Microsoft AI-200 Practice Exam Questions & Answers

To implement secure and maintainable secret management for Azure Function apps:

1. Configure Azure Key Vault for secret storage and rotation - Store database connection strings and credentials in Key Vault instead of configuration files or code. Enable automatic key rotation policies to support credential rotation without redeployment. Key Vault keeps secrets out of source control and enables secure, auditable secret management
2. Use Managed Identity for authentication - Configure the Function app with a system-assigned or user-assigned Managed Identity. The Function app uses this identity to authenticate to Key Vault, eliminating the need to store authentication credentials. Grant the identity appropriate RBAC permissions to read secrets from Key Vault

This approach ensures secrets are never exposed in source control, rotation happens without redeployment, and there's no downtime during credential updates since the Function app fetches updated values from Key Vault at runtime.

To implement secure access to Azure Key Vault for the API:

1. Use Managed Identity for authentication - Managed Identity (system-assigned or user-assigned) eliminates the need to store credentials in configuration files. The identity is managed by Azure and credentials are issued automatically
2. Create identities with minimal permissions - Use role-based access control (RBAC) to grant only the specific permission needed: 'Get' access to secrets. This minimizes blast radius if the identity is compromised

This combination ensures the API authenticates without stored credentials, operates with least-privilege access, and limits exposure in case of compromise. Avoid using connection strings or shared keys stored in configuration.

To implement a reply trail auditing solution for hazard notification system:

1. Publish messages to Service Bus topic with custom properties - Use a topic instead of queue to enable multiple subscriptions. Include alarm type and transaction information as message properties or in the message body. This ensures each alarm event contains necessary audit information
2. Use Service Bus subscriptions with audit message handlers - Create a dedicated audit subscription that processes messages independently. The audit handler records each message including alarm type and transaction details to an audit log or database. This separates audit concerns from alarm control logic

The topic-subscription pattern with dedicated audit handlers provides a clean audit trail. Each alarm event is captured with its type, and the transaction record is created separately, satisfying audit requirements without impacting alarm processing logic.

The question mentions configuring a connection string for a 'partner-facing service' but does not provide the available options or context about what type of service this is.

Generally, connection strings for partner-facing services could use:

• Azure Key Vault for secrets management
• Azure App Configuration for configuration management
• Connection string directly in environment variables (less secure)
• Managed Identity authentication (passwordless)

Please provide the answer choices to determine the most appropriate solution for your specific scenario.

To delay processing without incrementing the delivery count when an external API is unavailable:

Abandon the message (using AbandonAsync) - The Abandon action:

• Returns the message to the Service Bus queue without incrementing the delivery count
• Allows the message to be redelivered immediately or after a delay
• Preserves the delivery count, allowing the message to be retried up to the max delivery attempts
• Keeps the message accessible for reprocessing when the API becomes available

This differs from Complete (removes message) or DeadLetter (increments count). Abandon is ideal for temporary failures where you want to retry the same message later without penalty. Pair this with appropriate retry policies or schedule a delayed redelivery to check when the API recovers.

To handle dynamic configuration changes without application restart and reduce API requests:

1. Implement a configuration cache using IConfigurationRoot.Reload() - Call Reload() periodically or on-demand to refresh configuration from App Configuration into the application's configuration cache. This pulls updated settings efficiently without restarting the application
2. Use IOptionsMonitor<T> for dynamic reloading - IOptionsMonitor automatically detects configuration changes and provides updated values. Unlike IOptions, IOptionsMonitor doesn't require application restart and is designed specifically for dynamic configuration scenarios. Inject IOptionsMonitor<YourSettings> to access updated configuration values

Both approaches work together: IOptionsMonitor watches for changes and Reload() updates the cache. This ensures consistency across all 100 settings, handles dynamic updates without restart, and reduces requests by caching configuration locally rather than querying App Configuration for each access.