Microsoft Microsoft Certifications AZ-204 Questions & Answers

• Question 61:

  HOTSPOT

  You need to correct the Azure Logic app error message.

  Which configuration values should you use? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Scenario: You test the Logic app in a development environment. The following error message displays:

  '400 Bad Request'

  Troubleshooting of the error shows an HttpTrigger action to call the RequestUserApproval function.

  Note: If the inbound call's request body doesn't match your schema, the trigger returns an HTTP 400 Bad Request error.

  Box 1: function

  If you have an Azure function where you want to use the system-assigned identity, first enable authentication for Azure functions.

  Box 2: system-assigned

  Your logic app or individual connections can use either the system-assigned identity or a single user-assigned identity, which you can share across a group of logic apps, but not both.

  Reference:

  https://docs.microsoft.com/en-us/azure/logic-apps/create-managed-service-identity

• Question 62:

  HOTSPOT

  You need to configure Azure Service Bus to Event Grid integration.

  Which Azure Service Bus settings should you use? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Box 1: Premium Service Bus can now emit events to Event Grid when there are messages in a queue or a subscription when no receivers are present. You can create Event Grid subscriptions to your Service Bus namespaces, listen to these events, and then react to the events by starting a receiver. With this feature, you can use Service Bus in reactive programming models.

  To enable the feature, you need the following items:

  A Service Bus Premium namespace with at least one Service Bus queue or a Service Bus topic with at least one subscription. Contributor access to the Service Bus namespace.

  Box 2: Contributor

  Reference: https://docs.microsoft.com/en-us/azure/service-bus-messaging/service-bus-to-event-grid-integration-concept

• Question 63:

  HOTSPOT

  You need to configure API Management for authentication.

  Which policy values should you use? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Box 1: Validate JWT

  The validate-jwt policy enforces existence and validity of a JWT extracted from either a specified HTTP Header or a specified query parameter.

  Scenario: User authentication (see step 5 below)

  The following steps detail the user authentication process:

  1.

  The user selects Sign in in the website.

  2.

  The browser redirects the user to the Azure Active Directory (Azure AD) sign in page.

  3.

  The user signs in.

  4.

  Azure AD redirects the user's session back to the web application. The URL includes an access token.

  5.

  The web application calls an API and includes the access token in the authentication header. The application ID is sent as the audience (‘aud’) claim in the access token.

  6.

  The back-end API validates the access token.

  Incorrect Answers:

  1.

  Limit call rate by key - Prevents API usage spikes by limiting call rate, on a per key basis.

  2.

  Restrict caller IPs - Filters (allows/denies) calls from specific IP addresses and/or address ranges.

  3.

  Check HTTP header - Enforces existence and/or value of a HTTP Header.

  Box 2: Outbound

  Reference: https://docs.microsoft.com/en-us/azure/api-management/api-management-access-restriction-policies

• Question 64:

  HOTSPOT

  You need to configure the integration for Azure Service Bus and Azure Event Grid.

  How should you complete the CLI statement? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Box 1: eventgrid

  To create event subscription use: az eventgrid event-subscription create

  Box 2: event-subscription

  Box 3: servicebusqueue

  Scenario: Azure Service Bus and Azure Event Grid

  Azure Event Grid must use Azure Service Bus for queue-based load leveling.

  Events in Azure Event Grid must be routed directly to Service Bus queues for use in buffering.

  Events from Azure Service Bus and other Azure services must continue to be routed to Azure Event Grid for processing.

  Reference:

  https://docs.microsoft.com/en-us/cli/azure/eventgrid/event-subscription?view=azure-cli-latest#az_eventgrid_event_subscription_create

• Question 65:

  HOTSPOT

  You need to retrieve the database connection string.

  Which values should you use? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Azure database connection string retrieve REST API vault.azure.net/secrets/

  Box 1: cpandlkeyvault

  We specify the key vault, cpandlkeyvault.

  Scenario: The database connection string is stored in Azure Key Vault with the following attributes:

  Azure Key Vault name: cpandlkeyvault

  Secret name: PostgreSQLConn

  Id: 80df3e46ffcd4f1cb187f79905e9a1e8

  Box 2: PostgreSQLConn

  We specify the secret, PostgreSQLConn

  Example, sample request:

  https://myvault.vault.azure.net//secrets/mysecretname/4387e9f3d6e14c459867679a90fd0f79?api-version=7.1

  Box 3: Querystring

  Reference:

  https://docs.microsoft.com/en-us/rest/api/keyvault/getsecret/getsecret

• Question 66:

  HOTSPOT

  You need to add code at line AM10 of the application manifest to ensure that the requirement for manually reviewing content can be met.

  How should you complete the code? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Box 1: sid

  Sid: Session ID, used for per-session user sign-out. Personal and Azure AD accounts.

