You develop a REST API. You implement a user delegation SAS token to communicate with Azure Blob storage.The token is compromised.You need to revoke the token.What are two possible ways to achieve this goal? Each correct answer presents a complete solution.NOTE: Each correct selection is worth one point.
Answer(s): A,D
A: Revoke a user delegation SAS To revoke a user delegation SAS from the Azure CLI, call the az storage account revoke-delegation-keys command. This command revokes all of the user delegation keys associated with the specified storage account. Any shared access signatures associated with those keys are invalidated.B: To revoke a stored access policy, you can either delete it, or rename it by changing the signed identifier. Changing the signed identifier breaks the associations between any existing signatures and the stored access policy. Deleting or renaming the stored access policy immediately effects all of the shared access signatures associated with it.
https://github.com/MicrosoftDocs/azure-docs/blob/master/articles/storage/blobs/storage-blob-user-delegation-sas-create-cli.md https://docs.microsoft.com/en-us/rest/api/storageservices/define-stored-access-policy#modifying-or-revoking-a-stored-access-policy
DRAG DROP (Drag and Drop is not supported) You are developing an Azure-hosted application that must use an on-premises hardware security module (HSM) key.The key must be transferred to your existing Azure Key Vault by using the Bring Your Own Key (BYOK) process.You need to securely transfer the key to Azure Key Vault.Which four actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.Select and Place:
Answer(s): A
To perform a key transfer, a user performs following steps:- Generate KEK.- Retrieve the public key of the KEK.- Using HSM vendor provided BYOK tool - Import the KEK into the target HSM and exports the Target Key protected by the KEK.- Import the protected Target Key to Azure Key Vault.Step 1: Generate a Key Exchange Key (KEK).Step 2: Retrieve the Key Exchange Key (KEK) public key.Step 3: Generate a key transfer blob file by using the HSM vendor-provided tool.Generate key transfer blob using HSM vendor provided BYOK toolStep 4: Run the az keyvault key import commandUpload key transfer blob to import HSM-key.Customer will transfer the Key Transfer Blob (".byok" file) to an online workstation and then run a az keyvault key import command to import this blob as a newHSM-backed key into Key Vault.To import an RSA key use this command:az keyvault key import
https://docs.microsoft.com/en-us/azure/key-vault/keys/byok-specification
You develop and deploy an Azure Logic app that calls an Azure Function app. The Azure Function app includes an OpenAPI (Swagger) definition and uses anAzure Blob storage account. All resources are secured by using Azure Active Directory (Azure AD).The Azure Logic app must securely access the Azure Blob storage account. Azure AD resources must remain if the Azure Logic app is deleted.You need to secure the Azure Logic app.What should you do?
To give a managed identity access to an Azure resource, you need to add a role to the target resource for that identity.Note: To easily authenticate access to other resources that are protected by Azure Active Directory (Azure AD) without having to sign in and provide credentials or secrets, your logic app can use a managed identity (formerly known as Managed Service Identity or MSI). Azure manages this identity for you and helps secure your credentials because you don't have to provide or rotate secrets.If you set up your logic app to use the system-assigned identity or a manually created, user-assigned identity, the function in your logic app can also use that same identity for authentication.
https://docs.microsoft.com/en-us/azure/logic-apps/create-managed-service-identity https://docs.microsoft.com/en-us/azure/api-management/api-management-howto-mutual-certificates-for-clients
HOTSPOT (Drag and Drop is not supported) You are developing an application that uses a premium block blob storage account. You are optimizing costs by automating Azure Blob Storage access tiers.You apply the following policy rules to the storage account. You must determine the implications of applying the rules to the data. (Line numbers are included for reference only.)For each of the following statements, select Yes if the statement is true. Otherwise, select No.NOTE: Each correct selection is worth one point.Hot Area:
Box 1: Yes Box 2: Yes Box 3: Yes Box 4: Yes
You are developing a solution that will use a multi-partitioned Azure Cosmos DB database. You plan to use the latest Azure Cosmos DB SDK for development.The solution must meet the following requirements:-Send insert and update operations to an Azure Blob storage account.-Process changes to all partitions immediately.-Allow parallelization of change processing.You need to process the Azure Cosmos DB operations.What are two possible ways to achieve this goal? Each correct answer presents a complete solution.NOTE: Each correct selection is worth one point.
Answer(s): C,D
Azure Functions is the simplest option if you are just getting started using the change feed. Due to its simplicity, it is also the recommended option for most change feed use cases. When you create an Azure Functions trigger for Azure Cosmos DB, you select the container to connect, and the Azure Function gets triggered whenever there is a change in the container. Because Azure Functions uses the change feed processor behind the scenes, it automatically parallelizes change processing across your container's partitions.Note: You can work with change feed using the following options:- Using change feed with Azure Functions- Using change feed with change feed processor
https://docs.microsoft.com/en-us/azure/cosmos-db/read-change-feed
Post your Comments and Discuss Microsoft AZ-204 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the AZ-204 content, but please register or login to continue.