Microsoft · Free Practice Questions · Last reviewed May 2026
30real exam-style questions organised by domain, each with the correct answer highlighted and a plain-English explanation of why it's right — and why the others are wrong.
30% of exam · 6 sample questions below
You are implementing an Azure Durable Functions application that processes orders. The function must call three external APIs (payment gateway, inventory system, and shipping calculator) in parallel, then aggregate the results once all three have completed. Which Durable Functions pattern should you use?
Function chaining
Fan-out/Fan-in
This pattern is specifically designed for scenarios requiring parallel execution of multiple tasks followed by aggregation of their results. An orchestrator function initiates multiple activity functions concurrently (fan-out), often using Task.WhenAll in C# to asynchronously wait for all of them to complete. Once all parallel activities have finished, the orchestrator then collects and processes their individual outputs (fan-in) to produce a single, consolidated result. This perfectly matches the requirement for parallel API calls and subsequent data aggregation.
Monitor
Human interaction
A company uses Azure Functions with a consumption plan. The function processes messages from a queue. During peak hours, the function takes longer to execute, and some messages are processed twice. What is the most likely cause?
The function timeout is set too low.
The queue message visibility timeout is shorter than the function processing time.
When the queue message visibility timeout is shorter than the actual function processing time, the message becomes visible again in the queue before the initial function instance has successfully completed its work and deleted the message. This allows another available function instance, potentially on a different host, to pick up and process the exact same message. This concurrent processing of the same message by multiple instances is the direct cause of duplicate operations.
The function uses blob output binding incorrectly.
The function app is using a premium plan instead of consumption.
You are deploying a Node.js application to Azure Web Apps for Containers. The application needs to read configuration settings from Azure App Configuration. What is the recommended method to securely connect the app to the configuration store?
Store connection string in environment variables.
Use Key Vault references in App Settings.
Use managed identity.
Managed identities provide an Azure Active Directory identity for Azure resources, such as an Azure Web App for Containers. This allows the application to authenticate securely to other Azure services, like Azure App Configuration, without requiring any explicit credentials or connection strings to be stored in the application code or configuration. The Azure platform automatically manages the identity's lifecycle and authentication tokens, enabling secure, secret-less access based on assigned Azure RBAC roles.
Hardcode the connection string.
You are implementing an order processing system using Azure Durable Functions. The function must send notifications to multiple channels (email, SMS, push) in parallel and wait for all to complete before sending a confirmation. Which Durable Functions feature should you utilize?
Orchestration trigger with fan-out/fan-in pattern
The Orchestration trigger with a fan-out/fan-in pattern is the ideal choice for an order processing system. This pattern allows an orchestrator function to concurrently invoke multiple activity functions (e.g., inventory check, payment processing, shipping label generation) using `Task.WhenAll` to await their collective completion. After all parallel tasks finish, the orchestrator aggregates their results before proceeding, ensuring efficient and coordinated execution of complex, multi-step workflows.
Entity trigger
Activity trigger with retry policy
Timer trigger
You are deploying a sensitive configuration to Azure Container Instances. The configuration must be encrypted at rest and not visible in the container logs. What should you use?
Environment variables in the container group
Azure Key Vault with managed identity and secret volumes
Azure Key Vault provides a secure, centralized store for secrets, encrypting them at rest and in transit. A managed identity grants the Azure Container Instance (ACI) secure, authenticated access to Key Vault without needing hardcoded credentials. By mounting secrets as volumes, they are injected directly into the container's filesystem, making them accessible to the application while avoiding exposure in environment variables or logs, thus enhancing security posture.
Azure Files volume mounted into the container
ConfigMap in a Kubernetes cluster
A company deploys a web application to Azure App Service. They want to deploy a new version of the app with zero downtime and the ability to quickly roll back if needed. Which deployment feature should they use?
Auto-scaling
Deployment slots
Deployment slots in Azure App Service provide distinct environments for different versions of your application, such as staging and production. They allow you to deploy a new version to a non-production slot, warm it up, and then instantly swap it with the production slot, effectively achieving zero-downtime deployments. If issues arise post-swap, an immediate rollback to the previous production version is possible by swapping back, making them ideal for safe, continuous delivery.
