Microsoft Practice Questions, Discussions & Exam Topics by our Authors

SNAPSHOT - You are developing an ASP.NET Core app that includes feature flags which are managed by Azure App Configuration. You create an Azure App Configuration store named AppFeatureflagStore as shown in the exhibit: You must be able to use the feature in the app by using the following markup: You need to update the app to use the feature flag....

Author: Elizabeth · Last updated Aug 17, 2026

SNAPSHOT - You have a single page application (SPA) web application that manages information based on data returned by Microsoft Graph from another company's Azure Active Directory (Azure AD) instance. Users must be able to authenticate and access Microsoft Graph by using their own company's Azure AD instance. You need to configure the application manifest for the app registrati...

Author: Ming · Last updated Aug 17, 2026

You manage a data processing application that receives requests from an Azure Storage queue. You need to manage access to the queue. You have the following requirements: * Provide other applications access to the Azure queue. * Ensure that you can revoke access to the queue without having to regenerate the storage account ...

To address the given requirements, we need to carefully consider the different types of Shared Access Signatures (SAS) that Azure offers. Let's evaluate each option: A) Service SAS with a stored access policy - Service SAS allows granting access to specific resources (such as a queue, blob, or file) within a storage account. - Stored Access Policy provides a way to define a set of access policies at the storage service level. It allows for more control by specifying permissions (read, write, etc.), expiration time, and other settings at the resource level. - Advantages: The key benefit of this option is that it allows you to grant access to a specific resource (in this case, the queue) and manage permissions through the stored access policy. You can revoke access by updating or deleting the stored access policy without needing to regenerate the storage account keys, addressing the requirement for easy revocation. - Rejection of Other Options: - Unlike ad hoc SAS, which is generated on the fly, the stored access policy provides flexibility in managing multiple SAS tokens for the same resource. - Why it’s a better option: You don’t need to regenerate storage account keys, and access is granted at the queue level, not the entire storage account. B) Account SAS - Account SAS grants access to all services (Blob, Queue, File, and Table) at the storage account level, and permissions are assigned across the entire account. - Why it’s rejected: This does not meet the requirement to restrict access at the queue level. If you grant access at the account level, you can’t c...

Author: Kunal · Last updated Aug 17, 2026

SNAPSHOT - You are developing an application to store and retrieve data in Azure Blob storage. The application will be hosted in an on-premises virtual machine (VM). The VM is connected to Azure by using a Site-to-Site VPN gateway connection. The application is secured by using Azure Active Directory (Azure AD) credentials. The application must be granted access to the Azure Blob storage account with a start time, expiry time, and read permissions. The Azure Blob storage account access must use the Azure AD credentials of the application to secure data access. Data access must be able to be revoked if the c...

Author: Amira · Last updated Aug 17, 2026

You are building a web application that uses the Microsoft identity platform for user authentication. You are implementing user identification for the web application. You need to ...

When implementing user identification for a web application using the Microsoft identity platform, the goal is to retrieve a claim that uniquely identifies the user. Let’s evaluate each option based on the requirements: A) aud (Audience) - aud is a claim that identifies the intended recipient of the token (the audience). It specifies the application or service that the token is intended for. - Why it's rejected: While the aud claim helps ensure the token is sent to the correct application, it does not uniquely identify a user. Instead, it identifies the target application or service. - Use case: The aud claim is primarily used to verify the intended audience of the token and is not used for uniquely identifying users. B) nonce - nonce is a claim used to prevent replay attacks. It ensures that a token is not reused inappropriately. - Why it's rejected: The nonce claim is a security measure to prevent attacks and is not used for identifying a user. It is a unique value associated with the authentication request but does not provide a permanent or unique user identifier. - Use case: Nonce is useful in protecting the integrity of the authentication process but does not serve the purpose of uniquely identifying users. C) oid (Object ID) - oid represents the Object ID of the user in Azure ...

Author: Ryan · Last updated Aug 17, 2026

You are developing an Azure Function that calls external APIs by providing an access token for the API. The access token is stored in a secret named token in an Azure Key Vault named mykeyvault. You need to ensure the Azure Func...

To ensure that an Azure Function can securely access a secret (in this case, an access token) stored in Azure Key Vault, you need to use the correct configuration syntax in the Azure Function App settings. Let's go through each option and evaluate it. Analysis of Options: Option A: KeyVault:mykeyvault;Secret:token - This option implies a format where the Key Vault name and secret name are specified directly. However, Azure Functions do not support this syntax to reference secrets. It does not match the expected way of linking a secret in Azure Key Vault to an Azure Function App. - Rejected: This format is not valid for referencing secrets in Azure Key Vault in the Azure Function App configuration. Option B: App:Settings:Secret:mykeyvault:token - This option seems to suggest that a secret is being referenced in an app setting using some custom format, but it does not follow the correct Azure syntax. The Azure Functions configuration does not use this format for referencing secrets stored in Azure Key Vault. - Rejected: This is not a valid way to reference secrets in Azure Key Vault within an Azure Function's app settings. Option C: AZUREKVCONNSTR_ https://mykeyvault.vault.azure.net/secrets/token/ - This option resembles a connection string format for accessing a service (such as Azure ...

Author: Nia · Last updated Aug 17, 2026

A company maintains multiple web and mobile applications. Each application uses custom in-house identity providers as well as social identity providers. You need to impl...

To implement Single Sign-On (SSO) for multiple web and mobile applications that use custom in-house identity providers as well as social identity providers, it's important to choose the right solution based on the flexibility and functionality required. Analysis of Options: Option A: Use Azure Active Directory B2C (Azure AD B2C) with custom policies - Azure AD B2C (Business to Consumer) is a service that allows businesses to build customer-facing applications that can authenticate users via both social accounts (such as Facebook, Google) and local/custom identity providers. Custom policies allow for complete control over the authentication process, enabling complex scenarios such as integrating multiple identity providers, custom authentication flows, and more. - Why Selected: This option is ideal for this scenario because Azure AD B2C supports SSO for both custom in-house identity providers and social identity providers, offering full flexibility with custom policies. Custom policies are particularly useful when you need to customize and fine-tune the authentication process, especially when dealing with diverse identity sources. - Best Scenario: Companies with complex or highly customized authentication requirements, such as integrating in-house identity systems with a variety of social logins. Option B: Use Azure Active Directory B2B (Azure AD B2B) and enable external collaboration - Azure AD B2B allows businesses to enable secure access to internal applications for external users (e.g., partners or contractors). It works by inviting external users to the directory, allowing them to authenticate using their own credentials. - Rejected: Azure AD B2B is designed for collaboration between organizations (external partners) and is not a solution for handling SSO within customer-facing web and mobile applications with a mix of internal and external identity providers. It does not provide the necessary flexibility to integrate custom in-house identity providers o...

