QUESTION: 35 Exam Topic: Implement Azure security questions

You are developing a solution that will use a multi-partitioned Azure Cosmos DB database. You plan to use the latest Azure Cosmos DB SDK for development.

The solution must meet the following requirements:

-Send insert and update operations to an Azure Blob storage account.
-Process changes to all partitions immediately.
-Allow parallelization of change processing.

You need to process the Azure Cosmos DB operations.

What are two possible ways to achieve this goal? Each correct answer presents a complete solution.
NOTE: Each correct selection is worth one point.

Create an Azure App Service API and implement the change feed estimator of the SDK. Scale the API by using multiple Azure App Service instances.
Create a background job in an Azure Kubernetes Service and implement the change feed feature of the SDK.
Create an Azure Function to use a trigger for Azure Cosmos DB. Configure the trigger to connect to the container.
Create an Azure Function that uses a FeedIterator object that processes the change feed by using the pull model on the container. Use a FeedRange objext to parallelize the processing of the change feed across multiple functions.

Answer(s): A,C

Explanation:

Azure Functions is the simplest option if you are just getting started using the change feed. Due to its simplicity, it is also the recommended option for most change feed use cases. When you create an Azure Functions trigger for Azure Cosmos DB, you select the container to connect, and the Azure Function gets triggered whenever there is a change in the container. Because Azure Functions uses the change feed processor behind the scenes, it automatically parallelizes change processing across your container's partitions.

Note: You can work with change feed using the following options:
Using change feed with Azure Functions
Using change feed with change feed processor

Reference:

https://docs.microsoft.com/en-us/azure/cosmos-db/read-change-feed

Reveal Solution Next Question

QUESTION: 36 Exam Topic: Implement Azure security questions

HOTSPOT (Drag & Drop is not supported)
You develop a containerized application. You plan to deploy the application to a new Azure Container instance by using a third-party continuous integration and continuous delivery (CI/CD) utility.

The deployment must be unattended and include all application assets. The third-party utility must only be able to push and pull images from the registry. The authentication must be managed by Azure Active Directory (Azure AD). The solution must use the principle of least privilege.

You need to ensure that the third-party utility can access the registry.

Which authentication options should you use? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

See Explanation section for answer.

Answer(s): A

Explanation:

Box 1: Service principal
Applications and container orchestrators can perform unattended, or "headless," authentication by using an Azure Active Directory (Azure AD) service principal.

Incorrect Answers:
-Individual AD identity does not support unattended push/pull
-Repository-scoped access token is not integrated with AD identity
-Managed identity for Azure resources is used to authenticate to an Azure container registry from another Azure resource.

Box 2: AcrPush
AcrPush provides pull/push permissions only and meets the principle of least privilege.

Incorrect Answers:
AcrPull only allows pull permissions it does not allow push permissions.
Owner and Contributor allow pull/push permissions but does not meet the principle of least privilege.

Reference:

https://docs.microsoft.com/en-us/azure/container-registry/container-registry-authentication?tabs=azure-cli
https://docs.microsoft.com/en-us/azure/container-registry/container-registry-roles?tabs=azure-cli

Reveal Solution Next Question

QUESTION: 36 Exam Topic: Implement Azure security questions

HOTSPOT (Drag & Drop is not supported)
You have an Azure Web app that uses Cosmos DB as a data store. You create a CosmosDB container by running the following PowerShell script:

$resourceGroupName = "testResourceGroup"
$accountName = "testCosmosAccount"
$databaseName = "testDatabase"
$containerName = "testContainer"
$partitionKeyPath = "/EmployeeId"
$autoscaleMaxThroughput = 5000

New-AzCosmosDBSqlContainer
-ResourceGroupName $resourceGroupName
-AccountName $accountName
-DatabaseName $databaseName
-Name $containerName
-PartitionKeyKind Hash
-PartitionKeyPath $partitionKeyPath
-AutoscaleMaxThroughput $autoscaleMaxThroughput

You create the following queries that target the container:

SELECT * FROM c WHERE c.EmployeeId > '12345'
SELECT * FROM c WHERE c.UserID = '12345'

For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.

See Explanation section for answer.

Answer(s): A

Explanation:

Box 1: No
You set the highest, or maximum RU/s Tmax you don't want the system to exceed. The system automatically scales the throughput T such that 0.1* Tmax <= T <= Tmax.

In this example we have autoscaleMaxThroughput = 5000, so the minimum throughput for the container is 500 R/Us.

Box 2: No
First query: SELECT * FROM c WHERE c.EmployeeId > '12345'

Here's a query that has a range filter on the partition key and won't be scoped to a single physical partition. In order to be an in-partition query, the query must have an equality filter that includes the partition key:

SELECT * FROM c WHERE c.DeviceId > 'XMS-0001'

Box 3: Yes
Example of In-partition query:
Consider the below query with an equality filter on DeviceId. If we run this query on a container partitioned on DeviceId, this query will filter to a single physical partition.

SELECT * FROM c WHERE c.DeviceId = 'XMS-0001'

Reference:

https://docs.microsoft.com/en-us/azure/cosmos-db/how-to-choose-offer
https://docs.microsoft.com/en-us/azure/cosmos-db/how-to-query-container

Reveal Solution Next Question

QUESTION: 37 Exam Topic: Implement Azure security questions

You deploy an Azure App Service web app. You create an app registration for the app in Azure Active Directory (Azure AD) and Twitter.

The app must authenticate users and must use SSL for all communications. The app must use Twitter as the identity provider.

You need to validate the Azure AD request in the app code.
What should you validate?

ID token header
ID token signature
HTTP response code
Tenant ID

Answer(s): A

Reference:

https://docs.microsoft.com/en-us/azure/storage/common/storage-auth-aad-app?tabs=dotnet

Reveal Solution Next Question

Free AZ-204 Exam Braindumps (page: 31)

QUESTION: 35 Exam Topic: Implement Azure security questions

Explanation:

Reference:

QUESTION: 36 Exam Topic: Implement Azure security questions

Explanation:

Reference:

QUESTION: 36 Exam Topic: Implement Azure security questions

Explanation:

Reference:

QUESTION: 37 Exam Topic: Implement Azure security questions

Reference: