Microsoft Practice Questions, Discussions & Exam Topics by our Authors

You manage an Azure Cosmos DB for a NoSQL API account named account1. The account contains a database named db1, which contains a container named container1. You configure account1 with a session consistency level. You plan to develop an application named App1 that will access container1. Individual instances of App1 must perform reads and writes. App1 must allow mul...

Let's evaluate the different options and determine the appropriate object to share the session token between multiple nodes in your Azure Cosmos DB setup. Session Consistency and the Session Token - In Azure Cosmos DB, the session consistency level guarantees that within a single session (e.g., a single application or client), reads will always see the latest writes made by that session. For multiple nodes or instances of an application (App1) to access the same session data, they must use the same session token. This ensures that all nodes read and write data in the correct order relative to their own session. Now, let's examine the possible options for sharing the session token between nodes: Option A: Document Response - Explanation: A DocumentResponse refers to the result returned after querying or performing operations on a document in Cosmos DB. While it contains the data, it also includes metadata, such as the session token used to track session consistency for the particular operation. However, the DocumentResponse object is returned after each operation, meaning it’s a result object and not an object specifically designed to share the session token across multiple nodes. - Rejection Reason: The DocumentResponse will give you the session token for individual operations, but it is not an object designed to share that token across nodes. You would need to extract the session token from each response, which would be cumbersome and inefficient when handling multiple nodes. Option B: Request Options - Explanation: RequestOptions in Azure Cosmos DB allows you to specify various options for an individual request, including consistency level and session token. You can set the session token explicitly when making requests so that all reads and writes in the same session are consistent across nodes. - Selected Option Justification: RequestOptions is the correct object for configuring and sharing the session token. When multiple nodes are i...

Author: Lucas · Last updated Jul 23, 2026

DRAG DROP - Case study - This is a case study. Case studies are not timed separately. You can use as much exam time as you would like to complete each case. However, there may be additional case studies and sections on this exam. You must manage your time to ensure that you are able to complete all questions included on this exam in the time provided. To answer the questions included in a case study, you will need to reference information that is provided in the case study. Case studies might contain exhibits and other resources that provide more information about the scenario that is described in the case study. Each question is independent of the other questions in this case study. At the end of this case study, a review screen will appear. This screen allows you to review your answers and to make changes before you move to the next section of the exam. After you begin a new section, you cannot return to this section. To start the case study - To display the first question in this case study, click the Next button. Use the buttons in the left pane to explore the content of the case study before you answer the questions. Clicking these buttons displays information such as business requirements, existing environment, and problem statements. When you are ready to answer a question, click the Question button to return to the question. Background - ...

Author: SolarFalcon11 · Last updated Jul 23, 2026

DRAG DROP - You have a static website hosted in an Azure Storage account named storage1. You access the website by using a URL that ends with the web.core.windows.net suffix. You plan to configure the website to be accessible through the URL www.contoso.com. The website must be accessible during configuration. The contoso.com zone is hosted in Azure DNS. You need to complete the website configuration. Which four actions should yo...

Author: Mia · Last updated Jul 23, 2026

You have an Azure Queue Storage account that contains a queue named queue1. You plan to use Azure SDK for .NET to develop a solution that uses queue1. You need to author C# code that will return an approximate number of messages in q...

Let's evaluate each option based on the goal of retrieving the approximate number of messages in an Azure Queue Storage queue and minimizing development effort. Option A: GetProperties method of the QueueClient class - Explanation: The GetProperties method of the `QueueClient` class is used to retrieve metadata about the queue, such as the approximate number of messages in the queue. This method provides properties of the queue, including `ApproximateMessagesCount`, which gives the approximate number of messages in the queue. - Selected Option Justification: This method directly addresses the requirement. It provides the approximate number of messages in the queue with minimal effort, as it only requires calling the method and accessing the `ApproximateMessagesCount` property from the result. - Scenario Use: This is the most straightforward and efficient way to retrieve the approximate number of messages in a queue, as it is specifically designed for that purpose and requires minimal code. Option B: GetProperties method of the QueueServiceClient class - Explanation: The GetProperties method of the `QueueServiceClient` class is used to retrieve properties of the entire Queue Storage service, such as the account's configuration and performance metrics. This does not provide detailed queue-specific metrics, like the approximate number of messages in a specific queue. - Rejection Reason: This method is for service-level properties and does not return the number of messages in an individual queue, so it is not appropriate for this task. - Scenario Use: This method is useful when managing the entire Queue Storage service but does not help with querying the number of messages in a specific queue. ...

Author: Ethan · Last updated Jul 23, 2026

You manage an Azure Storage account named storage1. You plan to load 1 million blobs into storage1. You must assign key-value pairs to blobs so that both keys and their values are automatically indexed and searchable by using the built-in serv...

To assign key-value pairs to blobs in Azure Storage and make them searchable, let's examine each command option to determine which one is appropriate for this task. Option A: Update -AzStorageBlobServiceProperty - Explanation: The `Update-AzStorageBlobServiceProperty` command is used to update properties related to the blob service itself (like setting properties for lifecycle management, soft delete policies, and other service configurations). However, this does not directly handle tagging or key-value pairs for individual blobs. - Rejection Reason: This command is more about configuring service properties at the storage account level, not for assigning tags (key-value pairs) to individual blobs. It doesn’t facilitate indexing or searching for blobs based on key-value pairs. - Scenario Use: This is useful for changing global blob service properties like versioning, soft delete, or immutability, but not for assigning metadata or key-value pairs to individual blobs. Option B: Set-AzStorageBlobTag - Explanation: The `Set-AzStorageBlobTag` command allows you to assign key-value pairs (tags) to individual blobs. Azure Blob Storage supports tagging, and this command specifically facilitates the assignment of these tags to blobs, which are indexed and searchable by Azure services such as the Azure Blob Indexer. - Selected Option Justification: This command is the correct one for assigning key-value pairs (tags) to blobs, which are automatically indexed and can be searched through Azure's built-in indexing services. This directly addresses the requirement of assigning key-value pairs to 1 million blobs for indexing and searchability. - Scenario Use: This is the recommended command to use when you need to tag blobs w...