Author: Scarlett · Last updated Aug 17, 2026

You develop a Python application for image rendering that uses GPU resources to optimize rendering processes. You deploy the application to an Azure Container Instances (ACI) Linux container. The application requires a secret value to be passed when the container is started. The value must only be accessed from within the container. You need to pass the secret...

To pass a secret value to an Azure Container Instance (ACI) Linux container securely and ensure that the value is accessible only from within the container, let's evaluate the options provided. A) Create an environment variable. Set the secureValue property to the secret value. - Reasoning: You can pass secret values securely using environment variables, but environment variables are not inherently secure, as they can potentially be exposed in logs or other outputs within the container. However, ACI supports the Azure Key Vault integration to inject secrets into the container via environment variables, which would be a secure way to handle secrets. - Usage: This can be used in scenarios where you want the secret to be passed securely into the container, utilizing Azure Key Vault to keep it protected. B) Add the secret value to the container image. Use a managed identity. - Reasoning: Storing secrets directly in the container image is highly insecure because it would expose the secret whenever the container image is accessed or shared. While managed identities provide a secure way to access Azure resources (like Azure Key Vault), the secret itself should not be hardcoded into the image. - Usage: This option is not recommended because storing sensitive data directly in the container image defeats the purpose of keeping it secure. C) Add the secret value to the application code. Set the container startup command. - Reasoning: Embedding the secret value directly in the application code is insecure. If anyone gains access to the code, they could retrieve the secret. Additionally, passing secrets this way does not leverage Azure's built-in security mechanisms (such as Azure Key Vault), ma...

Author: Ming · Last updated Aug 17, 2026

You are developing a user portal for a company. You need to create a report for the portal that lists information about employees who are subject matter experts for a specific topic. You must ensure that adm...

To decide which technology to use to create a report for the portal, it's important to consider the needs of the system in terms of data access, control, and consent. Let's evaluate the given options: A) Microsoft Graph Data Connect - Reasoning: Microsoft Graph Data Connect is a service that allows organizations to integrate their data from Microsoft 365 services (like Office 365, Azure Active Directory, and others) into a data warehouse or data lake. This service is designed for ETL (Extract, Transform, Load) processes and can provide access to data in a controlled and structured manner. It ensures administrators can manage and consent to the access, which aligns well with your requirement for administrators to have full control over the data. - Usage: This solution would be appropriate if you need to integrate Microsoft 365 data into a centralized data platform for reporting and analytics, and it fits scenarios where consent and full control by administrators are necessary. - Why selected: It provides a secure, compliant, and controlled way to access data across Microsoft 365 services for reporting purposes. B) Microsoft Graph API - Reasoning: The Microsoft Graph API is a comprehensive API that allows you to access and interact with data from various Microsoft services (like Office 365, Azure Active Directory, Teams, SharePoint, etc.). The Graph API can be used to query data, including employee details, roles, and permissions. While it provides great flexibility, you would still need to implement controls around data access and consent manually. This might involve extra development and security mechanisms to ensure administrators maintain control. - Usage: This is a suitable option for pro...

Author: Isabella · Last updated Aug 17, 2026

SNAPSHOT - You are a developer building a web site using a web app. The web site stores configuration data in Azure App Configuration. Access to Azure App Configuration has been configured to use the identity of the web app for authentication. Security requirements specify that no other authentication systems must be used. You need to load configuration data from Azure App Config...

Author: Isabella1 · Last updated Aug 17, 2026

SNAPSHOT - You are building an application that stores sensitive customer data in Azure Blob storage. The data must be encrypted with a key that is unique for each customer. If the encryption key has been corrupted it must not be used for encryption. You need to ensure that the blob is encrypted. How should you complete ...

Author: Layla · Last updated Aug 17, 2026

SNAPSHOT - You are developing a web application that uses the Microsoft Identity platform for user and resource authentication. The web application called several REST APIs. You are implementing various authentication and authorization flows for the web application. You need to validate the claims in the authentication token. ...

Author: CrystalWolfX · Last updated Aug 17, 2026

SNAPSHOT - You are developing a content management application for technical manuals. The application is deployed as an Azure Static Web app. Authenticated users can view pages under/manuals but only contributors can access the page /manuals/new.html. You need to configure the routing for the web app. How should you...

Author: CrimsonViperX · Last updated Aug 17, 2026

You are developing a web application that uses the Microsoft identity platform for user and resource authentication. The web application calls several REST APIs. A REST API call must read the user's calendar. The web application requires permission to send a...

To authorize the web application and allow it to call the APIs for reading the user's calendar and sending an email, you must provide specific permissions during the OAuth 2.0 authorization flow. Let's evaluate the options given: A) tet - Reasoning: This seems to be a typo or an invalid option. "tet" does not refer to any known OAuth 2.0 or Microsoft identity platform concept or parameter. Therefore, it cannot be the correct choice. - Usage: Invalid. B) code_challenge - Reasoning: The code_challenge parameter is used as part of the PKCE (Proof Key for Code Exchange) flow. It is designed to protect authorization code flows, especially in public client scenarios like mobile apps or single-page applications (SPAs). However, this is unrelated to the actual authorization scope or the permissions for the web application to access user resources. - Usage: This is used in public client scenarios for security but is not directly related to the specific permissions required for the web application to access the calendar and send emails. - Why rejected: It does not pertain to the OAuth scope or permissions for resource access. C) state - Reasoning: The state parameter is used to maintain state between the request and callback in the OAuth 2.0 authorization flow. It helps to mitigate CSRF (Cross-Site Request Forgery) attacks by associating the request with a unique identifier. While this is useful for security, it does not specify the permissions or scope required to read the calendar or send emails. - Usage: This is important for security, but it does not provide the specific API permissions for calendar or email actions. - Why reje...

