You are creating an Azure key vault using PowerShell. Objects deleted from the key vault must be kept for a set period of 90 days.
Which two of the following parameters must be used in conjunction to meet the requirement? (Choose two.)
A. EnabledForDeployment
B. EnablePurgeProtection
C. EnabledForTemplateDeployment
D. EnableSoftDelete
Show Answer
Correct Answer: B, D
Explanation: To retain deleted Azure Key Vault objects for a fixed period of 90 days, soft delete must be enabled so deleted keys, secrets, and certificates are retained and recoverable during the retention window. Purge protection must also be enabled to prevent permanent deletion (purging) of those soft-deleted objects before the retention period expires. The other options relate to deployment access and do not affect deletion or retention.
Question 223
HOTSPOT -
You have an Azure Active Directory (Azure AD) tenant.
You want to implement multi-factor authentication by making use of a conditional access policy. The conditional access policy must be applied to all users when they access the Azure portal.
Which three settings should you configure? To answer, select the appropriate settings in the answer area.
NOTE: Each correct selection is worth one point.
Hot Area:
Show Answer
Correct Answer: Users and groups: All users
Cloud apps (Target resources): Microsoft Azure Management
Grant (Access controls): Require multi-factor authentication
Explanation: The policy must apply to all users, target the Azure portal (Microsoft Azure Management), and enforce MFA via the Grant access control. Conditions are optional and not required to mandate MFA.
Question 224
You need to reduce read latency for the retail store solution.
What are two possible ways to achieve the goal? Each correct answer presents a complete solution.
NOTE: Each correct selection is worth one point.
A. Create a new composite index for the store location data queries in Azure Cosmos DB. Modify the queries to support parameterized SQL and update the Azure Function app to call the new queries.
B. Provision an Azure Cosmos DB dedicated gateway. Update the Azure Function app connection string to use the new dedicated gateway endpoint.
C. Configure Azure Cosmos DB consistency to session consistency. Cache session tokens in a new Azure Redis cache instance after every write. Update reads to use the session token stored in Azure Redis.
D. Provision an Azure Cosmos DB dedicated gateway. Update blob storage to use the new dedicated gateway endpoint.
E. Configure Azure Cosmos DB consistency to strong consistency. Increase the RUs for the container supporting store location data.
Show Answer
Correct Answer: A, B
Explanation: To reduce read latency in Azure Cosmos DB, optimizing query execution and minimizing network latency are key. Creating an appropriate composite index directly improves query performance by allowing Cosmos DB to efficiently serve the specific store location queries with fewer RUs and faster execution. Provisioning a dedicated gateway provides a closer, optimized endpoint with integrated caching, reducing network hops and delivering lower and more predictable read latency for applications such as Azure Functions. Other options either add unnecessary complexity, do not directly reduce read latency, or can actually increase latency.
Question 225
DRAG DROP -
You are authoring a set of nested Azure Resource Manager templates to deploy multiple Azure resources.
The templates must be tested before deployment and must follow recommended practices.
You need to validate and test the templates before deployment.
Which tools should you use? To answer, drag the appropriate tools to the correct requirements. Each tool may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.
NOTE: Each correct selection is worth one point.
Select and Place:
Show Answer
Correct Answer: Determine whether the templates follow recommended practices:
Azure Resource Manager test toolkit
Test and validate changes that templates will make to the environment:
What-if operation
Explanation: The ARM template test toolkit analyzes templates for compliance with recommended best practices and flags issues. The What-if operation previews resource changes before deployment, allowing validation of the impact without modifying the environment.
Question 226
You are building a B2B web application that uses Azure B2B collaboration for authentication. Paying customers authenticate to Azure B2B using federation.
The application allows users to sign up for trial accounts using any email address.
When a user converts to a paying customer, the data associated with the trial should be kept, but the user must authenticate using federation.
You need to update the user in Azure Active Directory (Azure AD) when they convert to a paying customer.
Which Graph API parameter is used to change authentication from one-time passcodes to federation?
A. resetRedemption
B. Status
C. userFlowType
D. invitedUser
Show Answer
Correct Answer: A
Explanation: In Azure AD B2B, when a guest user initially authenticates using one-time passcodes (OTP), Azure AD continues to use OTP even if the user later gets a federated identity. To switch the authentication method to federation while preserving the user and their data, you must reset the user's redemption status using the Microsoft Graph API parameter `resetRedemption`. This forces the user to redeem again and authenticate via their federated identity. Other options like `userFlowType`, `status`, or `invitedUser` do not change an existing guest user's authentication method.
