AZ-204 Practice Test 12 — 15 Questions

Question 1

You are developing a mobile app that uses Azure Cognitive Services to analyze images. The app must authenticate to the Computer Vision API using a key that is rotated monthly. What is the best practice for handling the key?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Store the key in Azure App Configuration with Key Vault references and retrieve it at runtime. Azure App Configuration with Key Vault references provides a secure, centralized way to store and rotate secrets like API keys without embedding them in code or requiring redeployment. A secure backend service (e.g., an Azure Function or App Service) that the mobile app interacts with would retrieve the key at runtime via a managed identity, ensuring the key is never stored locally on the mobile device and can be rotated monthly by updating Key Vault, with App Configuration automatically fetching the latest version. The mobile app would then call this backend service, which in turn authenticates to Cognitive Services.

Answer

Use a system-assigned managed identity and acquire a token for Cognitive Services

Answer

Prompt the user to enter the key on first launch

Answer

Store the key in the mobile app's local secure storage after initial retrieval

Question 2

An API receives JWT access tokens from Microsoft Entra ID. Which two token properties should the API validate before accepting a request?

Accepted Answer

Issuer and signature are valid for the trusted tenant. The API must validate the token's issuer (iss) claim to ensure it matches the trusted Microsoft Entra ID tenant's issuer URL, confirming the token's origin. It must also verify the token's cryptographic signature to ensure it hasn't been tampered with. Additionally, the API must validate the token's audience (aud) claim, ensuring it matches the API's own Application ID URI or client ID, which confirms the token was intended for this specific API.

Answer

The user's display name is present

Answer

The token was sent in a query string

Question 3

Match each Azure monitoring tool to its purpose.

Accepted Answer

Azure Monitor: Collects, analyzes, and acts on telemetry data from Azure and on-premises environments.. Azure Monitor is the main service for telemetry collection and analysis. Application Insights focuses on application performance. Log Analytics is the query workspace for logs. Azure Advisor provides optimization recommendations. The distractors swap these definitions.

Answer

Application Insights: Workspace for querying and analyzing log data from various sources.

Answer

Azure Monitor: Provides personalized recommendations to optimize Azure resources for cost, security, reliability, and performance.

Question 4

You are developing a web application that allows users to upload profile pictures to Azure Blob Storage. The application generates thumbnails using an Azure Function that is triggered by blob creation. You need to ensure that the function only processes image files and ignores other file types. What should you do?

Accepted Answer

Set the trigger's 'source' parameter to 'EventGrid' and filter events by the 'content-type' property.. Both options A and C are valid methods to ensure the Azure Function only processes image files. Option A uses an Event Grid trigger with filtering on the 'content-type' property, which allows the function to only run for blobs with image content types. Option C checks the content type inside the function and ignores non-image blobs, which also works but runs the function for all blobs. Option B is incorrect because blob triggers do not have a 'filter' property for extensions. Option D is incorrect because the blob trigger's path pattern does not filter by extension; the function triggers for any blob in the container regardless of the file extension.

Answer

Set the trigger's 'filter' property to '*.jpg,*.png'.

Answer

Use the blob trigger with a path pattern like 'images/{name}.jpg' and 'images/{name}.png' and use the extension binding to filter.

Question 5

You are monitoring an Azure Web App with Application Insights. You notice that certain requests have high server response times. You need to identify which specific database queries are causing the delays. Which Application Insights feature should you use?

Accepted Answer

Application Insights Profiler. Application Insights Profiler is the correct feature because it provides detailed, code-level diagnostics for requests with high server response times, including per-operation breakdowns of database query durations. It captures execution traces that show exactly which SQL queries or external calls are contributing to latency, enabling you to pinpoint the specific database queries causing delays.

Answer

Live Metrics Stream

Answer

Performance blade

Answer

Application Map

Question 6

Application Insights ingestion cost is rising because a high-traffic app emits large telemetry volume. The team needs statistically useful telemetry while reducing ingestion. What should be configured?