Author: Aria · Last updated Aug 17, 2026

SNAPSHOT - You develop and deploy a web app to Azure App service. The web app allows users to authenticate by using social identity providers through the Azure B2C service. All user profile information is stored in Azure B2C. You must update the web app to display common user properties from Azure B2C to include the following information: * Email address * Job title * First name * Last name * Office location You need to implement t...

Author: Harper · Last updated Aug 17, 2026

SNAPSHOT - You develop and deploy the following staticwebapp.config.json file to the app_location value specified in the workflow file of an Azure Static Web app: For each of the following statements, select Yes if...

Author: Leo · Last updated Aug 17, 2026

You develop and deploy an Azure App Service web app named App1. You create a new Azure Key Vault named Vault1. You import several API keys, passwords, certificates, and cryptographic keys into Vault1. You need to grant App1 access to Vau...

To grant App1 access to Vault1 while ensuring that credentials are not stored in the code and can be automatically rotated, let’s analyze the provided options: A) Enable App Service authentication for App1. Assign a custom RBAC role to Vault1. - Reasoning: Enabling App Service authentication would authenticate users accessing the app (e.g., users or clients), not the web app itself to access resources like Azure Key Vault. While Role-Based Access Control (RBAC) can be used to control access to Key Vault, the custom RBAC role for Vault1 is not an ideal method here since Azure Key Vault access is better handled by managed identities rather than App Service authentication. - Usage: This option is more about securing user access to the app rather than giving the app itself secure access to the Key Vault. - Why rejected: It is unnecessary and less secure than using managed identities, which are specifically designed for secure resource access without requiring secrets in code. B) Add a TLS/SSL binding to App1. - Reasoning: Adding a TLS/SSL binding to App1 secures the communication between the client and the web app using HTTPS. This ensures that data in transit is encrypted, but it doesn’t address the core requirement, which is granting App1 access to the Key Vault to read secrets and rotate credentials automatically. - Usage: This is related to securing the transport layer but doesn't involve managing or securing credentials with Azure Key Vault. - Why rejected: This option does not help with the specific requirement of granting access to Azure Key Vault or credential management. C) Upload a self-signed client certificate to Vault1. Update App1 to use the client certificate. - Reasoning: While client certificates can be used for authentication, this solution would require manual ce...

Author: Noah Williams · Last updated Aug 17, 2026

You are developing a Java application to be deployed in Azure. The application stores sensitive data in Azure Cosmos DB. You need to configure Always Encrypted to encry...

To configure Always Encrypted for encrypting sensitive data inside a Java application deployed on Azure, the first step is to ensure that you have the necessary encryption keys in place. Let's break down each option and see which one fits the requirement. A) Create a new container to include an encryption policy with the JSON properties to be encrypted. - Why it's rejected: This option is related to creating containers and defining policies for JSON data in Azure Cosmos DB. It doesn't directly relate to configuring Always Encrypted in the context of encryption key management, which is the main concern for securing sensitive data in the application. - Relevant scenario: This option might be used when you're setting up Cosmos DB containers and need to define encryption policies at the container level, but it doesn't help with configuring Always Encrypted. B) Create a customer-managed key (CMK) and store the key in a new Azure Key Vault instance. - Why it's rejected: Although this option is relevant for key management, Always Encrypted doesn't directly require a customer-managed key in Azure Key Vault for Cosmos DB. Always Encrypted primarily relies on data encryption keys (DEKs), and these keys are stored within Cosmos DB, not in Azure Key Vault. - Relevant scenario: This option might be used if you're working with Azure SQL Database and need to configure Always Encrypted with a CMK, but it's not the right choice for Azure Cosmos DB. C) Create a data encryption key (DEK) by using the Azure Cosmos DB SDK and store the key in Azure Cosmos DB. - Why this i...

Author: Olivia · Last updated Aug 17, 2026

SNAPSHOT - You develop a web app that interacts with Azure Active Directory (Azure AD) groups by using Microsoft Graph. You build a web page that shows all Azure AD groups that are not of the type 'Unified'. You need to build the Microsoft Graph query for the page. How should you comp...

Author: Harper · Last updated Aug 17, 2026

DRAG DROP - You are developing an Azure solution. You need to develop code to access a secret stored in Azure Key Vault. How should you complete the code segment? To answer, drag the appropriate code segments to the correct location. Each code segment may be used once, more than once, or not at ...

Author: RadiantJaguar56 · Last updated Aug 17, 2026

SNAPSHOT - You are a developer building a web site using a web app. The web site stores configuration data in Azure App Configuration. Access to Azure App Configuration has been configured to use the identity of the web app for authentication. Security requirements specify that no other authentication systems must be used. You need to load configuration data from Azure App...

Author: Lucas Carter · Last updated Aug 17, 2026

You are developing several microservices to deploy to a new Azure Kubernetes Service cluster. The microservices manage data stored in Azure Cosmos DB and Azure Blob storage. The data is secured by using customer-managed keys stored in Azure Key Vault. You must automate key rotation for all Azure Key Vault keys and allow for manual key rotation. Keys must rotate every three months. Notifications of expiring keys must be sent before key expiry. You need to co...

To automate key rotation for all Azure Key Vault keys and enable notifications of expiring keys, the solution must ensure that key management is streamlined, automated, and allows manual intervention when necessary. Let's go over each option and explain the reasoning behind the selected options and the rejection of others. A) Create and configure a new Azure Event Grid instance. - Why it's rejected: While Azure Event Grid is useful for routing events to different services, it is not directly responsible for configuring key rotation or expiry notifications in Azure Key Vault. Event Grid can help trigger events, but it does not handle the automatic rotation or notification setup for keys in Key Vault. - Relevant scenario: Event Grid could be part of a broader solution where other components are listening for events, but it is not the most appropriate tool for key rotation or expiry notifications directly within Key Vault. B) Configure Azure Key Vault alerts. - Why this is selected: Azure Key Vault supports the configuration of alerts for specific events, such as expiring keys or keys nearing expiration. By setting up Key Vault alerts, you can configure notifications to be sent before the key expiry occurs, meeting the requirement for expiring key notifications. This would ensure that you receive timely reminders about expiring keys, allowing you to rotate or renew them before they expire. - Relevant scenario: This option is a direct fit for notifying users about expiring keys in Azure Key Vault, allowing you to manage the keys and ensure that the application remains functional without issues related to...

