AZ-204 Practice Test 11 — 15 Questions

Question 1

You are developing a .NET Core application that uploads large files (up to 50 GB) to Azure Blob Storage. The application must support resuming uploads that are interrupted due to network failures. Which approach should you use?

Accepted Answer

Use a block blob and upload blocks in parallel, then commit the block list.. Block blobs are designed for large files and support uploading blocks in parallel, which improves throughput and reliability. By uploading individual blocks and then committing the block list, you can resume an interrupted upload by re-uploading only the missing blocks, as each block is identified by a unique block ID. This approach is ideal for files up to 50 GB and aligns with Azure's recommended pattern for resumable uploads.

Answer

Use an append blob and append blocks in sequence.

Answer

Use the Put Blob API to upload the entire file in a single request.

Answer

Use a page blob and upload pages in sequence.

Question 2

Your team develops a containerized web app using Azure Kubernetes Service (AKS). You need to ensure that the application can automatically scale based on HTTP request load. Which Kubernetes resource should you configure?

Accepted Answer

HorizontalPodAutoscaler. The HorizontalPodAutoscaler (HPA) is the correct Kubernetes resource for automatically scaling the number of pod replicas based on observed CPU, memory, or custom metrics like HTTP request rate. In an AKS cluster, HPA adjusts the replica count of a Deployment or ReplicaSet to match the target metric, enabling the application to handle varying HTTP load without manual intervention.

Answer

VerticalPodAutoscaler

Answer

PodDisruptionBudget

Answer

NetworkPolicy

Question 3

Refer to the exhibit. You are analyzing the Azure Blob Storage service properties configured for a storage account. A web application hosted at https://www.contoso.com attempts to make a PUT request to a blob. The request fails with a CORS error. What is the most likely cause?

Accepted Answer

The request's Origin header does not match the allowed origin.. The CORS error occurs because the request's Origin header (https://www.contoso.com) does not match any allowed origin in the CORS rule. Azure Blob Storage enforces exact string matching for the Origin header against the allowed origins list; a mismatch causes the browser to block the PUT request. Since the question states the request fails with a CORS error and the exhibit shows allowed origins that do not include https://www.contoso.com, this is the most likely cause.

Answer

The request includes a header that is not in the allowed headers list.

Answer

The CORS rule does not include the DELETE method.

Answer

The exposedHeaders list does not include a required response header.

Question 4

Your application writes temperature data to Azure Table Storage every second. You have noticed that queries for the latest readings are slower than expected. What is the most likely cause?

Accepted Answer

The PartitionKey is not being used in the query filter.. In Azure Table Storage, queries that do not include the PartitionKey in the filter result in a full table scan, which is significantly slower than a point query that uses both PartitionKey and RowKey. Since the application writes data every second, the latest readings likely have a timestamp-based RowKey, but without filtering by PartitionKey, the query must scan all partitions, causing poor performance.

Answer

The storage account access tier is set to Cool.

Answer

The table name is too long.

Answer

The application is using an outdated version of the Azure Storage SDK.

Question 5

Refer to the exhibit. You are reviewing a role assignment for a managed identity. The JSON shows the role and scope. What access does this assignment grant?

Accepted Answer

Read, write, and delete access to blobs in container c1.. The role assignment grants the 'Storage Blob Data Contributor' role at the scope of container 'c1'. This role provides read, write, and delete access to blob data within that specific container, but not management operations on the storage account itself. Option C correctly identifies this level of access.

Answer

Full management access to the storage account.

Answer

Read access to all containers in the storage account.

Answer

Read-only access to blobs in container c1.

Question 6

Match each Azure security feature to its function.

Question 7

You are designing a solution that uses Azure Batch for parallel processing of large datasets. Each task requires significant CPU and memory. You need to minimize compute costs while ensuring tasks complete within a deadline. Which pool configuration should you use?

Accepted Answer

Low-priority VMs with a task retry policy. Low-priority VMs (now called Spot VMs) offer significant cost savings but can be preempted. Using them with a task retry policy ensures completion. Dedicated VMs are more expensive.

Answer

A mix of dedicated and low-priority VMs without retry

Answer

Use Azure Container Instances instead of Batch

Answer

Dedicated VMs only

Question 8

Your company uses Azure Logic Apps to automate a business process. The process needs to call an external REST API that requires an API key passed in the Authorization header. You need to store the API key securely and reference it in the Logic App. Which approach should you use?

Accepted Answer

Use an Azure Key Vault secret and a managed identity. Option B is correct because Azure Key Vault securely stores secrets like API keys, and using a managed identity allows the Logic App to authenticate to Key Vault without embedding credentials in code or configuration. This follows the principle of least privilege and eliminates the need to manage secrets in connection strings or parameter files.

Answer

Store the API key in the Logic App's definition as a constant

Answer

Hardcode the API key in a parameter file

Answer

Use an Azure Storage account table to store the key

Question 9

You are developing a serverless application using Azure Functions. The application processes orders from a queue and writes results to Azure Cosmos DB. You need to ensure that the function scales out automatically to handle sudden spikes in order volume. Which two actions should you take? (Choose two.)

