Microsoft AZ-204 Exam Questions Instant Access

Question 1

You have a workspace-based Azure Application Insights resource named Insights1 and an on-premises website. Access to the website from the internet is blocked. You plan to implement availability testing of the website by using Insights1. The implementation must maximize security and minimize the maintenance efforts. You need to decide which Application Insights availability test should be used to deliver the required functionality. Which availability test should you use?

Astandard test

Bmulti-step web test

Ccustom TrackAvailability test

DURL ping test

Answer : C

Question 2

You need to audit the retail store sales transactions.

What are two possible ways to achieve the goal? Each correct answer presents a complete solution.

NOTE: Each correct selection is worth one point.

AUpdate the retail store location data upload process to include blob index tags. Create an Azure Function to process the blob index tags and filter by store location

BEnable blob versioning for the storage account. Use an Azure Function to process a list of the blob versions per day.

CProcess an Azure Storage blob inventory report by using an Azure Function. Create rule filters on the blob inventory report,

DSubscribe to blob storage events by using an Azure Function and Azure Event Grid. Filter the events by store location.

EProcess the change feed logs of the Azure Blob storage account by using an Azure Function. Specify a time range for the change feed data.

Answer : D, E

Scenario: Audit store sale transaction information nightly to validate data, process sales financials, and reconcile inventory.

'Process the change feed logs of the Azure Blob storage account by using an Azure Function. Specify a time range for the change feed data': Change feed support is well-suited for scenarios that process data based on objects that have changed. For example, applications can:

Store, audit, and analyze changes to your objects, over any period of time, for security, compliance or intelligence for enterprise data management.

'Subscribe to blob storage events by using an Azure Function and Azure Event Grid. Filter the events by store location': Azure Storage events allow applications to react to events, such as the creation and deletion of blobs. It does so without the need for complicated code or expensive and inefficient polling services. The best part is you only pay for what you use.

Blob storage events are pushed using Azure Event Grid to subscribers such as Azure Functions, Azure Logic Apps, or even to your own http listener. Event Grid provides reliable event delivery to your applications through rich retry policies and dead-lettering.

https://docs.microsoft.com/en-us/azure/storage/blobs/storage-blob-change-feed

https://docs.microsoft.com/en-us/azure/storage/blobs/storage-blob-event-overview

Question 3

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

You are developing a website that will run as an Azure Web App. Users will authenticate by using their Azure Active Directory (Azure AD) credentials.

You plan to assign users one of the following permission levels for the website: admin, normal, and reader. A user's Azure AD group membership must be used to determine the permission level.

You need to configure authorization.

Solution:

Create a new Azure AD application. In the application's manifest, define application roles that match the required permission levels for the application.

Assign the appropriate Azure AD group to each role. In the website, use the value of the roles claim from the JWT for the user to determine permissions.

Does the solution meet the goal?

AYes

BNo

Answer : B

To configure Manifest to include Group Claims in Auth Token

Go to Azure Active Directory to configure the Manifest. Click on Azure Active Directory, and go to App registrations to find your application:

Click on your application (or search for it if you have a lot of apps) and edit the Manifest by clicking on it.

Locate the ''groupMembershipClaims'' setting. Set its value to either ''SecurityGroup'' or ''All''. To help you decide which:

''SecurityGroup'' - groups claim will contain the identifiers of all security groups of which the user is a member.

''All'' - groups claim will contain the identifiers of all security groups and all distribution lists of which the user is a member

Now your application will include group claims in your manifest and you can use this fact in your code.

https://blogs.msdn.microsoft.com/waws/2017/03/13/azure-app-service-authentication-aad-groups/

Question 4

You have an existing Azure storage account that stores large volumes of data across multiple containers.

You need to copy all data from the existing storage account to a new storage account. The copy process must meet the following requirements:

Automate data movement.

Minimize user input required to perform the operation.

Ensure that the data movement process is recoverable.

What should you use?

AAzCopy

BAzure Storage Explorer

CAzure portal

D.NET Storage Client Library

Answer : A

You can copy blobs, directories, and containers between storage accounts by using the AzCopy v10 command-line utility.

The copy operation is synchronous so when the command returns, that indicates that all files have been copied.

https://docs.microsoft.com/en-us/azure/storage/common/storage-use-azcopy-blobs-copy

Question 5

A development team is creating a new REST API. The API will store data in Azure Blob storage. You plan to deploy the API to Azure App Service.

Developers must access the Azure Blob storage account to develop the API for the next two months. The Azure Blob storage account must not be accessible by the developers after the two-month time period.

You need to grant developers access to the Azure Blob storage account.

What should you do?

AGenerate a shared access signature (SAS) for the Azure Blob storage account and provide the SAS to all developers.

BCreate and apply a new lifecycle management policy to include a last accessed date value. Apply the policy to the Azure Blob storage account.

CProvide all developers with the access key for the Azure Blob storage account. Update the API to include the Coordinated Universal Time (UTC) timestamp for the request header.

DGrant all developers access to the Azure Blob storage account by assigning role-based access control (RBAC) roles.

Answer : A

https://docs.microsoft.com/en-us/azure/storage/common/storage-sas-overview

Question 6

You develop a solution that uses an Azure SQL Database to store user information for a mobile app.

The app stores sensitive information about users.

You need to hide sensitive information from developers that query the data for the mobile app.

Which three items must you identify when configuring dynamic data masking? Each correct answer presents a

part of the solution.

NOTE: Each correct selection is worth one point.

AColumn

BTable

CTrigger

DIndex

ESchema

Answer : A, B, E

In the Dynamic Data Masking configuration page, you may see some database columns that the recommendations engine has flagged for masking. In order to accept the recommendations, just click Add Mask for one or more columns and a mask is created based on the default type for this column. You can change the masking function by clicking on the masking rule and editing the masking field format to a different format of your choice.

https://docs.microsoft.com/en-us/azure/sql-database/sql-database-dynamic-data-masking-get-started-portal

Question 7

You are developing an ASP.NET Core app hosted in Azure App Service.

The app requires custom claims to be returned from Microsoft Entra ID for user authorization. The claims must be removed when the app registration is removed. You need to include the custom claims in the user access token. What should you do?

AConfigure the app to use the OAuth 2.0 authorization code flow.

BImplement custom middleware to retrieve role information from Microsoft Entra ID.

CAdd the groups to the groupMembershipClaims attribute in the app manifest.

DRequire the https://graph.microsoft.eom/.default scope during authentication.

EAdd the roles to the appRoles attribute in the app manifest.

Answer : A

Microsoft Developing Solutions for Microsoft Azure AZ-204 Exam Questions