Author: Grace · Last updated Aug 17, 2026

You are developing a web application that uses the Microsoft identity platform to authenticate users and resources. The web application calls several REST APIs. The APIs require an access token from the Microsoft identity platform. You need to request a token. Which three prope...

To request an access token from the Microsoft identity platform, you need to configure your application to interact with Azure AD and ensure the authentication and authorization process works properly. The three properties that are essential for requesting an access token are: A) Redirect URI/URL - Explanation: The redirect URI (or redirect URL) is where the authentication response is sent after a user has authenticated. It is a required parameter for OAuth 2.0 and OpenID Connect flows in the Microsoft identity platform. It ensures that the user’s authentication response is correctly routed to the web application after login. - Reason for Selection: Without the redirect URI, the platform will not know where to send the token or authorization code. It is a fundamental part of securing the authentication flow. B) Application ID - Explanation: The application (client) ID is a unique identifier for your application in Azure Active Directory (Azure AD). This ID is required when the application makes a request for an access token because the Microsoft identity platform needs to know which application is requesting access. - Reason for Selection: The application ID is essential for identifying the app that is requesting the token. It ties your request to the registered app in Azure AD. E) Supported Account Type - Explanation: The supported account type defines which users or types of accounts are allowed to authenticate and use the application. This includes the following options: ...

Author: Scarlett · Last updated Aug 17, 2026

SNAPSHOT - You are developing an application that uses Azure Storage to store customer data. The data must only be decrypted by the customer and the customer must be provided a script to rotate keys. You need to provide a script to rotate keys to the customer. How should you complete...

Author: Chloe · Last updated Aug 17, 2026

You are developing several Azure API Management (APIM) hosted APIs. You must transform the APIs to hide private backend information and obscure the technology stack used to implement...

To protect APIs hosted in Azure API Management (APIM) and obscure private backend information, the goal is to transform and secure responses so that sensitive backend details, such as technology stack information, are not exposed to the API consumer. This requires the use of policies that can manipulate or filter the response data and headers. A) Configure and apply a new inbound policy scoped to a product - Explanation: Inbound policies are applied to requests before they reach the backend service. While you can use inbound policies to authenticate, validate, or transform incoming requests, it is not the most suitable choice for hiding backend information or obscuring the technology stack. Inbound policies primarily focus on securing incoming requests, not on transforming or hiding information in the response. - Reason for Rejection: This option is more about request validation, security, and transformation, but not about response obfuscation or hiding backend details. B) Configure and apply a new outbound policy scoped to the operation - Explanation: Outbound policies are applied to responses coming from the backend before they are sent to the client. You can use outbound policies to modify or filter the response content, which is the appropriate place to remove or obscure backend technology information. By applying outbound policies at the operation level, you can target specific APIs and manage the response for those APIs effectively. - Reason for Selection: This option allows you to directly manipulate the response and ensure that private backend details (e.g., headers, technology stack) are either removed or obfuscated. It's the...

Author: CrimsonViperX · Last updated Aug 17, 2026

SNAPSHOT - You are developing an Azure Function App named App1. You also plan to use cross-origin requests (CORS). You have the following requirements: * App1 functions must securely access an Azure Blob Storage account. * Access to the Azure Blob Storage account must not require the provisioning or rotation of secrets. * JavaScript code running in a browser on an external host must not be allowed to interact with the func...

Author: Liam · Last updated Aug 17, 2026

SNAPSHOT - You develop a containerized application. The application must be deployed to an existing Azure Kubernetes Service (AKS) cluster from an Azure Container Registry (ACR) instance. You use the Azure command-line interface (Azure CLI) to deploy the application image to AKS. Images must be pulled from the registry. You must be able to view all registries within the current Azure subscription. Authentication must be managed by Microsoft Entra ID and removed when the registry is deleted. The solution must use the principle of least privilege...

Author: Rahul · Last updated Aug 17, 2026

Case study - This is a case study. Case studies are not timed separately. You can use as much exam time as you would like to complete each case. However, there may be additional case studies and sections on this exam. You must manage your time to ensure that you are able to complete all questions included on this exam in the time provided. To answer the questions included in a case study, you will need to reference information that is provided in the case study. Case studies might contain exhibits and other resources that provide more information about the scenario that is described in the case study. Each question is independent of the other questions in this case study. At the end of this case study, a review screen will appear. This screen allows you to review your answers and to make changes before you move to the next section of the exam. After you begin a new section, you cannot return to this section. To start the case study - To display the first question in this case study, click the Next button. Use the buttons in the left pane to explore the content of the case study before you answer the questions. Clicking these buttons displays information such as business requirements, existing environment, and problem statements. When you are ready to answer a question, click the Question button to return to the question. Background - Munson's Pickles and ...

To implement farmer authentication as per the requirements of Munsons Pickles and Preserves Farm, we need to ensure that the authentication mechanism is set up using Microsoft Entra ID. The options provided are related to setting up the authentication for the farmers. Let's break down each option: A) Add the shared access signature (SAS) token to the app. - A Shared Access Signature (SAS) token is typically used to provide delegated access to Azure resources. However, this is not directly related to authentication using Microsoft Entra ID. SAS tokens are generally used for access to Azure Storage or for secure communication with services, not for user authentication. This option is not suitable for setting up user authentication via Microsoft Entra ID. B) Create a shared access signature (SAS) token. - Similar to option A, creating a SAS token is for securing access to Azure resources, not for authenticating users to applications. This does not address the farmer authentication requirement via Microsoft Entra ID. Therefore, this option is not suitable. C) Create a user flow. - A user flow in Microsoft Entra ID is a pre-built, configurable authentication experience for users. It can be used to manage authentication flows for users, such as sign-ups, sign-ins, or password resets. ...

