Download Microsoft.AZ-400.Dump4Pass.2024-02-12.228q.vcex

Note: PAT Supported only on Azure Pipelines and TFS 2017 and newer. After you choose PAT, paste the PAT token you created into the command prompt window. Use a personal access token (PAT) if your Azure DevOps Server or TFS instance and the agent machine are not in a trusted domain. PAT authentication is handled by your Azure DevOps Server or TFS instance instead of the domain controller.    Reference: https://docs.microsoft.com/en-us/azure/devops/pipelines/agents/v2-linux

Register your application to use Azure Active Directory. Registering the application means that your developers can use Azure AD to authenticate users and request access to user resources such as email, calendar, and documents.    Reference: https://docs.microsoft.com/en-us/azure/active-directory/manage-apps/developer-guidance-for-integrating-applications

Personal access tokens (PATs) give you access to Azure DevOps and Team Foundation Server (TFS), without using your username and password directly.  These tokens have an expiration date from when they're created. You can restrict the scope of the data they can access. Use PATs to authenticate if you don't already have SSH keys set up on your system or if you need to restrict the permissions that are granted by the credential.    Incorrect Answers: B: Azure DevOps no longer supports Alternate Credentials authentication since the beginning of March 2, 2020. If you're still using Alternate Credentials, we [Microsoft] strongly encourage you to switch to a more secure authentication method (for example, personal access tokens).    Reference: https://docs.microsoft.com/en-us/azure/devops/repos/git/auth-overview

1. In Azure portal navigate to the az400-9940427-main app.  2. Scroll down to the Settings group in the left navigation.  3. Select Managed identity.  4. Within the System assigned tab, switch Status to On. Click Save.              Reference: https://docs.microsoft.com/en-us/azure/app-service/overview-managed-identity

Application data plane permissions: Keys: sign Secrets: get   Reference: https://docs.microsoft.com/en-us/azure/key-vault/key-vault-secure-your-key-vault

Box 1: A key Vault advanced access policy             Box 2: RBAC Management plane access control uses RBAC.  The management plane consists of operations that affect the key vault itself, such as:   Creating or deleting a key vault.   Getting a list of vaults in a subscription.  Retrieving Key Vault properties (such as SKU and tags).  Setting Key Vault access policies that control user and application access to keys and secrets.    Reference: https://docs.microsoft.com/en-us/azure/azure-resource-manager/resource-manager-tutorial-use-key-vault

When you need to pass a secure value (like a password) as a parameter during deployment, you can retrieve the value from an Azure Key Vault. You retrieve the value by referencing the key vault and secret in your parameter file. The value is never exposed because you only reference its key vault ID. The key vault can exist in a different subscription than the resource group you are deploying to.    Reference: https://docs.microsoft.com/en-us/azure/azure-resource-manager/resource-manager-keyvault-parameter

With the storage account ready, you can configure backs up in the web app or App Service.  1. Open the App Service az400-11566895-main, which you want to protect, in the Azure Portal and browse to Settings > Backups. Click Configure and a Backup  Configuration blade should appear.  2. Select the storage account.  3. Click + to create a private container. You could name this container after the web app or App Service.  4. Select the container.  5. If you want to schedule backups, then set Scheduled Backup to On and configure a schedule: every five hours 6. Select your retention. Note that 0 means never delete backups.  7. Decide if at least one backup should always be retained.  8. Choose if any connected databases should be included in the web app backup.  9. Click Save to finalize the backup configuration.            Reference: https://petri.com/backing-azure-app-service

You can use a system-assigned managed identity for a Windows virtual machine (VM) to access Azure Key Vault.    1. Sign in to Azure portal  2. Locate virtual machine VM1.  3. Select Identity  4. Enable the system-assigned identity for VM1 by setting the Status to On.            Note: Enabling a system-assigned managed identity is a one-click experience. You can either enable it during the creation of a VM or in the properties of an existing VM.    Reference: https://docs.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/tutorial-windows-vm-access-nonaad

Step 1: Create an AKS cluster   Step 2: a system-assigned managed identity To create an RBAC binding, you first need to get the Azure AD Object ID.  1. Sign in to the Azure portal.  2. In the search field at the top of the page, enter Azure Active Directory.  3. Click Enter.  4. In the Manage menu, select Users.  5. In the name field, search for your account.  6. In the Name column, select the link to your account.  7. In the Identity section, copy the Object ID.            Step 3: a RBAC binding Reference:   https://docs.microsoft.com/en-us/azure/developer/ansible/aks-configure-rbac