QUESTION: 3 Exam Topic: Testlet 2

HOTSPOT (Drag & Drop is not supported)
You need to ensure that network security policies are met.
How should you configure network security? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.
Hot Area:

See Explanation section for answer.

Answer(s): A

Explanation:

Box 1: Valid root certificate

Scenario: All websites and services must use SSL from a valid root certificate authority.

Box 2: Azure Application Gateway
Scenario:
-Any web service accessible over the Internet must be protected from cross site scripting attacks.
-All Internal services must only be accessible from Internal Virtual Networks (VNets)
-All parts of the system must support inbound and outbound traffic restrictions.

Azure Web Application Firewall (WAF) on Azure Application Gateway provides centralized protection of your web applications from common exploits and vulnerabilities. Web applications are increasingly targeted by malicious attacks that exploit commonly known vulnerabilities. SQL injection and cross-site scripting are among the most common attacks.

Application Gateway supports autoscaling, SSL offloading, and end-to-end SSL, a web application firewall (WAF), cookie-based session affinity, URL path-based routing, multisite hosting, redirection, rewrite HTTP headers and other features.

Note: Both Nginx and Azure Application Gateway act as a reverse proxy with Layer 7 load-balancing features plus a WAF to ensure strong protection against common web vulnerabilities and exploits.

You can modify Nginx web server configuration/SSL for X-XSS protection. This helps to prevent cross-site scripting exploits by forcing the injection of HTTP headers with X-XSS protection.

Reference:

https://docs.microsoft.com/en-us/azure/web-application-firewall/ag/ag-overview https://www.upguard.com/articles/10-tips-for-securing-your-nginx-deployment

Reveal Solution Next Question

QUESTION: 4 Exam Topic: Testlet 2

View Related Case Study

HOTSPOT (Drag & Drop is not supported)
You need to add YAML markup at line CS17 to ensure that the ContentUploadService can access Azure Storage access keys.

How should you complete the YAML markup? To answer, drag the appropriate YAML segments to the correct locations. Each YAML segment may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.
NOTE: Each correct selection is worth one point.

See Explanation section for answer.

Answer(s): A

Explanation:

Box 1: volumeMounts
Example:
volumeMounts:
- mountPath: /mnt/secrets
name: secretvolume1
volumes:
- name: secretvolume1
secret:
mysecret1: TXkgZmlyc3Qgc2VjcmV0IEZPTwo=

Box 2: volumes

Box 3: secret

Reference:

https://docs.microsoft.com/en-us/azure/container-instances/container-instances-volume-secret

Reveal Solution Next Question

QUESTION: 5 Exam Topic: Testlet 2

View Related Case Study

HOTSPOT (Drag & Drop is not supported)
You need to add code at line AM10 of the application manifest to ensure that the requirement for manually reviewing content can be met.

How should you complete the code? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.

See Explanation section for answer.

Answer(s): A

Explanation:

Box 1: sid
Sid: Session ID, used for per-session user sign-out. Personal and Azure AD accounts.

Scenario: Manual review
To review content, the user must authenticate to the website portion of the ContentAnalysisService using their Azure AD credentials. The website is built using React and all pages and API endpoints require authentication. In order to review content a user must be part of a ContentReviewer role.

Box 2: email
Scenario: All completed reviews must include the reviewer’s email address for auditing purposes.

Reveal Solution Next Question

QUESTION: 1 Exam Topic: Implement Azure security

View Related Case Study

HOTSPOT (Drag & Drop is not supported)
You need to implement the Azure Function for delivery driver profile information.

Which configurations should you use? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

See Explanation section for answer.

Answer(s): A

Explanation:

Box 1: Azure Identity library
Store delivery driver profile information in Azure Active Directory (Azure AD) by using an Azure Function called from the corporate website.

We recommend that you use a managed identity for applications deployed to Azure.
The preceding authentication scenarios are supported by the Azure Identity client library and integrated with Key Vault SDKs.

Note: What is Managed Service Identity?
Azure Key Vault avoids the need to store keys and secrets in application code or source control. However, in order to retrieve keys and secrets from Azure Key Vault, you need to authorize a user or application with Azure Key Vault, which in its turn needs another credential. Managed Service Identity avoids the need of storing credentials for Azure Key Vault in application or environment settings by creating a Service Principal for each application or cloud service on which Managed Service Identity is enabled. This Service Principal enables you to call a local MSI endpoint to get an access token from Azure AD using the credentials of the Service Principal. This token is then used to authenticate to an Azure Service, for example Azure Key Vault.

Box 2: Azure Key Vault
Azure Key Vault allows you to securely access sensitive information from within your applications:
* Keys, secrets, and certificates are protected without your having to write the code yourself, and you can easily use them from your applications.

Use Azure Key Vault to store only secrets for your application. Examples of secrets that should be stored in Key Vault include:

Client application secrets
Connection strings
Passwords
Shared access keys
SSH keys

Reference:

https://docs.microsoft.com/en-us/azure/key-vault/general/developers-guide
https://integration.team/blog/retrieve-azure-key-vault-secrets-using-azure-functions-and-managed-service-identity

Reveal Solution Next Question

Free AZ-204 Exam Braindumps (page: 40)

QUESTION: 3 Exam Topic: Testlet 2

Explanation:

Reference:

QUESTION: 4 Exam Topic: Testlet 2

Explanation:

Reference:

QUESTION: 5 Exam Topic: Testlet 2

Explanation:

QUESTION: 1 Exam Topic: Implement Azure security

Explanation:

Reference: