Microsoft AI-200 Exam Dumps

The question mentions configuring a connection string for a 'partner-facing service' but does not provide the available options or context about what type of service this is.

Generally, connection strings for partner-facing services could use:

• Azure Key Vault for secrets management
• Azure App Configuration for configuration management
• Connection string directly in environment variables (less secure)
• Managed Identity authentication (passwordless)

Please provide the answer choices to determine the most appropriate solution for your specific scenario.

The correct answer is to store secrets in Azure Key Vault and configure App Service managed identity to retrieve them at runtime. This approach provides automatic secret rotation support, secure retrieval without storing secrets in the image, and audit logging of secret access.

Base64 encoding is not encryption and does not protect secrets. Storing secrets in ACR configuration files exposes them in the repository and makes rotation difficult. Passing secrets as command-line arguments makes them visible in process listings and deployment logs, violating security best practices.

The correct answer leverages the purpose-built Azure services: Key Vault for secrets with rotation support and audit logging, App Configuration for centralized settings management with dynamic updates, and managed identities to avoid storing credentials in the application. Option B embeds secrets in images, violating security best practices and preventing secret rotation without redeployment. Option C uses App Service settings (static) and manual updates, lacking dynamic configuration capability and proper secret isolation. Option D misuses Storage accounts (not designed for secret management) and SAS tokens (credentials that must still be rotated), and adds unnecessary middleware complexity.

The correct answer identifies the proper Service Bus pattern: configuring a DLQ with a max delivery count threshold ensures failed messages (after retries) are automatically moved to the DLQ, where a separate function can process them for logging, alerting, and reprocessing. Option B conflates Event Grid with Service Bus failure handling; Event Grid is for event distribution, not dead-letter processing. Option C avoids the core requirement of capturing and investigating failures. Option D unnecessarily decouples the message queue from the storage layer and adds complexity without leveraging Service Bus's built-in failure handling mechanisms.

This solution does not meet the goal. Here's why:

• System Topic Limitation: System topics are automatically created by Azure for built-in Azure resources (such as Storage Accounts, Service Bus, Event Hubs, etc.). They cannot be used for publishing custom application-generated events. System topics are read-only from the application's perspective and are meant to consume events from Azure services, not to publish custom events to customers.
• Custom Events Cannot Be Published: You cannot publish arbitrary application events to a system topic. System topics only relay events that originate from the specific Azure resource they represent.
• Hundreds of Event Types Issue: While system topics do support event filtering, they cannot fulfill the requirement to publish hundreds of various custom event types, as they are limited to the event types generated by their corresponding Azure service.
• Correct Approach: For this scenario, you would need to use a custom topic instead, which allows you to publish any event type and create subscriptions per customer with appropriate filtering.

System topics are designed for consuming events from Azure services, not for publishing custom application events to customers.