Author: IceDragon2023 · Last updated Jul 23, 2026

DRAG DROP - You manage an Azure Cosmos DB for a NoSQL API account named account1. You configure account1 with the default consistency level. An application named app1 must access containers in account1 to perform read and write operations. The connections from app1 to account1 must be established by using the direct mode. You plan to configure app1 to override the default consistency level by using the Azure Cosmos DB SDK client. You need to set the maximum consistency level for app1 to use for read and write operations. Which consistency level should you se...

Author: Ava · Last updated Jul 23, 2026

DRAG DROP - You manage an Azure subscription associated with a Microsoft Entra tenant named contoso.com. The subscription contains an Azure Blob Storage account named storage1. Your user account has the Contributor Azure role-based access control (RBAC) role within the scope of the subscription. You plan to implement secure access to containers and blobs in storage1. Your solution must satisfy the following requirements: * Authorization requests to access storage1 content must be authenticated by using Microsoft Entra credentials. * Authorized access to storage1 content must be time-limited based on arbitrary values specified when requests are raised. * The principle of l...

Author: Leo · Last updated Jul 23, 2026

Case study - This is a case study. Case studies are not timed separately. You can use as much exam time as you would like to complete each case. However, there may be additional case studies and sections on this exam. You must manage your time to ensure that you are able to complete all questions included on this exam in the time provided. To answer the questions included in a case study, you will need to reference information that is provided in the case study. Case studies might contain exhibits and other resources that provide more information about the scenario that is described in the case study. Each question is independent of the other questions in this case study. At the end of this case study, a review screen will appear. This screen allows you to review your answers and to make changes before you move to the next section of the exam. After you begin a new section, you cannot return to this section. To start the case study - To display the first question in this case study, click the Next button. Use the buttons in the left pane to explore the content of the case study before you answer the questions. Clicking these buttons displays information such as business requirements, existing environment, and problem statements. When you are ready to answer a question, click the Question button to return to the question. Background - Fourth Coffee is a gl...

Author: Elizabeth · Last updated Jul 23, 2026

SNAPSHOT - You have an Azure Blob Storage account named account1. You plan to grant permissions for access to blobs in account1 by using a combination of a shared access signature token and a stored access policy. You must set the duration of the token validity by using the stored access policy. You need to complete the configuration of the stored access policy and generate the shared access signatu...

Author: Kunal · Last updated Jul 23, 2026

You are developing a Java application that uses Cassandra to store key and value data. You plan to use a new Azure Cosmos DB resource and the Cassandra API in the application. You create an Azure Active Directory (Azure AD) group named Cosmos DB Creators to enable provisioning of Azure Cosmos accounts, databases, and containers. The Azure AD group must not be able...

Let's analyze the role-based access control (RBAC) options available for restricting access to the Azure AD group (Cosmos DB Creators) while ensuring they cannot access keys required to access data in Azure Cosmos DB. Option A: DocumentDB Accounts Contributor - Explanation: The DocumentDB Accounts Contributor role allows users to create, configure, and manage Cosmos DB accounts. However, it does not allow access to keys or data within the accounts, which fits the requirement of not granting access to the keys. - Rejection Reason: This role allows account creation and configuration, but the primary task here is restricting access to keys. While it does restrict data access, it doesn't address the specific concern of denying key access sufficiently, since it might still permit some higher-level configurations that could inadvertently expose sensitive data. - Scenario Use: This role is useful for users who need to configure and manage the account and resources but does not specifically focus on restricting access to keys. Option B: Cosmos Backup Operator - Explanation: The Cosmos Backup Operator role is designed to allow users to manage backups of Azure Cosmos DB accounts and databases, which includes performing backup and restore operations. It does not grant access to data or keys, focusing only on backup operations. - Rejection Reason: This role is focused solely on backup and restore operations and does not provide general administrative or management permissions for Cosmos DB accounts or databases. It also does not directly address the need to manage access to the keys required to access data. - Scenario Use: This role is suitable for users who need to manage Cosmos DB backups but is not suitable for restricting access to keys in a broader context of application development or configuration management. Option C: Cosmos DB Operator - Explanation: The Cosmos DB Operator...

Author: Daniel · Last updated Jul 23, 2026

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You are developing a website that will run as an Azure Web App. Users will authenticate by using their Azure Active Directory (Azure AD) credentials. You plan to assign users one of the following permission levels for the website: admin, norm...

Scenario Understanding You are developing a website that will run as an Azure Web App and require Azure Active Directory (Azure AD) authentication. You want the website to assign users permission levels such as admin, normal, and reader based on their Azure AD group membership. The solution provided suggests configuring the Azure Web App to allow only authenticated requests and require Azure AD logon. The question asks whether this solution meets the goal of assigning permission levels based on Azure AD group membership. Solution Breakdown Solution Provided: - Authenticated Requests Only: Configuring the Azure Web App to allow only authenticated requests and to require Azure AD logon ensures that only users who are authenticated by Azure AD can access the web app. This is necessary for any form of authorization based on Azure AD groups, as it confirms that the user is who they claim to be. Missing Component: - Role-Based Authorization: The key missing part in the solution is the authorization based on Azure AD group membership. To achieve the goal, once a user is authenticated, you need to use role-based access control (RBAC) or Azure AD group claims in the token to map the user's group membership t...

Author: Leah · Last updated Jul 23, 2026

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You are developing a website that will run as an Azure Web App. Users will authenticate by using their Azure Active Directory (Azure AD) credentials. You plan to assign users one of the following permission levels for the website: admin, normal, and reader. A user's Azure AD group membership must be used to determine the perm...

Solution Breakdown: The goal is to configure authorization for a website that uses Azure Active Directory (Azure AD) authentication, where users' permission levels (admin, normal, and reader) are determined by their Azure AD group membership. The solution provided suggests two key steps: 1. Create a new Azure AD application and set the `groupMembershipClaims` option in the application's manifest to All. 2. Use the `groups` claim from the JWT token to determine the user's permission levels. Step-by-step Evaluation of the Solution: 1. Setting the `groupMembershipClaims` option to "All": - In Azure AD, the `groupMembershipClaims` setting controls whether group membership information is included in the token. By setting it to All, the JWT token will contain a `groups` claim, which includes the groups the user belongs to. This is necessary to retrieve the user's group memberships and use them for authorization. - This part of the solution is correct because it ensures that the group membership information will be included in the user's token, which is crucial for assigning permissions based on Azure AD groups. 2. Using the `groups` claim from the JWT token for authorization: - After configuring the Azure AD...

Author: Julian · Last updated Jul 23, 2026

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You are developing a website that will run as an Azure Web App. Users will authenticate by using their Azure Active Directory (Azure AD) credentials. You plan to assign users one of the following permission levels for the website: admin, normal, and reader. A user's Azure AD group membership must be used to determine the permission level. You need to configure authorization. Soluti...

The solution involves creating an Azure AD application, defining roles in the application manifest, and assigning those roles to Azure AD groups. The website would then use the roles claim in the user's JWT to determine permissions. Let's analyze if this solution meets the goal: Key Factors: 1. Azure AD Application and Manifest: Defining application roles in the manifest and assigning them to groups ensures that users who belong to those groups are automatically granted the corresponding roles. 2. Role-based Access Control: The solution uses the roles claim in the JWT token to determine user permissions, which is a standard practice in Azure AD to manage access based on user roles. 3. Azure AD Groups and Roles: Assigning Azure AD groups to roles allows centralized management of permissions. For instance, you can easily add or remove users from a group, which will automatically up...

Author: James · Last updated Jul 23, 2026

DRAG DROP - You are developing an application to securely transfer data between on-premises file systems and Azure Blob storage. The application stores keys, secrets, and certificates in Azure Key Vault. The application uses the Azure Key Vault APIs. The application must allow recovery of an accidental deletion of the key vault or key vault objects. Key vault objects must be retained for 90 days after deletion. You need to protect the key vault and key vault objects. Which Azure Key Vault feature should you use? To answer, drag the appropriate f...

Author: Kai99 · Last updated Jul 23, 2026

You provide an Azure API Management managed web service to clients. The back-end web service implements HTTP Strict Transport Security (HSTS). Every request to the backend service must include a valid HTTP authorization header. You need to configure the Azure API Management instance with an authentication polic...

Let's review the options in the context of securing an Azure API Management (APIM) instance with an authentication policy, ensuring that every request to the backend service includes a valid HTTP authorization header. Key Considerations: - Backend Web Service Implements HSTS: This means that HTTP requests to the backend must be secure (over HTTPS). - Every Request Requires a Valid HTTP Authorization Header: This implies some form of authentication will be required, and the API Management service needs to pass the correct credentials in the `Authorization` header when forwarding requests to the backend. - API Management Authentication Policies: In Azure API Management, authentication policies ensure that requests are properly authenticated before being passed to the backend. Option A: Basic Authentication - Explanation: Basic Authentication involves passing the username and password as part of the `Authorization` header in the format `Basic <encoded_credentials>`. This is a simple and often used approach for securing APIs. - Why it Works: In the Azure API Management instance, you can configure a policy to add the `Authorization` header with Basic Authentication credentials. This can be done in the policy definition, allowing you to authenticate requests before they reach the backend service. Best Use Case: Basic Authentication is typically used when the backend expects basic user/pass credentials in the `Authorization` header. Option B: Digest Authentication - Explanation: Digest Authentication is a more secure alternative to Basic Authentication. It involves hashing the credentials, so the password is not sent in plain text. The header contains a hashed version of the credentials along with some other parameters. - Why it Works: Similar to Basic Authentication, you could configure Azure API Management to add the appropriate `Authorization` header, but Digest Authentication requires more complex header construction (hashing) and is not as commonly used with modern APIs compared to Basic Authentication or token-based approaches. Best Use Case: Digest Authentication might be used in legacy systems that require it, but it can be more complex to set up and...

Author: Lucas · Last updated Jul 23, 2026

DRAG DROP - You are developing an ASP.NET Core website that can be used to manage photographs which are stored in Azure Blob Storage containers. Users of the website authenticate by using their Azure Active Directory (Azure AD) credentials. You implement role-based access control (RBAC) role permissions on the containers that store photographs. You assign users to RBAC roles. You need to configure the website's Azure AD Application so that user's permissions can be used with the Azure Blob containers. How should you configure the application? To answer, drag the app...

Author: Manish · Last updated Jul 23, 2026

SNAPSHOT - You are developing an ASP.NET Core app that includes feature flags which are managed by Azure App Configuration. You create an Azure App Configuration store named AppFeatureFlagStore that contains a feature flag named Export. You need to update the app to meet the following requirements: * Use the Export feature in the app without requiring a restart of the app. * Validate users before users are allowed access to secure resources. * Permit...

Author: Sophia Clark · Last updated Jul 23, 2026

You have an application that includes an Azure Web app and several Azure Function apps. Application secrets including connection strings and certificates are stored in Azure Key Vault. Secrets must not be stored in the application or application runtime environment. Changes to Azure Active...