Question 227
You develop a solution that uses Azure Virtual Machines (VMs).
The VMs contain code that must access resources in an Azure resource group. You grant the VM access to the resource group in Resource Manager.
You need to obtain an access token that uses the VM's system-assigned managed identity.
Which two actions should you perform? Each correct answer presents part of the solution.
A. From the code on the VM, call Azure Resource Manager using an access token.
B. Use PowerShell on a remote machine to make a request to the local managed identity for Azure resources endpoint.
C. Use PowerShell on the VM to make a request to the local managed identity for Azure resources endpoint.
D. From the code on the VM, call Azure Resource Manager using a SAS token.
E. From the code on the VM, generate a user delegation SAS token.
Show Answer
Correct Answer: A, C
Explanation: To use a system-assigned managed identity on an Azure VM, the code running on the VM must first obtain an access token by calling the local managed identity endpoint (IMDS) from within the VM. This can be done, for example, with PowerShell on the VM. Once the token is obtained, the code then calls Azure Resource Manager using that access token to access the resource group. Requests cannot be made from a remote machine, and SAS or user delegation tokens are not used with managed identities.
Question 228
DRAG DROP -
You develop and deploy a web app to Azure App Service in a production environment. You scale out the web app to four instances and configure a staging slot to support changes.
You must monitor the web app in the environment to include the following requirements:
✑ Increase web app availability by re-routing requests away from instances with error status codes and automatically replace instances if they remain in an error state after one hour.
✑ Send web server logs, application logs, standard output, and standard error messaging to an Azure Storage blob account.
You need to configure Azure App Service.
Which values should you use? To answer, drag the appropriate configuration value to the correct requirements. Each configuration value may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.
NOTE: Each correct selection is worth one point.
Select and Place:
Show Answer
Correct Answer: Increase availability: Health check
Send logs: Diagnostic setting
Explanation: Health check reroutes traffic away from unhealthy instances and replaces instances that remain unhealthy, improving availability when scaled out. Diagnostic settings stream web server logs, application logs, stdout, and stderr to an Azure Storage blob account.
Question 229
HOTSPOT -
You are building an application that stores sensitive customer data in Azure Blob storage. The data must be encrypted with a key that is unique for each customer.
If the encryption key has been corrupted it must not be used for encryption.
You need to ensure that the blob is encrypted.
How should you complete the code segment? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Hot Area:
Explanation: Use a customer-provided key (CPK) to ensure each customer has a unique encryption key. Validate the key by checking its encryption-related value before use to avoid corrupted keys. Finally, assign the CustomerProvidedKey to BlobClientOptions so the blob is encrypted with the provided key.
Question 230
You develop and deploy an ASP.NET Core application that connects to an Azure Database for MySQL instance.
Connections to the database appear to drop intermittently and the application code does not handle the connection failure.
You need to handle the transient connection errors in code by implementing retries.
What are three possible ways to achieve this goal? Each correct answer presents part of the solution.
NOTE: Each correct selection is worth one point.
A. Close the database connection and immediately report an error.
B. Disable connection pooling and configure a second Azure Database for MySQL instance.
C. Wait five seconds before repeating the connection attempt to the database.
D. Set a maximum number of connection attempts to 10 and report an error on subsequent connections.
E. Increase connection repeat attempts exponentially up to 120 seconds.
Show Answer
Correct Answer: C, D, E
Explanation: Handling transient database connectivity issues requires implementing retry logic rather than failing immediately. Effective retry strategies include adding a delay before retrying (C), limiting the total number of retries to avoid infinite attempts and eventually reporting an error (D), and using exponential backoff to gradually increase the wait time between retries (E). These approaches align with Azure guidance for handling transient faults and improve application resilience.
Question 231
You are developing a road tollway tracking application that sends tracking events by using Azure Event Hubs using premium tier.
Each road must have a throttling policy uniquely assigned.
You need to configure the event hub to allow for per-road throttling.
What should you do?
A. Use a unique consumer group for each road.
B. Ensure each road stores events in a different partition.
C. Ensure each road has a unique connection string.
D. Use a unique application group for each road.
Show Answer
Correct Answer: D
Explanation: Azure Event Hubs Premium supports per-client throttling through Application Groups. Application groups let you define throttling and resource governance policies based on a shared identity (such as SAS policy or Azure AD app). To enforce per-road throttling, each road must be represented by a separate application group so that an individual throttling policy can be applied. Consumer groups, partitions, or connection strings do not provide per-producer throttling control.
$19
Get all 447 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.