Traffic Manager
Application Insights
Want more Develop Azure compute solutions practice?
Practice this domain19% of exam · 6 sample questions below
A company stores archival data in Azure Blob Storage. The data is accessed only a few times per year, and retrieval can take up to 15 hours. Which blob access tier minimizes storage costs while meeting these requirements?
Hot tier
Cool tier
Archive tier
Archive tier offers the lowest storage cost and supports retrieval within 1-15 hours, fitting the scenario.
Premium tier
You are building a serverless application that needs to react to insertions and updates in an Azure Cosmos DB container. You want to process these changes using an Azure Function. Which trigger should you configure for the function?
Cosmos DB trigger
The Azure Cosmos DB trigger is the native and most efficient mechanism for building serverless applications that react to changes in a Cosmos DB container. It directly leverages the built-in change feed functionality of Cosmos DB, which provides a persistent, ordered log of all document inserts, updates, and optionally deletes. This allows an Azure Function to process data modifications in near real-time without the need for inefficient polling, making it ideal for event-driven architectures.
Blob trigger
Event Grid trigger
Service Bus trigger
You are developing an application that writes logs to Azure Blob Storage. Each log entry is small (less than 1 KB) and you need to store millions of entries per day. You want to minimize storage costs and maximize write throughput. Which blob type should you use?
Block blobs with a high block size.
Append blobs.
Append blobs are specifically designed and optimized for append operations, making them ideal for logging scenarios where data is continuously added to the end of a file. Each append operation is atomic, ensuring data integrity even with concurrent writes. This sequential write pattern, without requiring knowledge of the total size or complex block management, provides high throughput and efficiency for log files that grow over time.
Page blobs.
Block blobs with a low block size.
You need to upload large files (up to 100 GB) to Azure Blob Storage from a web application. The upload must be resilient to network failures and support pausing/resuming. Which approach should you use?
Upload the blob as a single PUT operation.
Use block blob with multiple blocks and parallel upload.
Using block blobs with multiple blocks and parallel upload is the correct and recommended approach for uploading large files like 100 GB. This method involves breaking the large file into smaller, manageable blocks, which are then uploaded independently and potentially in parallel using `Put Block` operations. Once all blocks are successfully uploaded, a `Put Block List` operation commits them in the correct sequence to form the complete blob, providing robust resumability, retry capabilities, and significantly improved upload performance for very large files.
Use append blob.
Use AzCopy from the server.
You need to store millions of small log entries (each <1 KB) per day from an IoT device. The logs are rarely read. Which storage solution is most cost-effective?
Azure Blob Storage Block Blob
Azure Blob Storage Block Blobs are the ideal choice for storing millions of small, unstructured log entries due to their massive scalability, cost-effectiveness, and support for tiered storage. They are optimized for handling billions of objects, allowing for efficient ingestion and retrieval of 1KB log files. Lifecycle management policies can automatically move older logs to cooler tiers (Cool or Archive), significantly reducing long-term storage costs while maintaining data availability.
Azure SQL Database
Azure Table Storage
Azure Files
You are developing an application that writes log entries to Azure Blob Storage. Each log entry is approximately 500 bytes, and you expect to generate millions of entries per day. The logs are rarely read, and when they are read, you need to retrieve ranges of logs sequentially. Which blob type should you use to minimize storage costs and maximize write throughput?
Block blobs
Append blobs
Append blobs are purpose-built for append operations, making them the ideal choice for logging and other data streaming scenarios where new data is continuously added to the end of a file. They allow new blocks of data to be committed sequentially to the end of the blob without modifying existing content, ensuring high write throughput and low cost per write transaction. This design provides a robust and efficient mechanism for maintaining a chronological record of events.
Page blobs
Azure Files shares
Want more Develop for Azure storage practice?
Practice this domain19% of exam · 6 sample questions below
You have multiple Azure virtual machines that need to access the same Azure Key Vault to retrieve certificates. You want to minimize administrative overhead while ensuring each VM can authenticate without managing credentials. Which identity type should you use?