To determine the best approach for loading application secrets from Azure Key Vault without storing them in the application or runtime environment, we need to consider security, scalability, ease of management, and the minimization of changes to Azure Active Directory (Azure AD). Analysis of each option: A) Create a single user-assigned Managed Identity with permission to access Key Vault and configure each App Service to use that Managed Identity. - Pros: - Using a user-assigned managed identity centralizes access management. It simplifies the configuration since you assign permissions at the Key Vault level to this single identity, and multiple resources can use the same identity. - A single identity minimizes the complexity of managing multiple identities. - This method does not require storing secrets or certificates in the app, as the app can leverage Azure's Managed Identity feature to authenticate securely. - Cons: - Centralized access could be a risk if a single identity is compromised, as all app services would be affected. - The management overhead of the user-assigned Managed Identity may increase as your applications grow. - When to use: This option is ideal for scenarios where you have many Azure services that require access to Key Vault, and centralization of identity is desired to reduce complexity. B) Create a single Azure AD Service Principal with permission to access Key Vault and use a client secret from within the App Services to access Key Vault. - Pros: - The Azure AD Service Principal is an appropriate option when working with Azure AD-based authentication. - It can allow multiple services to share the same access credentials. - Cons: - Storing client secrets within your application is not recommended due to security risks. This breaks the requirement of not storing secrets in the application or its runtime environment. - Management of Service Principals requires careful handling of secrets and certificates, and if the secret is exposed, it could lead to security vulnerabilities. - When to use: This option is typically used in scenarios where you must use a Service Principal to grant access to resources but not in cases where secrets should not be stored in the app. C) Create a system-assigned Managed Identity in each App Service with permission to access Key Vault. - Pros: - System-assig...

Author: Oscar · Last updated Jul 23, 2026

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You are developing a medical records document management website. The website is used to store scanned copies of patient intake forms. If the stored intake forms are downloaded from storage by a third party, the contents of the forms must not ...

Analysis: The scenario requires ensuring that the contents of patient intake forms are not compromised if they are downloaded by a third party. The solution involves the following steps: 1. Create an Azure Key Vault key named skey. - This is a good start, as it ensures that the encryption key is managed securely by Azure Key Vault. 2. Encrypt the intake forms using the public key portion of skey. - Encryption using the public key is a method where only the private key can decrypt the data, which ensures confidentiality. This seems like a logical approach to protect the data from unauthorized access. 3. Store the encrypted data in Azure Blob storage. - Storing the encrypted data in Azure Blob storage ensures that the encrypted intake forms are stored securely, as access to the encrypted data would require decryption using the private key. Key Considerations: - Encryption Mechanism: Public key encryption (using the public key portion of skey) ensures that only someone with access to the private key can decrypt the ...

Author: Aarav · Last updated Jul 23, 2026

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You are developing a medical records document management website. The website is used to store scanned copies of patient intake forms. If the stored intake forms are downloaded from storage by a third party, the contents of t...

Analysis: The scenario specifies that the contents of patient intake forms must be protected, ensuring they are not compromised if downloaded by a third party. The proposed solution involves using Azure Cosmos DB with Storage Service Encryption enabled, followed by storing the intake forms in that database. Let's break down the key components: 1. Create an Azure Cosmos DB database with Storage Service Encryption enabled: - Azure Cosmos DB automatically enables Storage Service Encryption for all data at rest, which means the data in Cosmos DB is encrypted using encryption keys managed by Azure. This ensures that the data is secure while stored and that unauthorized parties cannot easily access or read the data from storage. 2. Store the intake forms in the Azure Cosmos DB database: - Storing the intake forms in Azure Cosmos DB would leverage the built-in encryption to protect the data at rest. Azure Cosmos DB ensures that only authorized users with proper access permissions can read the data, ensuring the confidentiality of sensitive patient information. Key Considerations: - Encryption at Rest: - Storage Service Encryption in Azure Cosmos DB ensures the data is encrypted while stored in the database, which aligns with the goal of protecting the content...

Author: Zara · Last updated Jul 23, 2026

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You are developing a medical records document management website. The website is used to store scanned copies of patient intake forms. If the stored intake forms a...

Analysis: The goal is to ensure that the contents of the intake forms are protected and not compromised if they are downloaded by a third party. The solution proposes storing the intake forms as Azure Key Vault secrets. Let's break down the key factors: 1. Storing intake forms as Azure Key Vault secrets: - Azure Key Vault is a service that securely stores and manages sensitive information, such as secrets (passwords, API keys), certificates, and cryptographic keys. - Secrets in Key Vault are typically small pieces of sensitive information, such as connection strings or credentials. They are not designed to store large binary objects, like scanned copies of documents, which are typically large files (images or PDFs). 2. Azure Key Vault Use Case: - Key Vault is not optimized for storing large files such as scanned patient intake forms (which are usually in image or PDF format). - Storing large documents in Key Vault would be inefficient, and would also violate the best practices for Key Vault, which is better suited for small pieces of sensitive data (such as keys, certificates, or short secr...

Author: Ming · Last updated Jul 23, 2026

SNAPSHOT - You plan to deploy a new application to a Linux virtual machine (VM) that is hosted in Azure. The entire VM must be secured at rest by using industry-standard encryption technology to address organizational security and compliance requirements. You need to configure Azure Disk Encryption for the VM. How should you complete ...

Author: SilverBear · Last updated Jul 23, 2026

Your company is developing an Azure API hosted in Azure. You need to implement authentication for the Azure API to access other Azure resources. You have the following requirements: * All API calls must be authenticated. * Cal...

Option Analysis: 1. Basic Authentication (A): - Explanation: Basic Authentication requires the caller to send credentials (username and password) with every API request. - Why rejected: The requirement is that "callers must not send credentials to the API." This directly rules out Basic Authentication since it involves sending credentials with each request. - Use case: This could be used if credentials need to be provided directly by the caller for access, but it's not suitable here. 2. Anonymous Authentication (B): - Explanation: Anonymous authentication allows access without requiring any form of user or service identity. No authentication is involved in the process. - Why rejected: This is incompatible with the requirement that "all API calls must be authenticated." Anonymous authentication does not provide any form of authentication, which violates the specified requirements. - Use case: This might be used for public APIs or scenarios where security is not a concern, but it doesn’t fit the requirement to authenticate all calls. 3. Managed Identity (C): - Explanation: A Managed Identity is an identity automatically managed by Azure for services like Azure Functions, Web Apps, and Azure API Management. It allows services to authenticate to Azure resources without needing credentials stored in the code. Managed identities work by using Azure Active Directory (AAD) to authenticate. - Why selected: This i...

