You have an application that includes an Azure Web app and several Azure Function apps. Application secrets including connection strings and certificates are stored in Azure Key Vault.Secrets must not be stored in the application or application runtime environment. Changes to Azure Active Directory (Azure AD) must be minimized.You need to design the approach to loading application secrets.What should you do?
Answer(s): A
Use Key Vault references for App Service and Azure Functions.Key Vault references currently only support system-assigned managed identities. User-assigned identities cannot be used.
https://docs.microsoft.com/en-us/azure/app-service/app-service-key-vault-references
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.You are developing a medical records document management website. The website is used to store scanned copies of patient intake forms.If the stored intake forms are downloaded from storage by a third party, the contents of the forms must not be compromised.You need to store the intake forms according to the requirements.Solution:1. Create an Azure Key Vault key named skey.2. Encrypt the intake forms using the public key portion of skey.3. Store the encrypted data in Azure Blob storage.Does the solution meet the goal?
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.You are developing a medical records document management website. The website is used to store scanned copies of patient intake forms.If the stored intake forms are downloaded from storage by a third party, the contents of the forms must not be compromised.You need to store the intake forms according to the requirements.Solution:1. Create an Azure Cosmos DB database with Storage Service Encryption enabled.2. Store the intake forms in the Azure Cosmos DB database.Does the solution meet the goal?
Answer(s): B
Instead use an Azure Key vault and public key encryption. Store the encrypted from in Azure Storage Blob storage.
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.You are developing a medical records document management website. The website is used to store scanned copies of patient intake forms.If the stored intake forms are downloaded from storage by a third party, the contents of the forms must not be compromised.You need to store the intake forms according to the requirements.Solution: Store the intake forms as Azure Key Vault secrets.Does the solution meet the goal?
HOTSPOT (Drag and Drop is not supported) You plan to deploy a new application to a Linux virtual machine (VM) that is hosted in Azure.The entire VM must be secured at rest by using industry-standard encryption technology to address organizational security and compliance requirements.You need to configure Azure Disk Encryption for the VM.How should you complete the Azure CLI commands? To answer, select the appropriate options in the answer area.NOTE: Each correct selection is worth one point.Hot Area:
Box 1: keyvault Create an Azure Key Vault with az keyvault create and enable the Key Vault for use with disk encryption. Specify a unique Key Vault name for keyvault_name as follows: keyvault_name=myvaultname$RANDOM az keyvault create \--name $keyvault_name \--resource-group $resourcegroup \--location eastus \--enabled-for-disk-encryption TrueBox 2: keyvault key The Azure platform needs to be granted access to request the cryptographic keys when the VM boots to decrypt the virtual disks. Create a cryptographic key in your Key Vault with az keyvault key create. The following example creates a key named myKey: az keyvault key create \--vault-name $keyvault_name \--name myKey \--protection softwareBox 3: vm Create a VM with az vm create. Only certain marketplace images support disk encryption. The following example creates a VM named myVM using an Ubuntu16.04 LTS image:az vm create \--resource-group $resourcegroup \--name myVM \--image Canonical:UbuntuServer:16.04-LTS:latest \--admin-username azureuser \--generate-ssh-keys \Box 4: vm encryption Encrypt your VM with az vm encryption enable:az vm encryption enable \--resource-group $resourcegroup \--name myVM \--disk-encryption-keyvault $keyvault_name \--key-encryption-key myKey \--volume-type allNote: seems to an error in the question. Should have enable instead of create.Box 5: all Encrypt both data and operating system.
https://docs.microsoft.com/en-us/azure/virtual-machines/linux/disk-encryption-cli-quickstart
Post your Comments and Discuss Microsoft AZ-204 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the AZ-204 content, but please register or login to continue.