Free Microsoft AZ-200 Exam Practice Questions & Explanations
Prepared & Reviewed by the ValidExamDumps Editorial Team
At ValidExamDumps, we consistently monitor updates to the Microsoft AZ-200 exam questions by Microsoft. Whenever our team identifies changes in the exam questions, objectives, focus areas or requirements, We immediately update our exam questions for both PDF and online practice exams. This commitment ensures our customers always have access to the most current and accurate questions. By preparing with these up to date and 100% exam domain coverage questions, our customers can successfully pass the Microsoft Azure Developer Core Solutions exam on their first attempt without needing additional materials or study guides.
Other certification materials providers often include outdated or removed questions by Microsoft in their AZ-200 exam. These outdated questions lead to customers failing their Microsoft Azure Developer Core Solutions exam. In contrast, we ensure our questions bank includes only precise and up-to-date questions. Our main priority is your success in the Microsoft AZ-200 exam, not profiting from selling obsolete exam questions in PDF or Online Practice Test.
You must expose an internal line-of-business API, hosted in an App Service Environment, to partner developers. Requirements: partners authenticate with subscription keys, each partner is limited to 1,000 calls per minute, request and response payloads are transformed for older partners, and the backend must never be reachable directly from the internet.
Which Azure service should you select as the entry point?
API Management is purpose-built for API publishing: it issues subscription keys, applies rate-limit-by-key and quota policies, and performs request/response transformation policies such as XML/JSON conversion and header rewriting. Deploying it in internal VNet mode (available in Developer and Premium tiers) lets it reach the ASE privately and keeps the backend off the public internet.
Front Door (B) and Application Gateway (C) provide global/regional load balancing and WAF but have no subscription key model, per-subscriber quotas, or payload transformation. Traffic Manager (D) is DNS-level routing only and never sees the request payload.
A single-page application hosted at https://shop.contoso.com calls a REST API hosted in an Azure App Service web app at https://api.contoso.com. Browser requests fail with a cross-origin error. A developer states: "Configuring the CORS allowed origins list in the App Service CORS blade and also adding a custom Access-Control-Allow-Origin header in the application code is the recommended fix."
Is the developer's statement correct?
False. App Service CORS and application-level CORS must not both be used. When you add allowed origins in the App Service CORS configuration, the platform intercepts and answers CORS preflight requests, so any headers your application emits are ignored or produce duplicate Access-Control-Allow-Origin headers, which browsers reject. The correct approach is to configure CORS in one place only: either the App Service CORS settings or the application's own CORS middleware (which is required if you need fine-grained rules such as per-route policies or credentialed requests).
A retail web app runs on an Azure App Service Premium v3 plan. During a marketing campaign the team must deploy a new build with zero downtime, validate it against production configuration and connection strings, and be able to revert within seconds if error rates spike.
Which approach best meets these requirements?
Deployment slots on Standard and higher tiers allow a build to be deployed and warmed on a staging slot. Sticky (slot) settings stay with the slot while non-sticky settings move, so the staging slot can be validated with production configuration during the swap warm-up. The swap is a routing change, so there is no cold start for users, and a swap-back restores the previous version in seconds.
B causes downtime and redeployment takes minutes. C addresses capacity, not deployment risk. D relies on DNS TTL propagation and is far slower and more costly than a slot swap.
You are deploying an ASP.NET Core API to Azure App Service. The API must read a database connection string and an API key at startup. Security policy states that no credentials may appear in application settings, source control, or deployment pipelines, and that secret rotation must not require redeploying the app.
What should you implement?
A system-assigned managed identity removes the need for any bootstrap credential. Granting that identity get/list permission on secrets (via RBAC or an access policy) and using Key Vault references of the form @Microsoft.KeyVault(SecretUri=...) lets App Service resolve secrets at runtime; if you reference the secret without a version, rotation is picked up automatically without a redeploy.
B keeps secrets in source control and the decryption key must still live somewhere. C and D both store a credential (client secret or certificate) that itself must be protected and rotated, which the policy forbids.
Your company processes insurance claim images. Users upload images to Azure Blob Storage. Each upload must trigger a short, stateless piece of code that generates a thumbnail and writes it to a second container. Volume is unpredictable, ranging from zero to several thousand uploads per hour, and the finance team requires that you pay only for actual execution time.
Which compute solution should you select?
The workload is event-driven, short-running, stateless, and highly variable, which is the classic case for Azure Functions on the Consumption plan: billing is based on executions and GB-seconds, and the platform scales out automatically to zero and back. Using the Event Grid based Blob trigger gives near-immediate, reliable notification of new blobs rather than relying on log polling.
An App Service plan (B) is billed continuously whether or not work occurs and must be sized for peak. A VM Scale Set (C) requires you to build and patch the polling infrastructure and pay for running instances. Azure Batch (D) targets large-scale parallel batch jobs with fixed pools, and dedicated nodes incur cost while idle.