Author: Emma · Last updated Jul 23, 2026

DRAG DROP - You are developing an application. You have an Azure user account that has access to two subscriptions. You need to retrieve a storage account key secret from Azure Key Vault. In which order should you arrange the PowerShell commands to develop the solution? To answer...

Author: Liam123 · Last updated Jul 23, 2026

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You develop Azure solutions. You must grant a virtual machine (VM) access to specific...

Analysis: 1. Solution Explanation: - The goal is to grant a virtual machine (VM) access to specific resource groups in Azure Resource Manager (ARM) by obtaining an ARM access token. The proposed solution is to use an X.509 certificate for authentication. - X.509 certificates are generally used in public key infrastructure (PKI) for secure authentication in various scenarios. In Azure, certificates can be used for client authentication, but this is not a typical method for authenticating a VM directly to Azure Resource Manager (ARM). - Normally, Azure Managed Identity or service principal with secret/certificate is used to authenticate a VM to Azure services. 2. Why this solution might not meet the goal: - While X.509 certificates can be used for secure authentication in Azure, they are not the most common or recommended method to authenticate a VM to obtain an Azure Resource Manager access token. Typically, Azure Managed Identity is used for VM authentication to Azure resources, as it simplifies the authentication process and doesn’t require managing certificates or secrets. - Using a certificate for authentication wou...

Author: Layla · Last updated Jul 23, 2026

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You develop Azure solutions. You must grant a virtual machine (VM) access to specific resource groups in ...

Analysis: 1. Solution Explanation: - The goal is to grant a virtual machine (VM) access to specific resource groups in Azure Resource Manager (ARM) and obtain an ARM access token. - The proposed solution involves using the Reader role-based access control (RBAC) role to authenticate the VM with ARM. 2. Role-Based Access Control (RBAC): - RBAC is the primary method to manage access to Azure resources, allowing you to assign roles to users, groups, or service principals to grant permissions. - The Reader role allows read-only access to Azure resources. It would allow the VM to access information about resources but does not allow the VM to authenticate or obtain an ARM access token by itself. - In Azure, RBAC roles are typically assigned to users, groups, or service principals, but VMs themselves need a way to authenticate to Azure (like through a Managed Identity or a Service Principal). - Therefore, the VM cannot directly use the Reader role to authenticate itself and obtain an access token. Instead, it would need a Managed Identity or a Service Principal to authenticate and obtain tok...

Author: Sofia2021 · Last updated Jul 23, 2026

SNAPSHOT - You are building a website that is used to review restaurants. The website will use an Azure CDN to improve performance and add functionality to requests. You build and deploy a mobile app for Apple iPhones. Whenever a user accesses the website from an iPhone, the user must be redirected to the app store. You need to implement an Azure CDN rule that ensures that iPhone users are redirected to the app store. ...

Author: Evelyn · Last updated Jul 23, 2026

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You are developing a website that will run as an Azure Web App. Users will authenticate by using their Azure Active Directory (Azure AD) credentials. You plan to assign users one of the following permission levels for the website: admin, normal, and reader. A user's Azure AD group me...

The solution provided involves configuring Integrated Windows Authentication (IWA) and using the Microsoft Graph API to query the user's Azure AD group memberships. Key factors for reasoning: 1. Integrated Windows Authentication (IWA) is typically used in on-premises environments and works well with Windows authentication for applications. It integrates with Active Directory but does not directly align with Azure AD authentication, which is required in this scenario. 2. Microsoft Graph API is the correct approach for querying Azure AD group memberships. It can provide information about the user's Azure AD group memberships, which is essential for determining their permission level for the website. Issues with the solution: - T...

Author: Maya · Last updated Jul 23, 2026

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You develop Azure solutions. You must grant a virtual machine (VM) access to specific resource groups in Azur...

To assess whether the solution meets the goal of granting a virtual machine (VM) access to specific resource groups in Azure Resource Manager (ARM), let's break down the solution provided: Key factors for reasoning: 1. Managed Identity: Azure provides managed identities (either system-assigned or user-assigned) for Azure resources like VMs, which can be used to authenticate to Azure services and resources without needing credentials stored in the application code. 2. Access Token: To interact with Azure Resource Manager (ARM) via its REST API, you need an access token for authentication. Managed identities can be used to request Azure Active Directory (Azure AD) tokens, which are required to authenticate against ARM. 3. Invoke-RestMethod cmdlet: This cmdlet can ...

Author: Olivia Johnson · Last updated Jul 23, 2026

SNAPSHOT - You are building a website to access project data related to teams within your organization. The website does not allow anonymous access. Authentication is performed using an Azure Active Directory (Azure AD) app named internal. The website has the following authentication requirements: * Azure AD users must be able to login to the website. * Personalization of the website must be based on membership in Active Directory groups. You need to configure the application's mani...

Author: Benjamin · Last updated Jul 23, 2026

You develop an app that allows users to upload photos and videos to Azure storage. The app uses a storage REST API call to upload the media to a blob storage account named Account1. You have blob storage containers named Container1 and Container2. Uploading of videos occurs on an irregu...

To determine the correct approach for copying blobs from `Container1` to `Container2` when a new video is uploaded, let's evaluate each option carefully based on the requirements and scenario. Key factors: - The goal is to copy blobs from `Container1` to `Container2` when a new video is uploaded. - Irregular uploads suggest an automated, event-driven approach, where the system detects and acts upon the upload. - Storage REST API: The app already uses REST API calls to interact with the blob storage, so we want a solution that integrates well with this environment and is efficient. Option Analysis: A) Copy blobs to Container2 by using the Put Blob operation of the Blob Service REST API - The Put Blob operation is used to upload blobs to a container, not to copy them. While it could potentially be used to upload a new blob to `Container2`, this doesn't directly address copying an existing blob from `Container1`. It would require downloading the blob first and then uploading it again, which is not ideal. - Rejection: This method involves extra steps (downloading then uploading), which is inefficient and doesn't directly copy the blob. B) Create an Event Grid topic that uses the Start-AzureStorageBlobCopy cmdlet - Event Grid can detect changes in a blob container (like a new blob upload) and trigger actions based on those events. The Start-AzureStorageBlobCopy cmdlet can be used to copy blobs between containers in Azure Storage. - Recommendation: This solution is efficient because Event Grid can automatically trigger the copy process as soon as a new video blob is uploaded to `Containe...

