AZ-204 — questions

You are developing a solution that will use a multi-partitioned Azure Cosmos DB database. You plan to use the latest Azure Cosmos DB SDK for development. The solution must meet the following requirements: • Send insert and update operations to an Azure Blob storage account. • Process changes to all partitions immediately. • Allow parallelization of change processing. You need to process the Azure Cosmos DB operations. What are two possible ways to achieve this goal? Each correct answer presents a complete solution. NOTE: Each correct selection is worth one point.

You deploy an Azure App Service web app. You create an app registration for the app in Azure Active Directory (Azure AD) and Twitter. The app must authenticate users and must use SSL for all communications. The app must use Twitter as the identity provider. You need to validate the Azure AD request in the app code. What should you validate?

A development team is creating a new REST API. The API will store data in Azure Blob storage. You plan to deploy the API to Azure App Service. Developers must access the Azure Blob storage account to develop the API for the next two months. The Azure Blob storage account must not be accessible by the developers after the two-month time period. You need to grant developers access to the Azure Blob storage account. What should you do?

You have a new Azure subscription. You are developing an internal website for employees to view sensitive data. The website uses Azure Active Directory (Azure AD) for authentication. You need to implement multifactor authentication for the website. Which two actions should you perform? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.

You develop and deploy an Azure App Service web app named App1. You create a new Azure Key Vault named Vault1. You import several API keys, passwords, certificates, and cryptographic keys into Vault1. You need to grant App1 access to Vault1 and automatically rotate credentials. Credentials must not be stored in code. What should you do?

You are developing a Java application to be deployed in Azure. The application stores sensitive data in Azure Cosmos DB. You need to configure Always Encrypted to encrypt the sensitive data inside the application. What should you do first?

You are developing a Microsoft Entra ID integrated app that interacts with Microsoft Graph. You must allow GET operations to receive unknown members that might be defined in the future in Microsoft Graph API. You plan to include support for evolvable enumerations in the app. You need to specify the HTTP request header that will provide the evolvable enumerations support in the app. Which header should you specify?

Case study - This is a case study. Case studies are not timed separately. You can use as much exam time as you would like to complete each case. However, there may be additional case studies and sections on this exam. You must manage your time to ensure that you are able to complete all questions included on this exam in the time provided. To answer the questions included in a case study, you will need to reference information that is provided in the case study. Case studies might contain exhibits and other resources that provide more information about the scenario that is described in the case study. Each question is independent of the other questions in this case study. At the end of this case study, a review screen will appear. This screen allows you to review your answers and to make changes before you move to the next section of the exam. After you begin a new section, you cannot return to this section. To start the case study - To display the first question in this case study, click the Next button. Use the buttons in the left pane to explore the content of the case study before you answer the questions. Clicking these buttons displays information such as business requirements, existing environment, and problem statements. When you are ready to answer a question, click the Question button to return to the question. Background - Fourth Coffee is a global coffeehouse chain and coffee company recognized as one of the world’s most influential coffee brands. The company is renowned for its specialty coffee beverages, including a wide range of espresso-based drinks, teas, and other beverages. Fourth Coffee operates thousands of stores worldwide. Current environment - The company is developing cloud-native applications hosted in Azure. Corporate website - The company hosts a public website located at http://www.fourthcoffee.com/. The website is used to place orders as well as view and update inventory items. Inventory items - In addition to its core coffee offerings, Fourth Coffee recently expanded its menu to include inventory items such as lunch items, snacks, and merchandise. Corporate team members constantly update inventory. Users can customize items. Corporate team members configure inventory items and associated images on the website. Orders - Associates in the store serve customized beverages and items to customers. Orders are placed on the website for pickup. The application components process data as follows: 1. Azure Traffic Manager routes a user order request to the corporate website hosted in Azure App Service. 2. Azure Content Delivery Network serves static images and content to the user. 3. The user signs in to the application through a Microsoft Entra ID for customers tenant. 4. Users search for items and place an order on the website as item images are pulled from Azure Blob Storage. 5. Item customizations are placed in an Azure Service Bus queue message. 6. Azure Functions processes item customizations and saves the customized items to Azure Cosmos DB. 7. The website saves order details to Azure SQL Database. 8. SQL Database query results are cached in Azure Cache for Redis to improve performance. The application consists of the following Azure services: Requirements - The application components must meet the following requirements: • Azure Cosmos DB development must use a native API that receives the latest updates and stores data in a document format. • Costs must be minimized for all Azure services. • Developers must test Azure Blob Storage integrations locally before deployment to Azure. Testing must support the latest versions of the Azure Storage APIs. Corporate website - • User authentication and authorization must allow one-time passcode sign-in methods and social identity providers (Google or Facebook). • Static web content must be stored closest to end users to reduce network latency. Inventory items - • Customized items read from Azure Cosmos DB must maximize throughput while ensuring data is accurate for the current user on the website. • Processing of inventory item updates must automatically scale and enable updates across an entire Azure Cosmos DB container. • Inventory items must be processed in the order they were placed in the queue. • Inventory item images must be stored as JPEG files in their native format to include exchangeable image file format (data) stored with the blob data upon upload of the image file. • The Inventory Items API must securely access the Azure Cosmos DB data. Orders - • Orders must receive inventory item changes automatically after inventory items are updated or saved. Issues - • Developers are storing the Azure Cosmos DB credentials in an insecure clear text manner within the Inventory Items API code. • Production Azure Cache for Redis maintenance has negatively affected application performance. You need to securely access inventory items when developing the Inventory Items API. What are three possible ways to achieve this goal? Each correct answer presents a complete solution. NOTE: Each correct selection is worth one point.

