DRAG DROP
-
You are developing an application to store millions of images in Azure blob storage. The images are uploaded to an Azure blob storage container named companyimages contained in an Azure blob storage account named companymedia. The stored images are uploaded with multiple blob index tags across multiple blobs in the container.
You must find all blobs whose tags match a search expression in the container. The search expression must evaluate an index tag named status with a value of final.
You need to construct the GET method request URI.
How should you complete the URI? To answer, drag the appropriate parameters to the correct request URI targets. Each parameter may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.
Explanation: To find blobs by index tags, use the List Blobs operation with a tag query. The storage account name forms the host, the container name is in the path, and the where parameter contains the tag expression Status='Final'.
Question 158
You develop a web application that provides access to legal documents that are stored on Azure Blob Storage with version-level immutability policies. Documents are protected with both time-based policies and legal hold policies. All time-based retention policies have the AllowProtectedAppendWrites property enabled.
You have a requirement to prevent the user from attempting to perform operations that would fail only when a legal hold is in effect and when all other policies are expired.
You need to meet the requirement.
Which two operations should you prevent? Each correct answer presents a complete solution.
NOTE: Each correct selection is worth one point.
A. adding data to documents
B. deleting documents
C. creating documents
D. overwriting existing documents
Show Answer
Correct Answer: B, D
Explanation: In Azure Blob Storage, when a legal hold is in effect, blobs are placed in a WORM (write-once, read-many) state regardless of whether time-based retention policies have expired. Legal holds specifically block delete and overwrite operations. Because AllowProtectedAppendWrites is enabled, appending data (adding data) is still allowed, and creating new documents is also allowed. Therefore, the only operations that would fail solely due to a legal hold—after all time-based policies have expired—are deleting documents and overwriting existing documents. To prevent users from attempting operations that would fail only under a legal hold, you should prevent delete and overwrite actions.
Question 159
DRAG DROP
-
You develop and deploy several APIs to Azure API Management.
You create the following policy fragment named APICounts:
The policy fragment must be reused across various scopes and APIs. The policy fragment must be applied to all APIs and run when a calling system invokes any API.
You need to implement the policy fragment.
Explanation: To run the fragment for every API call, it must be included at the inbound scope. The include-fragment policy references the reusable fragment by fragment-id, and inbound ensures it executes on each request before API processing.
Question 160
HOTSPOT
-
You develop an image upload service that is exposed using Azure API Management. Images are analyzed after upload for automatic tagging.
Images over 500 KB are processed by a different backend that offers a lower tier of service that costs less money. The lower tier of service is denoted by a header named x-large-request. Images over 500 KB must never be processed by backends for smaller images and must always be charged the lower price.
You need to implement API Management policies to ensure that images are processed correctly.
How should you complete the API Management inbound policy? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Explanation: For images under 500 KB, the x-large-request header must not be present, so it is deleted. Images over 500 KB must be routed to the lower-tier backend, which is done by configuring set-backend-service with the base-url pointing to the large-image host.
Question 161
You develop and deploy an Azure App Service web app named App1. You create a new Azure Key Vault named Vault1. You import several API keys, passwords, certificates, and cryptographic keys into Vault1.
You need to grant App1 access to Vault1 and automatically rotate credentials. Credentials must not be stored in code.
What should you do?
A. Enable App Service authentication for Appl. Assign a custom RBAC role to Vault1.
B. Add a TLS/SSL binding to App1.
C. Upload a self-signed client certificate to Vault1. Update App1 to use the client certificate.
D. Assign a managed identity to App1.
Show Answer
Correct Answer: D
Explanation: Assigning a managed identity to App1 allows the App Service to authenticate to Azure Key Vault without storing credentials in code. You then grant this identity access to Vault1 using Key Vault access policies or RBAC. Managed identities handle credential issuance and rotation automatically, meeting the requirements for secure access and automatic rotation.
Question 162
You are developing an online game that includes a feature that allows players to interact with other players on the same team within a certain distance. The calculation to determine the players in range occurs when players move and are cached in an Azure Cache for Redis instance.
The system should prioritize players based on how recently they have moved and should not prioritize players who have logged out of the game.
You need to select an eviction policy.
Which eviction policy should you use?
A. allkeys-Iru
B. volatile-Iru
C. allkeys-lfu
D. volatile-ttl
Show Answer
Correct Answer: B
Explanation: The requirement is to prioritize players based on how recently they have moved (LRU behavior) and to avoid prioritizing players who have logged out. Using volatile-lru evicts the least recently used keys only among keys that have a TTL set. By assigning TTLs to active players’ cached movement data and allowing logged-out players’ keys to expire or be excluded via TTL, Redis can deprioritize logged-out players while still using recency of movement for eviction. allkeys-lru cannot distinguish logged-out players, and the other policies do not focus on recency.
Question 165
DRAG DROP
-
You are developing an Azure solution.
You need to develop code to access a secret stored in Azure Key Vault.
How should you complete the code segment? To answer, drag the appropriate code segments to the correct location. Each code segment may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.
NOTE: Each correct selection is worth one point.
Explanation: Use SecretClient to connect to Key Vault using the vault URI, and authenticate with DefaultAzureCredential, which supports managed identity and local dev credentials.
Question 166
HOTSPOT
-
You develop a web app that interacts with Azure Active Directory (Azure AD) groups by using Microsoft Graph.
You build a web page that shows all Azure AD groups that are not of the type 'Unified'.
You need to build the Microsoft Graph query for the page.
How should you complete the query? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Explanation: To list all non‑Microsoft 365 (non‑Unified) groups, Microsoft Graph requires filtering out groups where the groupTypes collection contains 'Unified'. This is done using the NOT operator with the any() lambda expression. Advanced queries on directory objects also require $count=true (and the ConsistencyLevel: eventual header) for this filter to work.
Question 167
HOTSPOT
-
You develop and deploy a web app to Azure App service. The web app allows users to authenticate by using social identity providers through the Azure B2C service. All user profile information is stored in Azure B2C.
You must update the web app to display common user properties from Azure B2C to include the following information:
• Email address
• Job title
• First name
• Last name
• Office location
You need to implement the user properties in the web app.
Which code library and API should you use? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: API to access user properties:
Microsoft Graph
Code library to interface to Azure AD B2C:
Microsoft Authentication Library (MSAL)
Explanation: Azure AD B2C exposes user profile attributes (email, job title, names, office location) through Microsoft Graph. MSAL is used in the web app to authenticate users and acquire access tokens to securely call Microsoft Graph from the application.
Question 168
You are developing a web application that uses the Microsoft identity platform for user and resource authentication. The web application calls several REST APIs.
A REST API call must read the user’s calendar. The web application requires permission to send an email as the user.
You need to authorize the web application and the API.
Which parameter should you use?
A. tenant
B. code_challenge
C. state
D. client_id
E. scope
Show Answer
Correct Answer: E
Explanation: In the Microsoft identity platform (OAuth 2.0), the **scope** parameter specifies the permissions an application is requesting. Permissions such as reading the user’s calendar and sending email as the user are defined and requested via scopes during authorization, making **scope** the correct parameter.
$19
Get all 447 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.