Author: Amira · Last updated Aug 17, 2026

Case study - This is a case study. Case studies are not timed separately. You can use as much exam time as you would like to complete each case. However, there may be additional case studies and sections on this exam. You must manage your time to ensure that you are able to complete all questions included on this exam in the time provided. To answer the questions included in a case study, you will need to reference information that is provided in the case study. Case studies might contain exhibits and other resources that provide more information about the scenario that is described in the case study. Each question is independent of the other questions in this case study. At the end of this case study, a review screen will appear. This screen allows you to review your answers and to make changes before you move to the next section of the exam. After you begin a new section, you cannot return to this section. To start the case study - To display the first question in this case study, click the Next button. Use the buttons in the left pane to explore the content of the case study before you answer the questions. Clicking these buttons displays information such as business requirements, existing environment, and problem statements. When you are ready to answer a question, click the Question button to return to the question. Background - Munson's Pickles and ...

To secure the corporate website, we need to address several key security requirements outlined in the scenario: Key Security Requirements: 1. All web communications must be secured using TLS/HTTPS: This ensures that data is encrypted during transit. 2. Web content must be restricted by country/region: This ensures compliance with corporate standards. 3. The principle of least privilege: This is about securing access rights to services. 4. Managed identities for Azure resources must be used to authenticate services that support Microsoft Entra ID authentication: This ensures secure authentication for services without using credentials in code. Now, let's evaluate each option: A) Create an Azure Cache for Redis instance. Update the code to support the cache. - Azure Cache for Redis is a service used for improving performance by caching frequently accessed data. While this can help with performance optimization (e.g., faster webpage load times), it does not directly address security requirements, such as TLS/HTTPS or restricting web content by country/region. This option is not suitable for securing the website. B) Create an Azure Content Delivery Network profile and endpoint. Configure the endpoint. - Azure Content Delivery Network (CDN) improves the performance and speed of content delivery by caching content at edge locations closer to the user. While a CDN can help improve webpage load times, it is primarily focused on content delivery and performance. It does not directly address the security requirements like end-to-end TLS encryption, managed identities, or web content restriction by country/region. Therefore, this option is not sufficient...

Author: Madison · Last updated Aug 17, 2026

SNAPSHOT - Case study - This is a case study. Case studies are not timed separately. You can use as much exam time as you would like to complete each case. However, there may be additional case studies and sections on this exam. You must manage your time to ensure that you are able to complete all questions included on this exam in the time provided. To answer the questions included in a case study, you will need to reference information that is provided in the case study. Case studies might contain exhibits and other resources that provide more information about the scenario that is described in the case study. Each question is independent of the other questions in this case study. At the end of this case study, a review screen will appear. This screen allows you to review your answers and to make changes before you move to the next section of the exam. After you begin a new section, you cannot return to this section. To start the case study - To display the first question in this case study, click the Next button. Use the buttons in the left pane to explore the content of the case study before you answer the questions. Clicking these buttons displays information such as business requirements, existing environment, and problem statements. When you are ready to answer a question, click the Question button to return to the question. Background - M...

Author: CrystalWolfX · Last updated Aug 17, 2026

Case study - This is a case study. Case studies are not timed separately. You can use as much exam time as you would like to complete each case. However, there may be additional case studies and sections on this exam. You must manage your time to ensure that you are able to complete all questions included on this exam in the time provided. To answer the questions included in a case study, you will need to reference information that is provided in the case study. Case studies might contain exhibits and other resources that provide more information about the scenario that is described in the case study. Each question is independent of the other questions in this case study. At the end of this case study, a review screen will appear. This screen allows you to review your answers and to make changes before you move to the next section of the exam. After you begin a new section, you cannot return to this section. To start the case study - To display the first question in this case study, click the Next button. Use the buttons in the left pane to explore the content of the case study before you answer the questions. Clicking these buttons displays information such as business requirements, existing environment, and problem statements. When you are ready to answer a question, click the Question button to return to the question. Background - Munson's Pickles and ...

To configure site configuration settings for the corporate website, we need to take actions that meet the requirements mentioned in the case study. Here's the analysis of each option: A) Create a managed identity. - A managed identity is used to authenticate services securely without storing credentials in code. It's required for authentication when accessing Azure resources. However, this is more relevant for securing access to other Azure resources like databases or services, but the question specifically asks for configuring settings for the website. While creating a managed identity is useful in other scenarios (like for services that require access to Azure resources), it is not the primary action needed for configuring the website settings in this scenario. B) Update the role assignments for the Azure Key Vault. - Azure Key Vault is a service that stores secrets, certificates, and other sensitive data. While it is critical for securing sensitive information (which is part of the corporate website’s security requirement), this option pertains specifically to adjusting access control for the Key Vault, which doesn’t directly address the overall configuration settings for the website itself. C) Create an Azure App Configuration store. - This is the correct answer. Azure App Configuration is a service designed for central management of application settings and feature flags. It can be used to store and manage the configuration settings for the website, ensuring that settings are centrally stored and secured, as required by the case study. App Configuration supports encryption and can store non-sensitive settings like URLs, feature flags, etc. In this case, it als...

Author: CrystalWolfX · Last updated Aug 17, 2026

You are developing an application that uses keys stored in Azure Key Vault. You need to enforce a specific cryptographic algorithm and ke...

In this scenario, you need to enforce a specific cryptographic algorithm and key size for keys stored in Azure Key Vault. Let’s evaluate the available options: A) Secret versioning - Secret versioning in Azure Key Vault refers to keeping track of multiple versions of a secret. It allows you to manage different versions of secrets over time, but it does not control or enforce cryptographic algorithms or key sizes. Secret versioning is more about managing the lifecycle of secrets, and it doesn’t apply to setting specific key algorithms or sizes for encryption keys. - Rejected because it doesn’t apply to enforcing cryptographic standards for keys. B) Azure Policy - This is the correct answer. Azure Policy is used to enforce compliance with certain configurations, standards, or rules across Azure resources. Azure Policy can be used to define rules for Key Vault, such as enforcing the use of specific cryptographic algorithms or key sizes for keys stored in the vault. You can create a custom policy definition that requires the use of specific algorithms or key sizes, and apply that policy to your Key Vault. - Selected because Azure Pol...

Author: Sofia · Last updated Aug 17, 2026

SNAPSHOT - A company has an Azure storage static website with a custom domain name. The company informs you that unauthorized users from a different country/region are accessing the website. The company provides the following requirements for the static website: * Unauthorized users must not be able to access the website. * Users must be able to access the website using the HTTPS protocol. You need to i...