System-assigned managed identity on each VM
User-assigned managed identity assigned to each VM
A user-assigned managed identity is a standalone Azure resource that can be created once and then assigned to multiple Azure VMs. This approach centralizes identity management, as you only need to grant access permissions to the target resource, such as Azure Key Vault, to this single user-assigned identity. All assigned VMs can then leverage this identity, drastically reducing administrative overhead and simplifying permission management across your fleet of virtual machines.
Service principal with client secret stored in each VM
Storage account key
A developer accidentally deleted a secret from Azure Key Vault. Soft-delete is enabled with a retention period of 90 days. After 60 days, you attempt to recover the secret. What should you do?
Run the Azure CLI command: az keyvault secret recover
Azure Key Vault's soft-delete feature automatically retains deleted secrets for a configurable period, typically 90 days. During this retention window, the secret transitions to a soft-deleted state, not permanently removed from the Key Vault. The `az keyvault secret recover` command is specifically designed to restore a soft-deleted secret to an active state, making it accessible again, provided the retention period has not yet expired. This command directly addresses the scenario of an accidentally deleted secret.
Enable purge protection on the Key Vault first, then recover the secret.
Recover is not possible because the retention period of 90 days has not elapsed.
Run the Azure CLI command: az keyvault secret undelete
A company stores sensitive data in an Azure Storage account. They need to restrict access based on the client's IP address and require that clients use a valid SAS token. Which mechanism should they use?
Microsoft Entra ID authentication.
Shared Key.
SAS token with IP ACL.
A Shared Access Signature (SAS) token provides delegated access to Azure Storage resources with granular control over permissions, services, resource types, and validity period. Critically, a SAS token can include an `sip` (signed IP) parameter, which specifies an acceptable range of public IP addresses or a single IP address from which requests must originate. This ensures that even if the SAS token is intercepted, it can only be used by clients within the designated IP range, significantly enhancing security for specific, time-limited operations.
Firewall and virtual networks.
You are developing an application that stores user secrets. You need to ensure that the secrets are encrypted at rest and rotated automatically. Which Azure service should you integrate?
Azure Storage.
Azure Key Vault.
Azure Key Vault is purpose-built for the secure storage and management of cryptographic keys, secrets, and certificates. It provides robust protection for secrets using FIPS 140-2 Level 2 validated Hardware Security Modules (HSMs), offers fine-grained access control through Azure RBAC and Key Vault access policies, and supports automatic secret rotation, versioning, and comprehensive auditing. This dedicated design ensures the confidentiality and integrity of sensitive user secrets throughout their lifecycle.
Azure Security Center.
Microsoft Entra ID.
You have an Azure Function app that needs to retrieve a secret from Azure Key Vault at runtime. You want to avoid storing any credentials in code or configuration. Which mechanism should you use?
Service principal with client secret
Managed identity
Managed identities provide an automatically managed identity in Azure Active Directory for Azure services, including Function Apps. When enabled, the Function App can obtain an Azure AD token from the Azure Instance Metadata Service (IMDS) endpoint, which it then uses to authenticate to other Azure services like Azure Key Vault. This eliminates the need for developers to manage any credentials, as Azure handles the lifecycle of the identity and its authentication to Azure AD, making it the most secure and recommended approach for service-to-service authentication.
Access key
Shared access signature (SAS)
A developer deleted a secret from Azure Key Vault with soft-delete and purge protection enabled (retention 90 days). After 50 days, the secret is needed again. What is the correct recovery method?
Purge the secret and then restore from a backup
Recover the secret using Azure CLI 'az keyvault secret recover'
Azure Key Vault's soft-delete feature retains deleted secrets for a specified retention period, typically 90 days by default, making them recoverable. The `az keyvault secret recover` command is specifically designed to transition a soft-deleted secret back into an active state within this retention window. This command restores the secret with all its original properties, versions, and access policies, effectively reversing the deletion operation.
Recreate the secret with the same name
Use an Azure Resource Manager template to undelete the secret
Want more Implement Azure security practice?
Practice this domain24% of exam · 6 sample questions below
A retail system uses Azure Service Bus to process orders. Each order has multiple messages (e.g., payment, shipping, confirmation) that must be processed in sequence. You need to guarantee that all messages belonging to the same order are handled by the same consumer in order. Which Service Bus feature should you use?