Author: Emma · Last updated Jul 23, 2026

You are developing an ASP.NET Core website that uses Azure FrontDoor. The website is used to build custom weather data sets for researchers. Data sets are downloaded by users as Comma Separated Value (CSV) files. The data is refreshed every 10 hours. Specific files must be purged from the FrontDoor cache based ...

To determine the correct type of cache purge to use with Azure Front Door, let's analyze each option based on the requirements and scenario: Key factors: - The website delivers CSV files that need to be purged from the cache on an individual basis based on Response Header values. - The cache purge should be specific to certain files rather than a general cache clearing for the entire site. - Purging needs to occur based on specific assets (i.e., individual files) rather than bulk purging. Option Analysis: A) Single Path - Single path purge allows you to purge a specific asset or file from the cache by specifying its exact path (e.g., `/files/weatherdata.csv`). - This method is ideal for purging individual assets like specific CSV files that need to be cleared from the cache when their data is refreshed or updated. - Recommendation: Since you are targeting specific files for cache purging, this option directly fits the requirement. B) Wildcard - Wildcard purge allows you to purge multiple assets tha...

Author: SilverBear · Last updated Jul 23, 2026

Your company is developing an Azure API. You need to implement authentication for the Azure API. You have the following requirements: All API calls must be secure. * Callers to the API m...

Author: Vivaan · Last updated Jul 23, 2026

You are a developer for a SaaS company that offers many web services. All web services for the company must meet the following requirements: * Use API Management to access the services * Use OpenID Connect for authentication * Prevent anonymous usage A recent security audit f...

Key factors for reasoning: - Requirements: - The services must use API Management. - The authentication must be done using OpenID Connect. - Anonymous usage should be prevented, meaning only authenticated users should have access. Given these requirements, let's evaluate the options: Option Analysis: A) jsonp - JSONP (JSON with Padding) is a technique used for making cross-origin requests by injecting a `<script>` tag to bypass same-origin policies. However, this is not related to authentication or access control. - Rejection: This option doesn't address authentication or prevent anonymous access. It is not suited for securing web services. B) authentication-certificate - This policy is used for enforcing certificate-based authentication. It requires clients to provide a certificate in the request to authenticate. This is useful when you need to authenticate based on a client certificate, but it doesn't align with the requirement of using OpenID Connect for authentication. - Rejection: This option is not related to OpenID Connect and doesn’t address the requirement to prevent anonymous access through OpenID Connect. C) check-header - This policy is used to check for the pres...

Author: RadiantPhoenixX · Last updated Jul 23, 2026

DRAG DROP - Contoso, Ltd. provides an API to customers by using Azure API Management (APIM). The API authorizes users with a JWT token. You must implement response caching for the APIM gateway. The caching mechanism must detect the user ID of the client that accesses data for a given location and cache the response for that user ID. You need to add the following policies to the policies file: * a set-variable policy to store the detected user identity * a cache-lookup-value policy * a cache-store-value policy * a find-and-replace policy to update the response body with the user profile information To which policy section should you add th...

Author: Isabella · Last updated Jul 23, 2026

DRAG DROP - You are developing an Azure solution. You need to develop code to access a secret stored in Azure Key Vault. How should you complete the code segment? To answer, drag the appropriate code segments to the correct location. Each code segment may be used once, more than once, or not at all. You may n...

Author: Amelia · Last updated Jul 23, 2026

You are developing an Azure App Service REST API. The API must be called by an Azure App Service web app. The API must retrieve and update user profile information stored in Azure Active Directory (Azure AD). You need to configure the API to make the updates. Which two too...

Key factors for reasoning: - The task involves configuring an Azure App Service REST API that interacts with Azure Active Directory (Azure AD) to retrieve and update user profile information. - We need to consider tools that handle authentication (to securely authenticate the app) and interact with Azure AD to manage user profile data. Let's evaluate each option: Option Analysis: A) Microsoft Graph API - Microsoft Graph API is a REST API that allows developers to interact with a wide range of Microsoft services, including Azure AD. It provides endpoints to retrieve, create, and update user profile information within Azure AD. - Recommendation: Microsoft Graph API is the primary tool for interacting with Azure AD, especially when it comes to retrieving and updating user profile data. - Selected: This is one of the correct answers because it directly provides the functionality needed for interacting with Azure AD. B) Microsoft Authentication Library (MSAL) - The Microsoft Authentication Library (MSAL) is used to authenticate users and acquire access tokens. MSAL simplifies the process of obtaining the necessary access tokens to authenticate the application with Azure AD. - Recommendation: MSAL is crucial for authenticating the app and acquiring the necessary tokens to make authorized requests to Azure AD, which is required to interact with the Microsoft Graph API. - Selected: MSAL is another correct answer because it handles authentication and obtaining tokens for secure communication with Azure AD and the Microsoft Graph API. ...

Author: Amira99 · Last updated Jul 23, 2026

You develop a REST API. You implement a user delegation SAS token to communicate with Azure Blob storage. The token is compromised. You need to revoke the token. What are two possible ways to achieve this goal? Each ...

To revoke a compromised SAS token, you need to invalidate the token or prevent its usage. Let’s evaluate the possible options: A) Revoke the delegation key - Explanation: This option refers to revoking the key used to generate a SAS token for user delegation, which would render the SAS token invalid. However, Azure doesn't provide a direct API or mechanism to "revoke" a SAS token once it's been created. A delegation key could refer to the access token for user delegation, but simply revoking it may not directly invalidate the SAS token if it is already issued. - Reasoning: Not applicable because Azure does not support the direct revocation of SAS tokens once issued. B) Delete the stored access policy - Explanation: If a stored access policy is used to generate the SAS token, deleting this policy will invalidate any SAS token that is based on that policy. This can be done to revoke a compromised SAS token, as it invalidates the policy associated with the token. - Reasoning: This is an effective way to revoke a SAS token, assuming the token was created using a stored access policy. By deleting the policy, you prevent further usage of any SAS tokens generated from it. C) Regenerate the account key - Explanation: Regenerating the storage account key will invalidate all SAS tokens that were created using that account key, as the SAS tokens are signed with the account key. Regen...