To meet the company's requirements of blocking unauthorized users from accessing the static website while ensuring that users can access the site using HTTPS, you need to consider the following options: Requirements: 1. Unauthorized users must not be able to access the website — This implies blocking access based on region or country. 2. Users must be able to access the website using the HTTPS protocol — This indicates enabling SSL/TLS encryption. Key Concepts: 1. Azure Storage Static Website: Azure Blob Storage allows hosting static websites. You can configure custom domains, HTTPS, and enforce security rules. 2. Geo-blocking: This is the method for restricting access based on the user's geographical location (country or region). 3. HTTPS: To secure traffic, HTTPS should be enforced via an SSL certificate. Options to Consider: 1. Enforce HTTPS (via Azure CDN or Azure Front Door) - To ensure HTTPS traffic, you need to enforce SSL/TLS encryption. Azure Front Door or Azure CDN can be used to enforce HTTPS by redirecting HTTP requests to HTTPS. - Azure Storage static websites by themselves can serve content over HTTPS if configured with a custom domain and SSL certificate. 2. Geo-blocking (via Azure Front Door or Azure CDN) - Azure Front Door and Azure CDN allow geo-blocking features where you can restrict access to the website based on geographic regions. - By enabli...

Author: Ava · Last updated Aug 17, 2026

DRAG DROP - Case study - This is a case study. Case studies are not timed separately. You can use as much exam time as you would like to complete each case. However, there may be additional case studies and sections on this exam. You must manage your time to ensure that you are able to complete all questions included on this exam in the time provided. To answer the questions included in a case study, you will need to reference information that is provided in the case study. Case studies might contain exhibits and other resources that provide more information about the scenario that is described in the case study. Each question is independent of the other questions in this case study. At the end of this case study, a review screen will appear. This screen allows you to review your answers and to make changes before you move to the next section of the exam. After you begin a new section, you cannot return to this section. To start the case study - To display the first question in this case study, click the Next button. Use the buttons in the left pane to explore the content of the case study before you answer the questions. Clicking these buttons displays information such as business requirements, existing environment, and problem statements. When you are ready to answer a question, click the Question button to return to the question. Background -...

To secure the corporate website for users and meet the requirements stated in the case study, we need to follow a systematic process of implementing security measures. Below is a detailed explanation of how to approach this and the steps to follow. Requirements for Securing the Corporate Website: - User Authentication: Allowing one-time passcode sign-in and social identity providers (Google or Facebook). - Secure Data Access: The Inventory Items API should securely access Azure Cosmos DB data. - Securing Credentials: Azure Cosmos DB credentials must be securely stored and not in clear text. - Image Upload: Ensuring image files are stored securely (JPEG format with EXIF data). Sequence of Actions: 1. Configure Authentication and Authorization: - Action: Integrate Microsoft Entra ID to support social identity providers (Google, Facebook) and one-time passcodes. - Reasoning: The requirement states that users need to sign in through social identity provider...

Author: William · Last updated Aug 17, 2026

You are developing a Microsoft Entra ID integrated app that interacts with Microsoft Graph. You must allow GET operations to receive unknown members that might be defined in the future in Microsoft Graph API. You plan to include support for evolvable enumerations in the app. You need to spec...

In this scenario, you need to support evolvable enumerations in a Microsoft Entra ID integrated app that interacts with Microsoft Graph. Evolvable enumerations allow future members to be included in API responses without breaking backward compatibility, ensuring that your application can handle unknown members that might be defined in the future. Analysis of the Options: 1. A) Accept: - The `Accept` header in HTTP is used to specify the desired response format, such as `application/json`. However, it is not related to enabling support for evolvable enumerations. This header simply tells the API what kind of response the client expects. - Rejected: `Accept` does not provide evolvable enumeration support. 2. B) Content-Type: - The `Content-Type` header is used in HTTP requests to indicate the type of data being sent (e.g., `application/json`). This header is used to describe the data format of the request body, but it is not involved in specifying evolvable enumeration support. - Rejected: `Content-Type` is for request body format, not for enabling evolvable enumerations. 3. C) If-Match: - The `If-Match` header...

Author: Emily · Last updated Aug 17, 2026

Case study - This is a case study. Case studies are not timed separately. You can use as much exam time as you would like to complete each case. However, there may be additional case studies and sections on this exam. You must manage your time to ensure that you are able to complete all questions included on this exam in the time provided. To answer the questions included in a case study, you will need to reference information that is provided in the case study. Case studies might contain exhibits and other resources that provide more information about the scenario that is described in the case study. Each question is independent of the other questions in this case study. At the end of this case study, a review screen will appear. This screen allows you to review your answers and to make changes before you move to the next section of the exam. After you begin a new section, you cannot return to this section. To start the case study - To display the first question in this case study, click the Next button. Use the buttons in the left pane to explore the content of the case study before you answer the questions. Clicking these buttons displays information such as business requirements, existing environment, and problem statements. When you are ready to answer a question, click the Question button to return to the question. Background - Fourth Coffee is a gl...

Author: Ming · Last updated Aug 17, 2026

You manage an Azure Key Vault named kv1 of Standard SKU. You plan to programmatically store in kv1 an asymmetric key pair and use the key pair for encryption and decryption. You must develop an application named app1 that will access the key pai...

To achieve the goal of retrieving an asymmetric key pair for encryption and decryption in Azure Key Vault, you must use an object that is specifically designed to handle keys. Here's the reasoning for each option: A) SecretClient - Reasoning: The `SecretClient` is used for managing secrets (such as passwords, connection strings, etc.) in Azure Key Vault. It allows you to store, retrieve, and manage secrets, but it does not support working with keys, which are required for encryption and decryption operations in this scenario. - Rejection: Since we need to work with asymmetric keys (not secrets), this object is not appropriate. B) KeyVaultSettingsClient - Reasoning: This client is part of a newer Azure SDK and is used for managing configuration settings related to Key Vault resources like soft delete settings, purge protection, and retention policies. It is not designed for key management. - Rejection: This client does not deal with the retrieval of keys or encryption/decryption operations, so it is not suitable for this scenario. C) CertificateClient - Reasoning...