Sessions
Azure Service Bus sessions are specifically designed to ensure strict FIFO (First-In, First-Out) ordering for messages belonging to the same logical group, identified by a unique session ID. When a consumer accepts a session, it exclusively locks that session, guaranteeing that all subsequent messages for that session ID are delivered to and processed by only that specific consumer. This mechanism is crucial for stateful processing where the order of operations within a transaction or user interaction must be preserved, making it the correct choice for maintaining order per group.
Scheduled messages
Dead-letter queue
Auto-forwarding
You manage an API in Azure API Management. You need to cache API responses such that different responses are returned based on the product subscription key used by the caller. Which set of policies should you implement?
Set a 'cache-lookup' policy in the inbound section and a 'cache-store' policy in the outbound section, using the subscription key as a cache vary-by parameter.
This configuration correctly implements response caching in Azure API Management. The 'cache-lookup' policy in the inbound section efficiently checks for a cached response before forwarding the request to the backend, optimizing performance. If no cached entry is found, the request proceeds, and upon receiving a successful response from the backend, the 'cache-store' policy in the outbound section saves this response for future requests. Using the subscription key as a 'vary-by' parameter ensures that different API consumers receive their specific cached data, maintaining data isolation and correctness.
Set a 'cache-store' policy in the inbound section and a 'cache-lookup' policy in the outbound section.
Set both 'cache-lookup' and 'cache-store' policies in the inbound section.
Set only a 'cache-store' policy in the backend section.
A company uses Azure Logic Apps to integrate with a third-party REST API. The API has a rate limit of 100 requests per minute. You need to ensure that the Logic App respects this limit. Which connector feature should you configure?
Retry policy.
Concurrency control.
Concurrency control in Azure Logic Apps allows developers to limit the number of workflow instances or loop iterations that can run simultaneously for a specific trigger or action. By setting a maximum concurrent run limit, the Logic App proactively throttles its own outbound requests, preventing it from overwhelming a downstream API. This mechanism directly helps in adhering to external service rate limits by controlling the rate of outgoing calls.
Swagger connector.
API Management.
You are building an API that needs to send notifications to multiple subscribers. Each subscriber has a different callback URL, and you need to ensure each notification is sent exactly once and retried on failure. Which Azure service should you use?
Azure Event Grid.
Azure Service Bus.
Correct. Service Bus topics with duplicate detection provide exactly-once delivery. Subscribers can receive messages and send them to callback URLs via custom handlers, and retries are handled automatically.
Azure Notification Hubs.
Azure Queue Storage.
You manage an API in Azure API Management. The API response varies depending on the caller's subscription key. You need to cache responses per subscription key to reduce backend load. Which policy configuration should you use?
Set cache key to include the subscription key
When API responses vary based on the caller's identity, such as a subscription, including the subscription key (e.g., using @(context.Subscription.Id)) in the cache key ensures that each unique subscriber receives their specific cached data. This policy prevents data leakage between subscriptions while still leveraging Azure API Management's caching capabilities to reduce backend load and improve response times for individual subscribers. It effectively creates isolated cache entries per subscription, providing personalized caching.
Use a global cache with no variation
Disable caching and rely on the backend
Use rate limiting policy
You have an order processing system using Azure Service Bus. Each order generates multiple messages that must be processed in order and by the same consumer. Which Service Bus feature ensures this?
Message sessions
Message sessions are the correct mechanism for guaranteeing ordered, first-in-first-out (FIFO) delivery of related messages and ensuring that all messages belonging to a specific session are processed by a single consumer. By assigning a unique SessionId to a group of messages, Azure Service Bus ensures that these messages are delivered sequentially and processed exclusively by one receiver, which is crucial for maintaining the logical order in an order processing system.
Topics and subscriptions
Dead-letter queues
Auto-forwarding
Want more Connect to and consume Azure services and third-party services practice?
Practice this domain8% of exam · 6 sample questions below
An e-commerce application emits a high volume of telemetry data to Azure Application Insights. You need to reduce the cost of data ingestion while preserving statistical accuracy for performance metrics. Which sampling technique should you use?
