HOTSPOT (Drag and Drop is not supported) You have an Azure Web app that uses Cosmos DB as a data store. You create a CosmosDB container by running the following PowerShell script:$resourceGroupName = "testResourceGroup"$accountName = "testCosmosAccount"$databaseName = "testDatabase"$containerName = "testContainer"$partitionKeyPath = "/EmployeeId"$autoscaleMaxThroughput = 5000New-AzCosmosDBSqlContainer -ResourceGroupName $resourceGroupName-AccountName $accountName-DatabaseName $databaseName-Name $containerName-PartitionKeyKind Hash-PartitionKeyPath $partitionKeyPath-AutoscaleMaxThroughput $autoscaleMaxThroughputYou create the following queries that target the container:SELECT * FROM c WHERE c.EmployeeId > '12345'SELECT * FROM c WHERE c.UserID = '12345'For each of the following statements, select Yes if the statement is true. Otherwise, select No.NOTE: Each correct selection is worth one point.Hot Area:
Answer(s): A
Box 1: No You set the highest, or maximum RU/s Tmax you don't want the system to exceed. The system automatically scales the throughput T such that 0.1* Tmax <= T <=Tmax.In this example we have autoscaleMaxThroughput = 5000, so the minimum throughput for the container is 500 R/Us.Box 2: No First query: SELECT * FROM c WHERE c.EmployeeId > '12345'Here's a query that has a range filter on the partition key and won't be scoped to a single physical partition. In order to be an in-partition query, the query must have an equality filter that includes the partition key:SELECT * FROM c WHERE c.DeviceId > 'XMS-0001'Box 3: Yes Example of In-partition query:Consider the below query with an equality filter on DeviceId. If we run this query on a container partitioned on DeviceId, this query will filter to a single physical partition.SELECT * FROM c WHERE c.DeviceId = 'XMS-0001'
https://docs.microsoft.com/en-us/azure/cosmos-db/how-to-choose-offer https://docs.microsoft.com/en-us/azure/cosmos-db/how-to-query-container
HOTSPOT (Drag and Drop is not supported) You are developing a web application that makes calls to the Microsoft Graph API. You register the application in the Azure portal and upload a valid X509 certificate.You create an appsettings.json file containing the certificate name, client identifier for the application, and the tenant identifier of the Azure Active Directory (AzureAD). You create a method named ReadCertificate to return the X509 certificate by name.You need to implement code that acquires a token by using the certificate.How should you complete the code segment? To answer, select the appropriate options in the answer area.NOTE: Each correct selection is worth one point.Hot Area:
Box 1: ConfidentialClientApplicationBuilderHere's the code to instantiate the confidential client application with a client secret: app = ConfidentialClientApplicationBuilder.Create(config.ClientId).WithClientSecret(config.ClientSecret).WithAuthority(new Uri(config.Authority)).Build();Box 2: scopes After you've constructed a confidential client application, you can acquire a token for the app by calling AcquireTokenForClient, passing the scope, and optionally forcing a refresh of the token.Sample code: result = await app.AcquireTokenForClient(scopes).ExecuteAsync();
https://docs.microsoft.com/en-us/azure/active-directory/develop/scenario-daemon-app-configuration https://docs.microsoft.com/en-us/azure/active-directory/develop/scenario-daemon-acquire-token
HOTSPOT (Drag and Drop is not supported) You develop a containerized application. You plan to deploy the application to a new Azure Container instance by using a third-party continuous integration and continuous delivery (CI/CD) utility.The deployment must be unattended and include all application assets. The third-party utility must only be able to push and pull images from the registry. The authentication must be managed by Azure Active Directory (Azure AD). The solution must use the principle of least privilege.You need to ensure that the third-party utility can access the registry.Which authentication options should you use? To answer, select the appropriate options in the answer area.NOTE: Each correct selection is worth one point.Hot Area:
Box 1: Service principal Applications and container orchestrators can perform unattended, or "headless," authentication by using an Azure Active Directory (Azure AD) service principal.Incorrect Answers:- Individual AD identity does not support unattended push/pull- Repository-scoped access token is not integrated with AD identity- Managed identity for Azure resources is used to authenticate to an Azure container registry from another Azure resource.Box 2: AcrPush AcrPush provides pull/push permissions only and meets the principle of least privilege.Incorrect Answers:AcrPull only allows pull permissions it does not allow push permissions.- Owner and Contributor allow pull/push permissions but does not meet the principle of least privilege.
https://docs.microsoft.com/en-us/azure/container-registry/container-registry-authentication?tabs=azure-cli https://docs.microsoft.com/en-us/azure/container-registry/container-registry-roles?tabs=azure-cli
You deploy an Azure App Service web app. You create an app registration for the app in Azure Active Directory (Azure AD) and Twitter.The app must authenticate users and must use SSL for all communications. The app must use Twitter as the identity provider.You need to validate the Azure AD request in the app code.What should you validate?
Answer(s): B
https://docs.microsoft.com/en-us/azure/storage/common/storage-auth-aad-app?tabs=dotnet
A development team is creating a new REST API. The API will store data in Azure Blob storage. You plan to deploy the API to Azure App Service.Developers must access the Azure Blob storage account to develop the API for the next two months. The Azure Blob storage account must not be accessible by the developers after the two-month time period.You need to grant developers access to the Azure Blob storage account.What should you do?
https://docs.microsoft.com/en-us/azure/storage/common/storage-sas-overview
Post your Comments and Discuss Microsoft AZ-204 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the AZ-204 content, but please register or login to continue.