Author: Ryan · Last updated Aug 17, 2026

You have 100 Azure virtual machines (VMs) with the system-assigned managed identity enabled. You need to identify the value of the object ID attri...

To identify the object ID attribute for each of the Azure virtual machine (VM) identities that have system-assigned managed identity enabled, we need to query the Azure Active Directory (Azure AD) service for the VM’s managed identity. The object ID is tied to the Azure AD service principal, which is associated with the system-assigned managed identity. Analyzing each option: 1. A) `az ad sp credential list`: - This command is used to list the credentials associated with service principals, but it does not directly help in identifying the object ID of a system-assigned managed identity for a VM. - Rejected: This is focused on credentials rather than the object ID of the managed identity. 2. B) `Get-AzVM`: - This PowerShell cmdlet retrieves information about Azure VMs, including their properties such as the managed identity. However, it does not directly return the object ID of the managed identity. - Rejected: While you can see the managed identity is enabled via `Get-AzVM`, this does not give ...

Author: Noah · Last updated Aug 17, 2026

You have 100 Azure virtual machines (VMs) with the system-assigned managed identity enabled. You need to identify the value of the object ID attri...

To identify the value of the object ID attribute for each of the Azure virtual machines (VMs) with a system-assigned managed identity, we need to query the Azure Active Directory (Azure AD) for the managed identities associated with the VMs. The object ID is an attribute of the Azure AD service principal that is associated with the system-assigned managed identity of the VMs. Let's analyze each of the provided options: 1. A) `Get-AzureADUser`: - This cmdlet retrieves information about Azure AD users. Since system-assigned managed identities for VMs are not considered regular Azure AD users but service principals, this command will not return the object ID of the system-assigned managed identity. - Rejected: This is not useful for querying managed identities because it's meant for Azure AD user objects, not service principals. 2. B) `Get-AzResource`: - The `Get-AzResource` cmdlet retrieves information about any Azure resource, including VMs, but it does not focus on fetching the object ID for the system-assigned managed identity. It can be used to get information on resources, but not the object ID of the managed identity directly. - Rejected: While `Get-AzResource` can query VMs, it does not specifically target the object ID of the mana...

Author: Aarav · Last updated Aug 17, 2026

SNAPSHOT - You are developing a web application that makes calls to the Microsoft Graph API. You register the application in the Azure portal and upload a valid X509 certificate. You create an appsettings.json file containing the certificate name, client identifier for the application, and the tenant identifier of the Microsoft Entra ID. You create a method named ReadCertificate to return the X509 certificate by name. You need to implement code that a...

To implement code that acquires a token using a certificate for your web application, you'll need to interact with the Microsoft Identity platform (Microsoft Entra ID) via the Microsoft Graph API. The primary goal is to authenticate and acquire a token by using the certificate that you uploaded to Azure AD when you registered the application. To answer the question, we need to look at how to interact with the Microsoft Identity platform using a certificate. Let's break down the required options and reasoning: Key Steps: 1. Acquiring a Token Using a Certificate: The most common way to authenticate using a certificate in an Azure AD context is via the `ConfidentialClientApplication` class from the Microsoft Authentication Library (MSAL). This approach allows your application to authenticate as a client (service principal) and acquire a token by using a certificate. 2. Using the Certificate for Authentication: The certificate is used to sign the request to acquire an OAuth token. You'll need to load the certificate from a specific location (using its name or thumbprint) and use it to authenticate. Analyzing the Code and Options: - Option 1: `ConfidentialClientApplicationBuilder`: The `ConfidentialClientApplicationBuilder` is used to create a confidential client application object that allows ...

Author: FrozenWolf2022 · Last updated Aug 17, 2026

You develop applications that integrate with a Microsoft Entra tenant. You plan to implement a permission classification in the tenant. You need to select permissions...

When selecting permissions for a permission classification in Microsoft Entra (formerly Azure Active Directory), you need to consider the type of access each permission grants and the required consent level (admin or user). Let’s evaluate each option based on these criteria: A) App-only access permissions that require admin consent - App-only access permissions allow an application to access resources without a signed-in user. These permissions are typically used for background services or automation tasks where user interaction is not required. Admin consent is required because these permissions grant broad access that could impact multiple users or organizational resources. This type of permission is usually granted by an administrator and is suitable for scenarios where an app needs to act independently, such as accessing data across multiple users or performing administrative tasks. This option is valid when you need to grant access at the application level without relying on user consent. It is typically used in scenarios involving automated processes, admin-level access to data, or other background services that require high-level permissions. B) Delegated permissions that require only user consent - Delegated permissions are permissions granted to an application on behalf of a user who is signed in. These permissions are tied to the specific user’s role and actions within the organization. User consent is typically sufficient for these permissions as they are granted based on the user’s scope of access. This is ideal for applications that need to perform actions on behalf of users and interact with the user's data (e.g., accessing a user's calendar or email). This option is valid for applications where the user's consent is needed to allow the app to act on behalf of that user. It is often used for personal appli...

Author: Michael · Last updated Aug 17, 2026

DRAG DROP - You have an Azure Virtual Machine (VM) named VM1 running Windows Server 2022 and an Azure Key Vault instance named kv1. You are developing a .NET application named App1 that you plan to deploy to VM1. You have the following requirements: * App1 will require access to kv1. * The identity used by App1 to access kv1 must be automatically deprovisioned when VM1 is deleted. You need to identify the procedure that will meet the ...

Author: FrostFalcon88 · Last updated Aug 17, 2026

DRAG DROP - You develop a web app that uses the tier D1 app service plan by using the Web Apps feature of Microsoft Azure App Service. Spikes in traffic have caused increases in page load times. You need to ensure that the web app automatically scales when CPU load is about 85 percent and minimize costs. Which four actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answ...

Author: Grace · Last updated Aug 17, 2026

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution. Determine whether the solution meets the stated goals. You are developing and deploying several ASP.NET web applications to Azure App Service. You plan to save session state information and HTML output. You must use a storage mechanism with the following requirements: * Share session state across all ASP.NET web applications. * Support controlled, concurrent access to the same session state ...