Author: Evelyn · Last updated Jul 23, 2026

DRAG DROP - You are developing an Azure-hosted application that must use an on-premises hardware security module (HSM) key. The key must be transferred to your existing Azure Key Vault by using the Bring Your Own Key (BYOK) process. You need to securely transfer the key to Azure Key Vault. Which four actions should you perform in sequ...

Author: Ahmed97 · Last updated Jul 23, 2026

You develop and deploy an Azure Logic app that calls an Azure Function app. The Azure Function app includes an OpenAPI (Swagger) definition and uses an Azure Blob storage account. All resources are secured by using Azure Active Directory (Azure AD). The Azure Logic app must securely access the Azure Blob storage ...

Let's break down the options for securing the Azure Logic app that needs to securely access the Azure Blob storage account while ensuring Azure AD resources remain intact if the Azure Logic app is deleted. A) Create a user-assigned managed identity and assign role-based access controls. - Explanation: A user-assigned managed identity can be created independently of the Azure Logic app, which is beneficial because it ensures that the managed identity persists even if the Logic app is deleted. You would assign the required Azure AD roles (e.g., Storage Blob Data Reader/Writer) to the managed identity, ensuring that the Logic app can securely access the Azure Blob storage account using Azure AD authentication. - Reasoning: This is a valid option because the user-assigned managed identity is decoupled from the Logic app lifecycle, meaning that even if the Logic app is deleted, the identity and its access permissions will remain intact, fulfilling the requirement of Azure AD resources persisting after deletion. B) Create an Azure AD custom role and assign the role to the Azure Blob storage account. - Explanation: Azure AD custom roles are typically used to define specific access permissions for users or groups. While a custom role can be created and assigned, it does not solve the issue of the Logic app's access to the Blob storage. The role assignment would generally need to be linked to a user, group, or managed identity. - Reasoning: While the custom role approach is useful, it does not specify how to securely authenticate the Logic app with Azure Blob storage. There’s no indication of a managed identity or service principal to facilitate secure authentication. Hence, this is not the best approach in this case. C) Create an Azure Key Vault and issue a client certificate. - Explanation: Azure Key Vault can be used to store secrets or certificates securely, and client certificates can be issued to secure communication. However, for Azure Logic app to authenticate to Azure Blob storage using Azure AD, it's typically better to use a managed identity instead of a client certificate. - Reasoning: While Key Vault and ce...

Author: Stella · Last updated Jul 23, 2026

SNAPSHOT - You are developing an application that uses a premium block blob storage account. You are optimizing costs by automating Azure Blob Storage access tiers. You apply the following policy rules to the storage account. You must determine the implications of applying the rules to the data. (Line numbers are included for reference only.) For ...

Author: Kai99 · Last updated Jul 23, 2026

You are developing a solution that will use a multi-partitioned Azure Cosmos DB database. You plan to use the latest Azure Cosmos DB SDK for development. The solution must meet the following requirements: * Send insert and update operations to an Azure Blob storage account. * Process changes to all partitions immediately. * Allow parallelization of change processing. You need to process the Az...

To process changes in an Azure Cosmos DB database with multiple partitions, meet the specified requirements, and achieve parallelized processing, let’s analyze each of the given options: A) Create an Azure App Service API and implement the change feed estimator of the SDK. Scale the API by using multiple Azure App Service instances. - Explanation: The change feed estimator isn't a common feature for processing changes; it's primarily used for tracking throughput changes in Cosmos DB. Scaling an Azure App Service API may allow the processing of changes, but it won't inherently parallelize the change feed processing across partitions. Using multiple instances of Azure App Service might lead to overhead and may not fully leverage Cosmos DB's optimized change feed processing. - Reasoning: While it could work for some scenarios, it isn't the most optimized or efficient method for handling Cosmos DB's change feed. It lacks direct integration with Cosmos DB's change feed and does not inherently optimize parallelism at the partition level. B) Create a background job in an Azure Kubernetes Service and implement the change feed feature of the SDK. - Explanation: Azure Kubernetes Service (AKS) can provide scalability and flexibility for background jobs, and implementing the change feed feature within AKS could work. However, AKS is more complex to set up and manage compared to Azure Functions for serverless, event-driven workloads. Additionally, scaling change feed processing and managing the load might require additional configurations, leading to increased operational complexity. - Reasoning: Although feasible, using AKS for this task is overkill for most scenarios. Azure Functions are a more streamlined and easier solution for processing the Cosmos DB change feed. C) Create an Azure Function to use a trigger for Azure Cosmos DB. Configure the trigger to connect to the container. - Explanation: Azure Functions can be directly triggered by changes in an Azure Cosmos DB container using the Cosmos DB trigger. This option works well for serverless, event-dr...

Author: Maya2022 · Last updated Jul 23, 2026

SNAPSHOT - You have an Azure Web app that uses Cosmos DB as a data store. You create a CosmosDB container by running the following PowerShell script: $resourceGroupName = "testResourceGroup" $accountName = "testCosmosAccount" $databaseName = "testDatabase" $containerName = "testContainer" $partitionKeyPath = "/EmployeeId" $autoscaleMaxThroughput = 5000 New-AzCosmosDBSqlContainer - -ResourceGroupName $resourceGroupName -AccountName $accountName -DatabaseName $databaseName -Name $containerName -PartitionKeyKind Hash -PartitionKeyPath $partitionKeyPath -AutoscaleMaxThroughput $autoscaleMaxThroughput You create the following qu...

