Az204 exam prep quiz5

Your company is developing an Azure API.You need to implement authentication for the Azure API. You have the following requirements:All API calls must be secure.✑ Callers to the API must not send credentials to the API.Which authentication mechanism should you use?

• Basic

• Anonymous

• Managed Identity

• Client Certificate

Answer explanation

Use the authentication-managed-identity policy to authenticate with a backend service using the managed identity of the API Management service. This policy essentially uses the managed identity to obtain an access token from Azure Active Directory for accessing the specified resource. After successfully obtaining the token, the policy will set the value of the token in the Authorization header using the Bearer scheme.

You are a developer for a SaaS company that offers many web services.All web services for the company must meet the following requirements:✑ Use API Management to access the services✑ Use OpenID Connect for authentication✑ Prevent anonymous usageA recent security audit found that several web services can be called without any authentication.Which API Management policy should you implement?

• jsonp

• authentication-certificate

• check-header

• validate-jwt

Answer explanation

Correct Answer: D 🗳️Add the validate-jwt policy to validate the OAuth token for every incoming request.Incorrect Answers:A: The jsonp policy adds JSON with padding (JSONP) support to an operation or an API to allow cross-domain calls from JavaScript browser-based clients.JSONP is a method used in JavaScript programs to request data from a server in a different domain. JSONP bypasses the limitation enforced by most web browsers where access to web pages must be in the same domain.JSONP - Adds JSON with padding (JSONP) support to an operation or an API to allow cross-domain calls from JavaScript browser-based clients.

Contoso, Ltd. provides an API to customers by using Azure API Management (APIM). The API authorizes users with a JWT token.You must implement response caching for the APIM gateway. The caching mechanism must detect the user ID of the client that accesses data for a given location and cache the response for that user ID.You need to add the following policies to the policies file:✑ a set-variable policy to store the detected user identity✑ a cache-lookup-value policy✑ a cache-store-value policy✑ a find-and-replace policy to update the response body with the user profile informationTo which policy section should you add the policies? To answer, drag the appropriate sections to the correct policies. Each section may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.NOTE: Each correct selection is worth one point.

• Box 1: Inbound.

  Box 2: Inbound

  Box 3: Outbound

  Box 4: Outbound

• Box 1: Outbound.

  Box 2: Inbound

  Box 3: Outbound

  Box 4: Outbound

Answer explanation

You are developing an Azure solution.You need to develop code to access a secret stored in Azure Key Vault.How should you complete the code segment? To answer, drag the appropriate code segments to the correct location. Each code segment may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.NOTE: Each correct selection is worth one point.Select and Place:

• Box 1: ClientSecretCredential

  Box 2: CloudClients

• Box 1: SecretClient

  Box 2: DefaultAzureCredential

Answer explanation

You are creating an Azure key vault using PowerShell. Objects deleted from the key vault must be kept for a set period of 90 days.
Which two of the following parameters must be used in conjunction to meet the requirement? (Choose two.)

• EnabledForDeployment

• • EnablePurgeProtection

• • EnabledForTemplateDeployment

• • EnableSoftDelete

Answer explanation

Answer : BD

You have an Azure Active Directory (Azure AD) tenant.
You want to implement multi-factor authentication by making use of a conditional access policy. The conditional access policy must be applied to all users when they access the Azure portal.
Which three settings should you configure? To answer, select the appropriate settings in the answer area.
NOTE: Each correct selection is worth one point.

• Box1 :0 Users selected

  Box2: 0 apps selected

  Box3:(Session)0 controls selected

• Box1 :0 Users selected

  Box2: 0 apps selected

  Box3:(Grant)0 controls selected

• Box1 :0 Users selected

  Box2: 0 apps selected

  Box3:(Grant)0 controls selected

Answer explanation

You manage an Azure SQL database that allows for Azure AD authentication.
You need to make sure that database developers can connect to the SQL database via Microsoft SQL Server Management Studio (SSMS). You also need to make sure the developers use their on-premises Active Directory account for authentication. Your strategy should allow for authentication prompts to be kept to a minimum.
Which of the following should you implement?

• • A. Azure AD token.

• • B. Azure Multi-Factor authentication.

• • C. Active Directory integrated authentication.

• • D. OATH software tokens.

Answer explanation

Answer : C

Azure AD can be the initial Azure AD managed domain. Azure AD can also be an on-premises Active Directory Domain Services that is federated with the Azure
AD.
Using an Azure AD identity to connect using SSMS or SSDT
The following procedures show you how to connect to a SQL database with an Azure AD identity using SQL Server Management Studio or SQL Server Database

You are developing an application to transfer data between on-premises file servers and Azure Blob storage. The application stores keys, secrets, and certificates in Azure Key Vault and makes use of the Azure Key Vault APIs.
You want to configure the application to allow recovery of an accidental deletion of the key vault or key vault objects for 90 days after deletion.
What should you do?

• • A. Run the Add-AzKeyVaultKey cmdlet.

• • B. Run the az keyvault update --enable-soft-delete true --enable-purge-protection true CLI.

• • C. Implement virtual network service endpoints for Azure Key Vault.

• • D. Run the az keyvault update --enable-soft-delete false CLI.

Answer explanation

Answer : B

When soft-delete is enabled, resources marked as deleted resources are retained for a specified period (90 days by default). The service further provides a mechanism for recovering the deleted object, essentially undoing the deletion.
Purge protection is an optional Key Vault behavior and is not enabled by default. Purge protection can only be enabled once soft-delete is enabled.
When purge protection is on, a vault or an object in the deleted state cannot be purged until the retention period has passed. Soft-deleted vaults and objects can still be recovered, ensuring that the retention policy will be followed.
The default retention period is 90 days, but it is possible to set the retention policy interval to a value from 7 to 90 days through the Azure portal. Once the retention policy interval is set and saved it cannot be changed for that vault.

You have developed a Web App for your company. The Web App provides services and must run in multiple regions.
You want to be notified whenever the Web App uses more than 85 percent of the available CPU cores over a 5 minute period. Your solution must minimize costs.
Which command should you use? To answer, select the appropriate settings in the answer area.
NOTE: Each correct selection is worth one point.

• Box1: auto mitigate

  Box2:Percentage CPU

• Box1: window size

  Box2:avg Percentage CPU

• Box1: evaluation frequency

  Box2:CPU Usage

Answer explanation

You are configuring a web app that delivers streaming video to users. The application makes use of continuous integration and deployment.
You need to ensure that the application is highly available and that the users' streaming experience is constant. You also want to configure the application to store data in a geographic location that is nearest to the user.
Solution: You include the use of an Azure Content Delivery Network (CDN) in your design.
Does the solution meet the goal?

• A.Yes

• B.No