Solution Evaluation The scenario requires a solution for storing session state information and HTML output in a manner that meets the following key requirements: 1. Share session state across all ASP.NET web applications. 2. Support controlled, concurrent access to the same session state data for multiple readers and a single writer. 3. Save full HTTP responses for concurrent requests. Proposed Solution: Enable Application Request Routing (ARR) Application Request Routing (ARR) is a feature in Azure App Service that primarily facilitates load balancing and routing of requests across multiple instances of web applications. ARR can be useful for distributing requests to multiple backend servers and enabling session affinity (sticky sessions). It helps in directing the requests to the appropriate server, which is useful for web applications that need to maintain session state. However, based on the requirements of the scenario, enabling ARR alone does not fully address the goals of the solution for the following reasons: 1. Session State Sharing: ARR can ensure that a user's requests are consistently routed to the same instance (using session affinity), but it does not inherently provi...

Author: Sophia · Last updated Aug 17, 2026

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution. Determine whether the solution meets the stated goals. You are developing and deploying several ASP.NET web applications to Azure App Service. You plan to save session state information and HTML output. You must use a storage mechanism with the following requirements: * Share session state across all ASP.NET web applications. * Support controlled, concurrent access to the same session state data for multiple readers and...

Solution Evaluation The scenario requires a storage solution for session state information and HTML output with the following goals: 1. Share session state across all ASP.NET web applications. 2. Support controlled, concurrent access to the same session state data for multiple readers and a single writer. 3. Save full HTTP responses for concurrent requests. Proposed Solution: Deploy and configure an Azure Database for PostgreSQL and update the web applications. Azure Database for PostgreSQL is a managed relational database service that allows you to store data in a highly available and scalable manner. Relational databases, such as PostgreSQL, can store structured data and support complex queries. However, let’s analyze how this proposed solution aligns with the requirements. 1. Session State Sharing: - PostgreSQL can be used to share session state across multiple web applications by storing session data in a centralized database. However, it is typically not the most efficient method for storing session state compared to more optimized solutions like Azure Redis Cache. Redis is often preferred for session storage because it is designed for fast, in-memory storage, and it can support quick lookups and high throughput. 2. Controlled, Concurrent Access: - PostgreSQL supp...

Author: Elijah · Last updated Aug 17, 2026

SNAPSHOT - A company is developing a gaming platform. Users can join teams to play online and see leaderboards that include player statistics. The solution includes an entity named Team. You plan to implement an Azure Redis Cache instance to improve the efficiency of data operations for entities that rarely change. You need to invalidate the cache when team data is chan...

Author: FrozenWolf2022 · Last updated Aug 17, 2026

DRAG DROP - A company has multiple warehouses. Each warehouse contains IoT temperature devices which deliver temperature data to an Azure Service Bus queue. You need to send email alerts to facility supervisors immediately if the temperature at a warehouse goes above or below specified threshold temperatures. Which five actions should you perform in...

Author: Sofia · Last updated Aug 17, 2026

DRAG DROP - You develop an ASP.NET Core MVC application. You configure the application to track webpages and custom events. You need to identify trends in application usage. Which Azure Application Insights Usage Analysis features should you use? To answer, drag the appropriate features to the correct requirements. Each feature may be used once, more than once, o...

Author: Manish · Last updated Aug 17, 2026

You develop a gateway solution for a public facing news API. The news API back end is implemented as a RESTful service and uses an OpenAPI specification. You need to ensure that you can access the news API by usi...

Solution Evaluation The scenario requires us to ensure that we can access a news API (which is implemented as a RESTful service and uses an OpenAPI specification) through Azure API Management. Goal - You need to import the API definition (OpenAPI specification) into Azure API Management to expose it via an API Gateway. Let's evaluate each option: A) Import-AzureRmApiManagementApi -Context $ApiMgmtContext -SpecificationFormat "Swagger" -SpecificationPath $SwaggerPath -Path $Path - This command imports an API into Azure API Management by specifying the OpenAPI/Swagger specification (`SpecificationFormat "Swagger"`) and the path of the specification file (`$SwaggerPath`). - It is the correct command for this scenario, as it explicitly states that it works with a Swagger/OpenAPI definition, which is the format used by the news API backend. This is the method used to register an API in Azure API Management using a specification file. B) New-AzureRmApiManagementBackend -Context $ApiMgmtContext -Url $Url -Protocol http - This command is used to define a backend service for API Management, specifying the protocol and URL. - However, this command does not import...

Author: Max · Last updated Aug 17, 2026

You are creating a hazard notification system that has a single signaling server which triggers audio and visual alarms to start and stop. You implement Azure Service Bus to publish alarms. Each alarm controller uses Azure Service Bus to receive alarm signals as part of a transaction. Alarm events must be recorded for audit purposes. Each transaction record must include information about the alarm type that was activated. You nee...

Solution Evaluation In this scenario, you are tasked with implementing a reply trail auditing solution for a hazard notification system. The system uses Azure Service Bus to publish alarm signals, and you need to include audit trail information for each transaction record, ensuring that each transaction includes the alarm type and the ability to track the message flow (audit trail). Let’s break down the options: Key requirements: - Track the audit trail and relate it to the specific alarm type. - Ensure that relevant properties in the Azure Service Bus message are used to maintain a traceable audit trail. Breakdown of Options: A) Assign the value of the hazard message SessionID property to the ReplyToSessionId property. - Explanation: The `SessionId` property is typically used to group related messages that should be processed in a specific order. The `ReplyToSessionId` is used when the receiver sends a reply to the sender, and it refers to the `SessionId` of the original message. - Why it’s correct: This allows tracking of related messages as part of a conversation or session, providing an effective audit trail. By correlating the original session (alarm trigger) with its response (acknowledgement or action), you create a chain that can be audited. B) Assign the value of the hazard message MessageId property to the DeliveryCount property. - Explanation: The `DeliveryCount` property is used to track how many times a message has been delivered to the receiver. This is not related to auditing the trail of the message. - Why it’s incorrect: The `MessageId` represents a unique identifier for the message, whereas the `DeliveryCount` is a system property related to message retries. They do not serve the purpose of correlating or tracking an audit trail effectively. C) Assign the value of the hazard message SessionID property to the SequenceNumber property. - Explanation: The `SequenceNumber` is a system-assigned property that uniquely identifies the position of the message in the Service Bus queue or topic. It’s not something you would manually set for auditing. - W...

Author: Zain · Last updated Aug 17, 2026