Author: James · Last updated Jul 23, 2026

SNAPSHOT - You are developing a web application that makes calls to the Microsoft Graph API. You register the application in the Azure portal and upload a valid X509 certificate. You create an appsettings.json file containing the certificate name, client identifier for the application, and the tenant identifier of the Azure Active Directory (Azure AD). You create a method named ReadCertificate to return the X509 certificate by name. You need to implement code that acq...

Author: Sam · Last updated Jul 23, 2026

SNAPSHOT - You develop a containerized application. You plan to deploy the application to a new Azure Container instance by using a third-party continuous integration and continuous delivery (CI/CD) utility. The deployment must be unattended and include all application assets. The third-party utility must only be able to push and pull images from the registry. The authentication must be managed by Azure Active Directory (Azure AD). The solution must use the principle of least privilege. You need to ensure t...

Author: Mia · Last updated Jul 23, 2026

You deploy an Azure App Service web app. You create an app registration for the app in Azure Active Directory (Azure AD) and Twitter. The app must authenticate users and must use SSL for all communications. The app must use Twitter as the i...

To validate the Azure Active Directory (Azure AD) request in the app code for the authentication process, we need to ensure that the information being sent and received is legitimate and comes from a trusted source. Let’s review each of the given options to determine what should be validated: A) ID token header - Explanation: The ID token header typically contains information about the signing algorithm and token type. While it is important in understanding the ID token's structure, validating just the header is not sufficient to ensure the integrity and authenticity of the ID token itself. - Reasoning: You must validate the actual content of the ID token (its signature and claims) to ensure it hasn't been tampered with, rather than just checking the header. Therefore, validating only the ID token header is insufficient. B) ID token signature - Explanation: The ID token signature is the part of the ID token that proves the token has been issued by a trusted identity provider (Azure AD, in this case) and hasn’t been altered. Validating the signature ensures the token is legitimate and issued by Azure AD. You would validate the signature using a public key that Azure AD exposes. - Reasoning: This is the most correct answer. Validating the ID token's signature guarantees that the token is valid and hasn't been tampered with. It’s the key step in validating any authentication...

Author: RadiantPhoenixX · Last updated Jul 23, 2026

A development team is creating a new REST API. The API will store data in Azure Blob storage. You plan to deploy the API to Azure App Service. Developers must access the Azure Blob storage account to develop the API for the next two months. The Azure Blob storage account must not be accessible by the deve...

Let's evaluate the given options based on the requirement that developers need temporary access to the Azure Blob storage account for two months, after which the access should be revoked. A) Generate a shared access signature (SAS) for the Azure Blob storage account and provide the SAS to all developers. - Explanation: A Shared Access Signature (SAS) provides a secure, temporary, and limited access mechanism to Azure Blob storage. By generating a SAS token, you can specify an expiration date, granting access for a defined time period. This means developers will only have access to the storage account during the specified period (in this case, two months). - Reasoning: This option meets the requirement perfectly. You can set an expiration date for the SAS token, and after two months, the SAS token will no longer be valid, thereby preventing further access to the Blob storage account. This solution is flexible and secure, as it allows for granular control over access permissions. B) Create and apply a new lifecycle management policy to include a last accessed date value. Apply the policy to the Azure Blob storage account. - Explanation: Lifecycle management policies are primarily used to automate data movement or deletion in Azure Blob storage based on certain criteria, such as file age or last access date. However, lifecycle management does not control who can access the storage account or the associated data. - Reasoning: This option is not applicable to granting access. Lifecycle management is useful for optimizing data storage but doesn't control user access or meet the specific requirement of temporarily granting access to developers. Therefore, it's not a suitable choice for the scenario. C) Provide all developers with the access key for the Azure Blob storage account. Update the API to include the Coordinated Universal Time (UT...

Author: Ishaan · Last updated Jul 23, 2026

DRAG DROP - You develop a web application. You need to register the application with an active Azure Active Directory (Azure AD) tenant. Which three actions should you perform in sequence? To answer, move all actions from...

Author: Aditya · Last updated Jul 23, 2026

You have a new Azure subscription. You are developing an internal website for employees to view sensitive data. The website uses Azure Active Directory (Azure AD) for authentication. You need to implement multifactor authentication for the website. Which two actions sho...

To implement multifactor authentication (MFA) for an internal website using Azure Active Directory (Azure AD), let's evaluate the options: A) Configure the website to use Azure AD B2C. - Explanation: Azure AD B2C is typically used for external-facing applications where you authenticate users outside of your organization (e.g., customers or partners). It provides authentication services for applications that need to manage users from various identity providers. - Reasoning: Since the website is for internal employees, Azure AD B2C is not necessary or applicable in this case. You should use Azure AD for internal user authentication, not B2C. B) In Azure AD, create a new conditional access policy. - Explanation: Conditional Access policies in Azure AD allow you to enforce various authentication requirements, such as requiring multifactor authentication (MFA) based on conditions like user group, device, location, etc. By creating a conditional access policy, you can configure MFA requirements for employees accessing the internal website. - Reasoning: This is the correct approach. You can define policies that require MFA under specific conditions (such as access to sensitive data), making it highly relevant for enforcing MFA. C) Upgrade to Azure AD Premium. - Explanation: Azure AD Premium includes more advanced features for conditional access and identity management, but MFA itself is available in both Azure AD Free and Premium versions, though Premium offers more advanced conditional access features and reporting. However, MFA functionality can still be enabled with Azure AD Free. - Reasoning: While upgrading to Azure AD Premium would provide more advanced features like conditional access policies and detailed reporting, MF...

Author: Jack · Last updated Jul 23, 2026

DRAG DROP - An organization plans to deploy Azure storage services. You need to configure shared access signature (SAS) for granting access to Azure Storage. Which SAS types should you use? To answer, drag the appropriate SAS types to the correct requirements. Each SAS type may be used once, more than once, or not at all. Yo...

Author: VenomousSerpent42 · Last updated Jul 23, 2026