:

  A: The Import-AzureRmApiManagementApi cmdlet imports an Azure API Management API from a file or a URL in Web Application Description Language (WADL), Web Services Description Language (WSDL), or Swagger format.

  B: New-AzureRmApiManagementBackend creates a new backend entity in Api Management.

  C: The New-AzureRmApiManagement cmdlet creates an API Management deployment in Azure API Management.

  References: https://docs.microsoft.com/en-us/powershell/module/azurerm.apimanagement/new-azurermapimanagementbackendproxy?view=azurermps-6.13.0

• Question 442:

  You are creating a hazard notification system that has a single signaling server which triggers audio and visual alarms to start and stop.

  You implement Azure Service Bus to publish alarms. Each alarm controller uses Azure Service Bus to receive alarm signals as part of a transaction. Alarm events must be recorded for audit purposes. Each transaction record must include

  information about the alarm type that was activated.

  You need to implement a reply trail auditing solution.

  NOTE: Each correct selection is worth one point.

  A. Assign the value of the hazard message MessageId property to the DeliveryCount property.

  B. Assign the value of the hazard message SequenceNumber property to the DeliveryCount property.

  C. Assign the value of the hazard message MessageId property to the SequenceNumber property.

  D. Assign the value of the hazard message MessageId property to the CorrelationId property.

  E. Assign the value of the hazard message SessionID property to the SequenceNumber property..

  F. Assign the value of the hazard message SessionID property to the ReplyToSessionId property.

  Correct Answer: DF

  D: CorrelationId: Enables an application to specify a context for the message for the purposes of correlation; for example, reflecting the MessageId of a message that is being replied to.

  F: ReplyToSessionId: This value augments the ReplyTo information and specifies which SessionId should be set for the reply when sent to the reply entity.

  Incorrect Answers:

  A, B: DeliveryCount

  Number of deliveries that have been attempted for this message. The count is incremented when a message lock expires, or the message is explicitly abandoned by the receiver. This property is read-only.

  C, E: SequenceNumber

  The sequence number is a unique 64-bit integer assigned to a message as it is accepted and stored by the broker and functions as its true identifier. For partitioned entities, the topmost 16 bits reflect the partition identifier. Sequence numbers

  monotonically increase and are gapless. They roll over to 0 when the 48-64 bit range is exhausted. This property is read-only.

  References: https://docs.microsoft.com/en-us/azure/service-bus-messaging/service-bus-messages-payloads

• Question 443:

  You are developing an ASP.NET Core Web API web service. The web service uses Azure Application Insights for all telemetry and dependency tracking. The web service reads and writes data to a database other than Microsoft SQL Server.

  You need to ensure that dependency tracking works for calls to the third-party database.

  Which two Dependency Telemetry properties should you store in the database? Each correct answer presents part of the solution.

  NOTE: Each correct selection is worth one point.

  A. Telemetry.Context.Operation.Id

  B. Telemetry.Name

  C. Telemetry.Context.Cloud.RoleInstance

  D. Telemetry.Context.Session.Id

  E. Telemetry.Id

  Correct Answer: AE

  Example:

  public async Task Enqueue(string payload)

  {

  // StartOperation is a helper method that initializes the telemetry item

  // and allows correlation of this operation with its parent and children.

  var operation = telemetryClient.StartOperation("enqueue " + queueName);

  operation.Telemetry.Type = "Azure Service Bus";

  operation.Telemetry.Data = "Enqueue " + queueName;

  var message = new BrokeredMessage(payload);

  // Service Bus queue allows the property bag to pass along with the message.

  // We will use them to pass our correlation identifiers (and other context)

  // to the consumer.

  message.Properties.Add("ParentId", operation.Telemetry.Id);

  message.Properties.Add("RootId", operation.Telemetry.Context.Operation.Id);

  References: https://docs.microsoft.com/en-us/azure/azure-monitor/app/custom-operations-tracking

• Question 444:

  You develop an Azure web app. You monitor performance of the web app by using Application Insights.

  You need to ensure the cost for Application Insights does not exceed a preset budget.

  What should you do?

  A. Implement ingestions sampling using the Application Insights SDK.

  B. Set a daily cap for the Application Insights instance.

  C. Implement ingestion sampling using the Azure portal.

  D. Implement adaptive sampling using the Azure portal.

  E. Implement adaptive sampling using the Application Insights SDK.

  Correct Answer: E

  Sampling is an effective way to reduce charges and stay within your monthly quota.

  You can set sampling manually, either in the portal on the Usage and estimated costs page; or in the ASP.NET SDK in the .config file; or in the Java SDK in the ApplicationInsights.xml file, to also reduce the network traffic.

  Adaptive sampling is the default for the ASP.NET SDK. Adaptive sampling automatically adjusts to the volume of telemetry that your app sends. It operates automatically in the SDK in your web app so that telemetry traffic on the network is

  reduced.

  Incorrect Answers:

  B: You can use the daily volume cap to limit the data collected.

  To change the daily cap, in the Configure section of your Application Insights resource, in the Usage and estimated costs pane, select Daily Cap.

  References:

  https://docs.microsoft.com/en-us/azure/azure-monitor/app/sampling

• Question 445:

  You provide an Azure API Management managed web service to clients. The back-end web service implements HTTP Strict Transport Security (HSTS).

  Every request to the backend service must include a valid HTTP authorization header.

  You need to configure the Azure API Management instance with an authentication policy.

  Which two policies can you use? Each correct answer presents a complete solution.

  NOTE: Each correct selection is worth one point.

  A. OAuth Client Credential Grant

  B. Basic Authentication

  C. Certificate Authentication

  D. Digest Authentication

  Correct Answer: AD

• Question 446:

  You have an Azure App Services Web App Azure SQL Database instance Azure Storage Account, and an Azure Redis Cache instance in a resource group.

  A developer must be able to publish code to the web app. You must grant the developer the Contribute role to the web app.

  You need to grant the role.

  Which two commands can you use? Each correct answer presents a complete solution.

  NOTE: Each correct selection is worth one point.

  A. az role assignment create

  B. az role definition create

  C. New-AzureRmRoleAssignment

  D. New-AzureRmRoleDefinition

  Correct Answer: AC

  A: The az role assignment create command creates a new role assignment for a user, group, or service principal.

  Example: Create role assignment for an assignee.

  az role assignment create --assignee sp_name --role a_role

  C: The New-AzureRmRoleAssignment command assigns the specified RBAC role to the specified principal, at the specified scope.

  Incorrect Answers:

  B, D: Creates a custom role in Azure RBAC.

  References:

  https://docs.microsoft.com/en-us/cli/azure/role/assignment?view=azure-cli-latest#az-role-assignment-create https://docs.microsoft.com/en-us/powershell/module/azurerm.resources/new-azurermroleassignment?view=azurermps-6.13.0

• Question 447:

  You are developing an internal website for employees to view sensitive data. The website uses Azure Active Directory (AAD) for authentication.

  You need to implement multifactor authentication for the website.

  What should you do? Each correct answer presents part of the solution.

  NOTE: Each correct selection is worth one point.

  A. Upgrade to Azure AD Premium.

  B. In Azure AD conditional access, enable the baseline policy.

  C. In Azure AD, create a new conditional access policy.

  D. In Azure AD, enable application proxy.

  E. Configure the website to use Azure AD B2C.

  Correct Answer: AC

  A: Multi-Factor Authentication comes as part of the following offerings:

  Azure Active Directory Premium licenses - Full featured use of Azure Multi-Factor Authentication Service (Cloud) or Azure Multi-Factor Authentication Server (On-premises).

