AZ-204-ExamPrep

You manage an Azure App Service web app named app1. App1 is registered as an application in Azure Active Directory (Azure AD).

You need to ensure that Azure AD signed-in user information can be retrieved by app1 by using Microsoft Graph.

What should you configure?

• appRoles

• application permissions

• groupMembershipClaims

• delegated permissions

You have an Azure Storage account.

You need to provide external users the ability to create and update blobs.

Which enum value of BlobSasPermissions should you use?

• Add

• Create

• Read

• Write

You manage an Azure App Service web app named app1. App1 is registered as a multi-tenant application in an Azure Active Directory (Azure AD) tenant named tenant1.

You need to grant app1 the permission to access the Microsoft Graph API in tenant1.

Which service principal should you use?

• legacy

• system-assigned managed identity

• application

• user-assigned managed identity

You have blobs in an Azure storage account.

You need to implement a stored access policy that will apply to shared access signatures generated for the blobs.

To which type of storage resource should you associate the policy?

• the storage account

• the blob service of the storage account

• the container that is hosting blobs

• each individual blob

You manage an Azure App Service function app named app1 and a storage account named account1.

You have the following requirements:

App1 should access account1 without managing credentials.

The service principal associated with app1 cannot be explicitly deleted.

You need to configure a security principal for app1.

Which security principal should you use?

• application

• system-assigned managed identity

• user-assigned managed identity

• legacy

You plan to enable a user to create a managed identity for an Azure virtual machine (VM).

You need to ensure the following requirements are met:

The user account must have sufficient permissions to create the managed identity.

The principle of least privilege must be used.

Which permission role should you assign?

• Virtual Machine Administrator Login

• Virtual Machine Contributor

• Global Administrator

• Security Administrator

You need to generate a new version of a key stored in Azure Key Vault.

Which code segment should you use?

• az keyvault key rotation-policy update -n mykey --vault-name mykeyvault --value path/to/policy.json

• az keyvault key purge --name mykey --vault-name mykeyvault

• az keyvault key rotate --vault-name mykeyvault --name mykey

• az keyvault key set-attributes --vault-name mykeyvault --name mykey –policy path/to/policy.json

You are developing a solution that stores secrets in an Azure Key Vault named myvault.

You need to retrieve the value for a secret named mysecret that is stored in myvault.

Which CLI command should you use?

• az keyvault secret recover --name mysecret --vault-name myvault

• az keyvault secret recover --id myvault/mysecret

• az keyvault secret show --id myvault/mysecret

• az keyvault secret show --name mysecret --vault-name myvault

You manage a multiregion deployment of an Azure Cosmos DB account named account1.

You need to configure the default consistency level for account1. The consistency level must maximize throughput and minimize latency for write operations.

Which consistency level should you use?

• bounded staleness

• consistent prefix

• eventual

• session

You manage an Azure Cosmos DB database named database1.

You need to read items from the database without any ordering guarantee and ensure the highest availability.

Which consistency level should you use?

• strong

• bounded staleness

• session

• eventual