  Scenario: Manual review

  To review content, the user must authenticate to the website portion of the ContentAnalysisService using their Azure AD credentials. The website is built using React and all pages and API endpoints require authentication. In order to review

  content a user must be part of a ContentReviewer role.

  Box 2: email

  Scenario: All completed reviews must include the reviewer's email address for auditing purposes.

• Question 67:

  HOTSPOT

  You need to configure the Account Kind, Replication, and Storage tier options for the corporate website's Azure Storage account.

  How should you complete the configuration? To answer, select the appropriate options in the dialog box in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Account Kind: StorageV2 (general-purpose v2)

  Scenario: Azure Storage blob will be used (refer to the exhibit). Data storage costs must be minimized.

  General-purpose v2 accounts: Basic storage account type for blobs, files, queues, and tables. Recommended for most scenarios using Azure Storage.

  Incorrect Answers:

  BlockBlobStorage accounts: Storage accounts with premium performance characteristics for block blobs and append blobs. Recommended for scenarios with high transactions rates, or scenarios that use smaller objects or require

  consistently low storage latency.

  General-purpose v1 accounts: Legacy account type for blobs, files, queues, and tables. Use general-purpose v2 accounts instead when possible.

  Replication: Geo-redundant Storage

  Scenario: Data must be replicated to a secondary region and three availability zones.

  Geo-redundant storage (GRS) copies your data synchronously three times within a single physical location in the primary region using LRS. It then copies your data asynchronously to a single physical location in the secondary region.

  Incorrect Answers:

  Geo-zone-redundant storage (GZRS), but it would be more costly.

  Storage tier: Cool

  Data storage costs must be minimized.

  Note: Azure storage offers different access tiers, which allow you to store blob object data in the most cost-effective manner. The available access tiers include:

  Hot - Optimized for storing data that is accessed frequently.

  Cool - Optimized for storing data that is infrequently accessed and stored for at least 30 days.

  Reference:

  https://docs.microsoft.com/en-us/azure/storage/common/storage-account-overview

  https://docs.microsoft.com/en-us/azure/storage/common/storage-redundancy

  https://docs.microsoft.com/en-us/azure/storage/blobs/storage-blob-storage-tiers?tabs=azure-portal

• Question 68:

  HOTSPOT

  You need to ensure that validation testing is triggered per the requirements.

  How should you complete the code segment? To answer, select the appropriate values in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Box 1: RepositoryUpdated

  When a new version of the ContentAnalysisService is available the previous seven days of content must be processed with the new version to verify that the new version does not significantly deviate from the old version.

  Box 2: service

  Box 3: imageCollection

  Reference: https://docs.microsoft.com/en-us/azure/devops/notifications/oob-supported-event-types

• Question 69:

  HOTSPOT

  You need to add code at line AM09 to ensure that users can review content using ContentAnalysisService.

  How should you complete the code? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Box 1: "oauth2Permissions": ["login"]

  oauth2Permissions specifies the collection of OAuth 2.0 permission scopes that the web API (resource) app exposes to client apps. These permission scopes may be granted to client apps during consent.

  Box 2: "oauth2AllowImplicitFlow":true

  For applications (Angular, Ember.js, React.js, and so on), Microsoft identity platform supports the OAuth 2.0 Implicit Grant flow.

  Reference:

  https://docs.microsoft.com/en-us/azure/active-directory/develop/reference-app-manifest

• Question 70:

  HOTSPOT

  You need to ensure that network security policies are met.

  How should you configure network security? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Box 1: Valid root certificate

  Scenario: All websites and services must use SSL from a valid root certificate authority.

  Box 2: Azure Application Gateway

  Scenario:

  Any web service accessible over the Internet must be protected from cross site scripting attacks.

  All Internal services must only be accessible from Internal Virtual Networks (VNets)

  All parts of the system must support inbound and outbound traffic restrictions.

  Azure Web Application Firewall (WAF) on Azure Application Gateway provides centralized protection of your web applications from common exploits and vulnerabilities. Web applications are increasingly targeted by malicious attacks that

  exploit commonly known vulnerabilities. SQL injection and cross-site scripting are among the most common attacks.

  Application Gateway supports autoscaling, SSL offloading, and end-to-end SSL, a web application firewall (WAF), cookie-based session affinity, URL path-based routing, multisite hosting, redirection, rewrite HTTP headers and other features.

  Note: Both Nginx and Azure Application Gateway act as a reverse proxy with Layer 7 load-balancing features plus a WAF to ensure strong protection against common web vulnerabilities and exploits.

  You can modify Nginx web server configuration/SSL for X-XSS protection. This helps to prevent cross-site scripting exploits by forcing the injection of HTTP headers with X-XSS protection.

  Reference:

  https://docs.microsoft.com/en-us/azure/web-application-firewall/ag/ag-overview

  https://www.upguard.com/articles/10-tips-for-securing-your-nginx-deployment