  Multi-Factor Authentication for Office 365

  Azure Active Directory Global Administrators

  C: MFA Enabled by conditional access policy. It is the most flexible means to enable two-step verification for your users. Enabling using conditional access policy only works for Azure MFA in the cloud and is a premium feature of Azure AD.

  References:

  https://docs.microsoft.com/en-us/azure/active-directory/authentication/howto-mfa-getstarted

• Question 448:

  You develop an app that allows users to upload photos and videos to Azure storage. The app uses a storage REST API call to upload the media to a blob storage account named Account1. You have blob storage containers named

  Container1 and Container2.

  Uploading of videos occurs on an irregular basis.

  You need to copy specific blobs from Container1 to Container2 in real time when specific requirements are met, excluding backup blob copies.

  What should you do?

  A. Download the blob to a virtual machine and then upload the blob to Container2.

  B. Run the Azure PowerShell command Start-AzureStorageBlobCopy.

  C. Copy blobs to Container2 by using the Put Blob operation of the Blob Service REST API.

  D. Use AzCopy with the Snapshot switch blobs to Container2.

  Correct Answer: B

  The Start-AzureStorageBlobCopy cmdlet starts to copy a blob.

  Example 1: Copy a named blob

  C:\PS>Start-AzureStorageBlobCopy -SrcBlob "ContosoPlanning2015" -DestContainer "ContosoArchives" -SrcContainer "ContosoUploads"

  This command starts the copy operation of the blob named ContosoPlanning2015 from the container named ContosoUploads to the container named ContosoArchives.

  References:

  https://docs.microsoft.com/en-us/powershell/module/azure.storage/start-azurestorageblobcopy?view=azurermps-6.13.0

• Question 449:

  A company uses Azure SQL Database to store data for an app. The data includes sensitive information.

  You need to implement measures that allow only members of the managers group to see sensitive information.

  Which two actions should you perform? Each correct answer presents part of the solution.

  NOTE: Each correct selection is worth one point.

  A. Include the managers group.

  B. Exclude the managers group.

  C. Exclude the administrators group.

  D. Navigate to the following URL: PUT https://management.azure.com/subscriptions/00000000-1111-2222-3333-444444444444/resouceGroupos/rg01/providers/Microsoft.Sql/servers/server01/databases/customers/ transparentDataEncryption/current?api-version=2014-04-01

  E. Run the following Azure PowerShell command: New-AzureRmSqlDatabaseDataMaskingRule -SchemaName "dbo" -TableName "customers" -ColumnName "ssn" -MaskingFunction "Default"

  Correct Answer: BE

  Dynamic data masking helps prevent unauthorized access to sensitive data by enabling customers to designate how much of the sensitive data to reveal with minimal impact on the application layer.

  SQL users excluded from masking - A set of SQL users or AAD identities that get unmasked data in the SQL query results. Note: The New-AzureRmSqlDatabaseDataMaskingRule cmdlet creates a data masking rule for an Azure SQL database. References:

  https://docs.microsoft.com/en-us/powershell/module/azurerm.sql/new-azurermsqldatabasedatamaskingrule?view=azurermps-6.13.0

• Question 450:

  You develop a solution that uses an Azure SQL Database to store user information for a mobile app.

  The app stores sensitive information about users.

  You need to hide sensitive information from developers that query the data for the mobile app.

  Which three items must you identify when configuring dynamic data masking? Each correct answer presents a part of the solution.

  NOTE: Each correct selection is worth one point.

  A. Column

  B. Table

  C. Trigger

  D. Index

  E. Schema

  Correct Answer: ABE

  In the Dynamic Data Masking configuration page, you may see some database columns that the recommendations engine has flagged for masking. In order to accept the recommendations, just click Add Mask for one or more columns and a mask is created based on the default type for this column. You can change the masking function by clicking on the masking rule and editing the masking field format to a different format of your choice.

  

  References: https://docs.microsoft.com/en-us/azure/sql-database/sql-database-dynamic-data-masking-get-started-portal