Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.You are developing a website that will run as an Azure Web App. Users will authenticate by using their Azure Active Directory (Azure AD) credentials.You plan to assign users one of the following permission levels for the website: admin, normal, and reader. A user's Azure AD group membership must be used to determine the permission level.You need to configure authorization.Solution:-Configure and use Integrated Windows Authentication in the website.-In the website, query Microsoft Graph API to load the groups to which the user is a member.Does the solution meet the goal?
Answer(s): B
Microsoft Graph is a RESTful web API that enables you to access Microsoft Cloud service resources.Instead in the Azure AD application's manifest, set value of the groupMembershipClaims option to All. In the website, use the value of the groups claim from theJWT for the user to determine permissions.
https://blogs.msdn.microsoft.com/waws/2017/03/13/azure-app-service-authentication-aad-groups/
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.You develop Azure solutions.You must grant a virtual machine (VM) access to specific resource groups in Azure Resource Manager.You need to obtain an Azure Resource Manager access token.Solution: Run the Invoke-RestMethod cmdlet to make a request to the local managed identity for Azure resources endpoint.Does the solution meet the goal?
Answer(s): A
Get an access token using the VM's system-assigned managed identity and use it to call Azure Resource ManagerYou will need to use PowerShell in this portion.1. In the portal, navigate to Virtual Machines and go to your Windows virtual machine and in the Overview, click Connect.2. Enter in your Username and Password for which you added when you created the Windows VM.3. Now that you have created a Remote Desktop Connection with the virtual machine, open PowerShell in the remote session.4. Using the Invoke-WebRequest cmdlet, make a request to the local managed identity for Azure resources endpoint to get an access token for Azure ResourceManager.Example:$response = Invoke-WebRequest -Uri 'http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01&resource=https:// management.azure.com/' -Method GET -Headers @{Metadata="true"}
https://docs.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/tutorial-windows-vm-access-arm
HOTSPOT (Drag and Drop is not supported) You are building a website to access project data related to teams within your organization. The website does not allow anonymous access. Authentication is performed using an Azure Active Directory (Azure AD) app named internal.The website has the following authentication requirements:-Azure AD users must be able to login to the website.-Personalization of the website must be based on membership in Active Directory groups.You need to configure the application's manifest to meet the authentication requirements.How should you configure the manifest? To answer, select the appropriate configuration in the answer area.NOTE: Each correct selection is worth one point.Hot Area:
Box 1: groupMembershipClaims Scenario: Personalization of the website must be based on membership in Active Directory groups.Group claims can also be configured in the Optional Claims section of the Application Manifest.Enable group membership claims by changing the groupMembershipClaimThe valid values are:"All""SecurityGroup""DistributionList""DirectoryRole"Box 2: oauth2Permissions Scenario: Azure AD users must be able to login to the website. oauth2Permissions specifies the collection of OAuth 2.0 permission scopes that the web API (resource) app exposes to client apps. These permission scopes may be granted to client apps during consent.Incorrect Answers:oauth2AllowImplicitFlow. oauth2AllowImplicitFlow specifies whether this web app can request OAuth2.0 implicit flow access tokens. The default is false. This flag is used for browser-based apps, like Javascript single-page apps.
https://docs.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-fed-group-claims
You develop an app that allows users to upload photos and videos to Azure storage. The app uses a storage REST API call to upload the media to a blob storage account named Account1. You have blob storage containers named Container1 and Container2.Uploading of videos occurs on an irregular basis.You need to copy specific blobs from Container1 to Container2 when a new video is uploaded.What should you do?
The Start-AzureStorageBlobCopy cmdlet starts to copy a blob.Example 1: Copy a named blob C:\PS>Start-AzureStorageBlobCopy -SrcBlob "ContosoPlanning2015" -DestContainer "ContosoArchives" -SrcContainer "ContosoUploads"This command starts the copy operation of the blob named ContosoPlanning2015 from the container named ContosoUploads to the container namedContosoArchives.
https://docs.microsoft.com/en-us/powershell/module/azure.storage/start-azurestorageblobcopy?view=azurermps-6.13.0
You are developing an ASP.NET Core website that uses Azure FrontDoor. The website is used to build custom weather data sets for researchers. Data sets are downloaded by users as Comma Separated Value (CSV) files. The data is refreshed every 10 hours.Specific files must be purged from the FrontDoor cache based upon Response Header values.You need to purge individual assets from the Front Door cache.Which type of cache purge should you use?
These formats are supported in the lists of paths to purge:- Single path purge: Purge individual assets by specifying the full path of the asset (without the protocol and domain), with the file extension, for example, /[1]- Wildcard purge: Asterisk (*) may be used as a wildcard. Purge all folders, subfolders, and files under an endpoint with /* in the path or purge all subfolders and files under a specific folder by specifying the folder followed by /*, for example, /pictures/*.- Root domain purge: Purge the root of the endpoint with "/" in the path.
https://docs.microsoft.com/en-us/azure/frontdoor/front-door-caching
Post your Comments and Discuss Microsoft AZ-204 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the AZ-204 content, but please register or login to continue.