Adaptive sampling
Adaptive sampling in Application Insights automatically adjusts the sampling rate based on the volume of telemetry and a target maximum data ingestion rate. This dynamic adjustment ensures that a representative sample of data is collected during both low and high traffic periods, preventing excessive costs while maintaining sufficient data for accurate diagnostics and performance analysis. It intelligently reduces the sampling rate during spikes and increases it during lulls to meet the configured daily cap, preserving statistical validity.
Fixed-rate sampling with a 1% rate
Ingestion sampling
Head-based sampling
You need to monitor the real-time CPU utilization of an Azure virtual machine. Which Azure Monitor feature is designed for this purpose?
Metrics
Metrics provide real-time numerical values such as CPU usage, ideal for monitoring performance.
Logs
Alerts
Workbooks
You have an Azure App Service web app that experiences intermittent slowness. You enable Application Insights and notice that the "Failed Requests" metric is low, but "Server Response Time" is high for a subset of requests. You want to identify the specific code path causing the delay. Which feature should you use?
Live Metrics.
Snapshot Debugger.
Profiler.
Application Insights Profiler continuously collects performance traces from your live Azure App Service application, even when it's under load. It automatically identifies the "hot paths" in your code that consume the most time during web requests, database calls, or other operations. By visualizing the call stack and execution times for individual requests, the Profiler helps pinpoint the exact methods responsible for application slowness, enabling targeted optimization.
Availability tests.
An Azure Function processes events from Event Hubs. You need to monitor the number of events that were successfully processed and those that were dropped due to processing errors. Which approach should you use?
Custom metrics in Application Insights.
Custom metrics in Application Insights is the most appropriate solution because it allows developers to instrument their Azure Function code directly. By utilizing the Application Insights SDK, the function can explicitly send numerical data points, such as counts of successfully processed events or dropped events, to Application Insights. This provides real-time, granular visibility into the function's internal processing logic and operational health, enabling effective monitoring and alerting based on actual event outcomes.
Event Hubs metrics.
Stream Analytics job.
Log Analytics query on function logs.
Your e-commerce application sends telemetry to Application Insights. You need to reduce ingestion costs while preserving the ability to detect trends in performance metrics. Which sampling type should you configure?
Fixed-rate sampling
Adaptive sampling
Adaptive sampling dynamically adjusts the sampling rate based on the current telemetry volume and a configured target data ingestion rate. This intelligent approach ensures that the total volume of collected telemetry remains within a manageable budget, preventing excessive costs while still capturing a statistically representative dataset. By continuously monitoring and adapting, it effectively preserves the statistical accuracy needed for trend analysis and anomaly detection across varying application loads.
Ingestion sampling
Head-based sampling
You need to monitor the CPU utilization of an Azure VM in real-time and set up an alert when it exceeds 90%. Which Azure Monitor feature should you use?
Log Analytics Workspace
Metrics Explorer
Metrics Explorer, an integral part of Azure Monitor, is the dedicated tool for visualizing and analyzing platform metrics emitted by Azure resources, including VM CPU utilization. It provides near real-time data with minimal latency, enabling users to interactively chart metrics, apply aggregations, and directly create metric alerts based on specific thresholds. This capability directly addresses the requirement for real-time monitoring and setting alerts on VM CPU utilization with high responsiveness.
Application Insights
Azure Monitor for VMs
Want more Monitor, troubleshoot, and optimize Azure solutions practice?
Practice this domainThe AZ-204 exam has 50 questions and must be completed in 100 minutes. The passing score is 700/1000.
Scenario questions on developing Azure solutions covering compute, Blob storage, Cosmos DB, authentication, message-based services, and monitoring. Some questions are performance-based (PBQs), asking you to complete tasks in a simulated environment.
The exam covers 5 domains: Develop Azure compute solutions, Develop for Azure storage, Implement Azure security, Connect to and consume Azure services and third-party services, Monitor, troubleshoot, and optimize Azure solutions. Questions are weighted by domain — higher-weight domains appear more on your actual exam.
No. These are original exam-style practice questions written against the official Microsoft AZ-204 exam objectives. They are not copied from the real exam. Courseiva focuses on genuine understanding, not memorisation of braindumps.
Courseiva tracks your accuracy per domain and routes you toward weak areas automatically. Free, no account required.