Accepted Answer

Adaptive sampling. Adaptive sampling in Application Insights automatically reduces the volume of telemetry data sent from high-traffic apps by intelligently selecting a representative subset of events. This preserves statistical utility for analysis while significantly lowering ingestion costs, making it the ideal solution for the described scenario.

Answer

Move the app to a larger App Service plan

Answer

Disable all exception telemetry

Answer

Increase log verbosity to debug

Question 7

You are creating an Azure Functions app that uses a Blob Storage trigger to process new files. The function must process files only when they are completely written (i.e., no ongoing writes). You need to avoid processing partially written files. Which TWO configurations should you consider?

Accepted Answer

Check the blob's 'LastModified' timestamp in the function code to verify no recent changes.. Checking the blob's 'LastModified' timestamp in the function code allows you to verify that no recent writes have occurred. By comparing the timestamp to the current time and adding a delay, you can ensure the file is complete before processing. Option C is correct because a timer-triggered function can periodically list blobs and check for a stable size (unchanged over a period) to determine if the blob is fully written. This avoids the trigger firing on partially written files. Options D and E are incorrect because 'LeaseBlob' and 'ScanBlob' are not valid properties of the Azure Functions Blob trigger binding. The recommended approach is to manually acquire a lease inside the function code, which is not explicitly listed as an option here.

Answer

Increase the 'BatchSize' to reduce the frequency of trigger evaluations.

Answer

Use the 'BlobTrigger' with the 'LeaseBlob' property set to 'True'.

Answer

Set the 'ScanBlob' property to 'True' in the trigger binding.

Question 8

You are using Azure Logic Apps to integrate with a third-party CRM. The CRM API requires OAuth 2.0 authentication with a client secret. The secret must be stored securely and rotated automatically. What should you do?

Accepted Answer

Store the secret in Azure Key Vault and use a managed identity to access it. The CRM API requires OAuth 2.0 with a client secret, so the secret must be stored securely and support automatic rotation. Azure Key Vault is the appropriate service for storing secrets, and using a managed identity allows secure access without hardcoding credentials. Option A is incorrect because a managed identity alone does not store the secret; the secret must be kept in a vault. Option C is wrong because storing secrets directly in a Logic App definition is insecure and does not support rotation. Option D is wrong because Azure App Configuration is designed for application settings, not secrets; it lacks automatic secret rotation capabilities.

Answer

Use a system-assigned managed identity without storing the secret

Answer

Store the secret in the Logic App definition as a string parameter

Answer

Store the secret in Azure App Configuration with encryption

Question 9

You deploy the above ARM template resource for a web app. The web app reads the connection string from the 'DefaultConnection' name. However, the web app fails to connect to the database with an error 'Login failed for user 'myuser'. What is the most likely cause?

Accepted Answer

The SQL server is configured to use Microsoft Entra authentication only, not SQL authentication.. The login failure indicates that the SQL server does not accept SQL authentication. If the server is configured for Microsoft Entra authentication only, then SQL login credentials (username/password) will fail. Option A is incorrect because the user ID may exist but authentication method is wrong. Option B is incorrect because 'SQLAzure' is the correct connection string type for Azure SQL Database. Option D is incorrect because 'Trusted_Connection=True' is for Windows authentication, not applicable to Azure SQL.

Answer

The user ID does not have access to the database.

Answer

The connection string type should be 'SQLServer' instead of 'SQLAzure'.

Answer

The connection string is missing 'Trusted_Connection=True;'.

Question 10

Refer to the exhibit. You are deploying an API in Azure API Management using an ARM template. The API is configured to use OAuth 2.0 authentication. The deployment fails with a validation error. What is the most likely cause?

Accepted Answer

The authorization server 'auth-server-1' is not defined in the template.. When an API in Azure API Management is configured to use OAuth 2.0 authentication, the ARM template must include a corresponding authorization server resource (type 'Microsoft.ApiManagement/service/authorizationServers') that defines the OAuth 2.0 provider. The API's authenticationSettings reference this authorization server by name, and if that server is not defined in the template, the deployment fails with a validation error indicating a missing dependency or undefined resource.

Answer

The serviceUrl is not a valid URL.

Answer

The dependsOn array uses resourceId incorrectly.

Answer

The protocols array does not include http.