You manage an Azure Key Vault named kv1 of Standard SKU. You plan to programmatically store in kv1 an asymmetric key pair and use the key pair for encryption and decryption. You must develop an application named app1 that will access the key pair in kv1. You need to configure an object to retrieve a key pair from kv1. Which object should you use?

You have 100 Azure virtual machines (VMs) with the system-assigned managed identity enabled. You need to identify the value of the object ID attribute for each of the identities. Which command should you use?

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You are developing an Azure solution to collect point-of-sale (POS) device data from 2,000 stores located throughout the world. A single device can produce 2 megabytes (MB) of data every 24 hours. Each store location has one to five devices that send data. You must store the device data in Azure Blob storage. Device data must be correlated based on a device identifier. Additional stores are expected to open in the future. You need to implement a solution to receive the device data. Solution: Provision an Azure Event Grid. Configure event filtering to evaluate the device identifier. Does the solution meet the goal?

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You are developing an Azure solution to collect point-of-sale (POS) device data from 2,000 stores located throughout the world. A single device can produce 2 megabytes (MB) of data every 24 hours. Each store location has one to five devices that send data. You must store the device data in Azure Blob storage. Device data must be correlated based on a device identifier. Additional stores are expected to open in the future. You need to implement a solution to receive the device data. Solution: Provision an Azure Event Hub. Configure the machine identifier as the partition key and enable capture. Does the solution meet the goal?

You are creating an app that will use CosmosDB for data storage. The app will process batches of relational data. You need to select an API for the app. Which API should you use?

A company is developing a solution that allows smart refrigerators to send temperature information to a central location. The solution must receive and store messages until they can be processed. You create an Azure Service Bus instance by providing a name, pricing tier, subscription, resource group, and location. You need to complete the configuration. Which Azure CLI or PowerShell command should you run?

You are developing several Azure API Management (APIM) hosted APIs. You must make several minor and non-breaking changes to one of the APIs. The API changes include the following requirements: • Must not disrupt callers of the API. • Enable roll back if you find issues. • Documented to enable developers to understand what is new. • Tested before publishing. You need to update the API. What should you do?

You need to grant access to the retail store location data for the inventory service development effort. What should you use?

You need to secure the Azure Functions to meet the security requirements. Which two actions should you perform? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.

You need to secure the Shipping Logic App. What should you use?

You need to authenticate the user to the corporate website as indicated by the architectural diagram. Which two values should you use? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.

You need to ensure the security policies are met. What code do you add at line CS07 of ConfigureSSE.ps1?