Accepted Answer

Configure the function app to use the Premium plan with Always Ready instances enabled.. Option A is correct because the Premium plan supports Always Ready instances, which pre-warm a specified number of instances to eliminate cold start latency and ensure the function can handle sudden spikes in order volume without delay. This is critical for serverless applications that require consistent performance under load.

Answer

Use the Consumption plan with a max instance count of 200.

Answer

Implement a retry policy in the queue trigger to handle throttling.

Answer

Set the function's WEBSITE_MAX_DYNAMIC_APPLICATION_SCALE_OUT app setting to 500.

Question 10

You are deploying a web application to Azure App Service. The application needs to read configuration settings that vary by deployment environment (development, staging, production). You want to minimize application changes and leverage Azure services. What should you use?

Accepted Answer

Use Azure App Service application settings.. Azure App Service application settings are the correct choice because they are natively supported by the App Service platform, allowing you to define key-value pairs that are injected as environment variables at runtime. This approach requires no application code changes, as the settings are automatically available via standard configuration APIs (e.g., `Environment.GetEnvironmentVariable` in .NET or `process.env` in Node.js), and you can configure different values per deployment slot (e.g., development, staging, production) without redeploying the application.

Answer

Use Azure Key Vault secrets for configuration values.

Answer

Use Azure DevOps variable groups and inject them at build time.

Answer

Use Azure App Configuration with feature flags.

Question 11

You are designing a solution that uses Azure Container Instances (ACI) to run a batch job that processes images. The job is triggered by a message in Azure Queue Storage. Each image takes about 5 minutes to process. You need to ensure that the container runs only when there are messages in the queue and scales automatically. What should you use?

Accepted Answer

Use Azure Logic Apps with a Container Instances connector.. Option A is correct because Azure Logic Apps provides a serverless workflow that can be triggered by a queue message (via the Azure Queue Storage connector) and then use the Container Instances connector to start a container group. This ensures the container runs only when messages are present and scales automatically by creating a new container instance per message, matching the requirement for event-driven, on-demand execution without idle costs.

Answer

Use Azure Functions with a custom container and queue trigger.

Answer

Use Azure Batch to process the images in a pool of VMs.

Answer

Deploy the image processing job as a pod in Azure Kubernetes Service.

Question 12

You are developing an application that runs on Azure App Service. The application needs to store session state. The session state must be shared across multiple instances of the app and survive restarts. You need to choose a session state provider. What should you use?

Accepted Answer

Use Azure Redis Cache as a session state provider.. Azure Redis Cache provides a distributed, in-memory data store that can be shared across multiple instances of an App Service application and persists data through restarts. It is the recommended session state provider for Azure App Service when high availability and scalability are required, as it stores session data externally from the application's memory.

Answer

Use Azure Table Storage for session state.

Answer

Use a SQL Database to store session data.

Answer

Use the in-memory session state provider.

Question 13

You are deploying an Azure Functions app using ARM template. The exhibit shows a portion of the template. You notice that the AzureWebJobsStorage connection string includes the account key directly. What is the MOST important security concern?

Accepted Answer

The storage account key is exposed in the template, which could be compromised.. Option C is correct because embedding the storage account key directly in an ARM template exposes a long-lived secret in plaintext. If the template is stored in source control, shared, or logged, the key can be compromised, granting an attacker full access to the storage account. This violates the principle of least privilege and security best practices for infrastructure as code.

Answer

The FUNCTIONS_WORKER_RUNTIME is set to dotnet-isolated, which is outdated.

Answer

The storage account name is hardcoded in the connection string.

Answer

The connection string does not use HTTPS.

Question 14

You need to deploy a containerized application to Azure Container Instances (ACI) with a public IP address and DNS name label. The container must restart automatically if it exits unexpectedly. Which configuration should you use?

Accepted Answer

Set restart policy to Always and assign a DNS name label.. Option D is correct because setting the restart policy to Always ensures the container automatically restarts if it exits unexpectedly, which is the required behavior. Assigning a DNS name label to the container group makes it accessible via a public IP address and a fully qualified domain name (FQDN) in the format ..azurecontainer.io, meeting the requirement for a public IP address and DNS name label.

Answer

Deploy the container into an Azure Virtual Network.

Answer

Set restart policy to Never and configure a public IP.

Answer

Set restart policy to OnFailure and use a private IP address.

Question 15

You are deploying a containerized application to Azure Container Instances. The container image is stored in a private Azure Container Registry (ACR). You need to ensure that ACI can pull the image without storing credentials in the container group definition. What should you use?

Accepted Answer

Enable managed identity for the container group and assign the AcrPull role.. Option D is correct because managed identity (system-assigned or user-assigned) allows ACI to authenticate to ACR without storing credentials, by granting the identity 'AcrPull' role. Option A is wrong because admin account requires username/password in the configuration. Option B is wrong because SAS tokens are not supported for ACR authentication in ACI. Option C is wrong because service principal requires storing credentials in the container group.

Answer

Generate a SAS token for the ACR and use it in the image registry credential.

Answer

Create a service principal with AcrPull role and pass its credentials.

Answer

Use the ACR admin account and provide the credentials in the container group.