Question 11

Your application uses Azure Key Vault to store secrets. You need to ensure that the application can access secrets without storing any credentials in the application code or configuration files. What should you use?

Accepted Answer

Azure Managed Identity. Azure Managed Identity enables Azure resources (such as App Service, Functions, or VMs) to authenticate to Azure Key Vault without storing any credentials in code or configuration files. This is the recommended approach for secure access. Option A is correct. Option B is incorrect because Key Vault access policies control permissions but do not eliminate the need for authentication credentials. Option C is incorrect because a connection string inherently includes credentials, violating the requirement. Option D is incorrect because a client certificate still requires storing and managing the certificate, which introduces credential management overhead.

Answer

Key Vault access policies

Answer

A connection string with the secret

Answer

A client certificate stored in the application

Question 12

Your web app hosted on Azure App Service needs to consume an external SaaS API that requires an API key. The key must be stored securely and rotated without redeploying the app. What is the best approach?

Accepted Answer

Store the API key in Azure Key Vault and use a managed identity to retrieve it.. Azure Key Vault is specifically designed for securely storing and managing secrets, keys, and certificates. Using a Managed Identity for the App Service allows it to authenticate to Key Vault without needing any secrets (like connection strings or client IDs/secrets) stored within the App Service itself, adhering to the principle of least privilege. Secrets in Key Vault can be rotated independently, and the application can be designed to retrieve the latest version without redeployment, satisfying all requirements. This approach provides the highest level of security, auditability, and adherence to Azure best practices for secret management.

Answer

Store the API key in Azure SQL Database and query it at startup.

Answer

Store the API key in a configuration file in the application code.

Answer

Store the API key in an App Service application setting.

Question 13

Refer to the exhibit. You are analyzing the Azure Blob Storage service properties configured for a storage account. A web application hosted at https://www.contoso.com attempts to make a PUT request to a blob. The request fails with a CORS error. What is the most likely cause?

Accepted Answer

The request's Origin header does not match the allowed origin.. The CORS error occurs because the request's Origin header (https://www.contoso.com) does not match any allowed origin in the CORS rule. Azure Blob Storage enforces exact string matching for the Origin header against the allowed origins list; a mismatch causes the browser to block the PUT request. Since the question states the request fails with a CORS error and the exhibit shows allowed origins that do not include https://www.contoso.com, this is the most likely cause.

Answer

The request includes a header that is not in the allowed headers list.

Answer

The CORS rule does not include the DELETE method.

Answer

The exposedHeaders list does not include a required response header.

Question 14

Refer to the exhibit. The exhibit shows an Azure Event Grid subscription configuration. You notice that the webhook endpoint is not receiving events when a .png file is uploaded to the 'images' container. What is the most likely reason?

Accepted Answer

The subject filter excludes .png files. The exhibit shows an Event Grid subscription with a subject filter configured to only include events where the subject ends with '.jpg'. Since a .png file upload would have a subject ending in '.png', the filter excludes it, preventing the event from being sent to the webhook endpoint. Therefore, the subject filter is the most likely reason the webhook is not receiving .png file events.

Answer

The subscription is disabled

Answer

The destination endpoint type is incorrect

Answer

The webhook endpoint requires authentication

Question 15

A high-traffic API sends approximately 80,000 telemetry events per second to Application Insights. Monthly ingestion costs are too high. The team wants to reduce data volume by roughly 80 percent while still seeing representative samples of all request types. What should the developer configure?

Accepted Answer

Enable adaptive sampling in the Application Insights SDK and set a target events-per-second limit. Adaptive sampling in the Application Insights SDK automatically adjusts the volume of telemetry sent to the service, targeting a specified rate of events per second. By setting a target that reduces the original 80,000 events/sec to roughly 20%, the SDK will intelligently sample all request types proportionally, preserving representative data while cutting costs.

Answer

Configure ingestion sampling in the Azure portal to retain 20 percent of incoming telemetry

Answer

Increase the TelemetryClient flush interval from 30 seconds to 5 minutes to batch events

Answer

Filter all events with HTTP status code 200 from the telemetry pipeline before sending