Module assessment

1.

Contoso replaces its Azure application host during deployments. The application needs an identity that retains its role assignments across host replacements without storing credentials. Which approach meets this requirement?

Enable a system-assigned identity on each replacement host and treat it as the same principal.

Configure each replacement host to use the developer's signed-in identity as its production credential.

Attach the same user-assigned identity to each replacement host and select it explicitly in application credentials.

2.

Every consumer of a Cosmos DB account's read-only key pair uses primary, and secondary is confirmed unused. Which routine rotation sequence maintains access while replacing both key values?

Regenerate secondary, validate it, switch and verify every consumer, then regenerate primary and secure its replacement.

Regenerate primary, update the vault secret, verify every consumer, then regenerate secondary and secure its replacement.

Regenerate secondary, update the vault secret, regenerate primary, then verify that all consumers reload the secret.

3.

An application's managed identity needs to read items and run queries only in the cosmicworks product container. It has no data-plane role assignments. Which assignment supplies the required access at the narrowest supported scope?

Assign Cosmos DB Built-in Data Contributor at /dbs/cosmicworks scope.

Assign Cosmos DB Built-in Data Reader at account scope.

Assign Cosmos DB Built-in Data Reader at /dbs/cosmicworks/colls/product scope.

4.

Contoso requires its application to access Cosmos DB through private addresses and reject public access. Which configuration meets both requirements?

Enable a service endpoint on the application subnet, allow that subnet, and remove public IP exceptions.

Approve a private endpoint, configure private DNS and connectivity, and explicitly disable public network access.

Approve a private endpoint, configure private DNS and connectivity, and retain the existing public IP exceptions.

5.

To read original customer values from a container with dynamic data masking, a review service uses a managed identity. It needs read and query access without permission to change items. Which role design fits this requirement?

Assign a custom role with Reader's actions plus items/unmask at the customer container scope.

Assign the built-in Data Contributor role with its item wildcard at the customer container scope.

Assign the built-in Data Reader role with its unchanged actions at the customer container scope.

Check your knowledge

Feedback