AZ-204 Practice Test 13 — 15 Questions

Question 1

The mobile app team needs to send push notifications to 10 million devices running both iOS and Android. On iOS, notifications go through Apple Push Notification service (APNs); on Android, through Firebase Cloud Messaging (FCM). The team wants a single Azure service that abstracts platform differences and scales without managing separate APNs and FCM integrations per platform. Which service should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Azure Notification Hubs with APNs and FCM credentials configured in the hub namespace. Azure Notification Hubs is the correct choice because it is a fully managed push notification service designed to abstract platform-specific notification systems like APNs (iOS) and FCM (Android). By configuring the APNs and FCM credentials in the hub namespace, the team can send a single notification that is automatically routed to the correct platform service, scaling to millions of devices without managing separate integrations.

Answer

Azure Service Bus with topics — one subscription per platform, each subscription delivering to APNs or FCM

Answer

Azure Event Grid with a custom endpoint handler per platform that calls APNs or FCM directly

Answer

Azure Communication Services email with HTML-formatted alerts sent to device email addresses

Question 2

A company has an Azure App Service web app that occasionally returns 500 errors. You need to diagnose the root cause without impacting production traffic. Which feature should you use?

Accepted Answer

Application Insights. Application Insights is a powerful diagnostic tool that provides detailed telemetry and performance monitoring for your web app. It can automatically detect and analyze 500 errors, showing stack traces, request details, and dependencies. This allows you to identify the root cause without impacting production traffic, as it works passively by collecting data.

Answer

Kudu console

Answer

Deployment slots

Answer

Autoscaling rules

Question 3

You are configuring a managed identity for an Azure App Service to access Azure Key Vault. The identity has been assigned, but the app receives a 403 Forbidden when trying to retrieve a secret. What is the most likely cause?

Accepted Answer

The managed identity lacks an access policy or RBAC role in Key Vault. Azure Key Vault uses either access policies or Azure RBAC to authorize requests. When a managed identity is assigned to an App Service but no corresponding access policy or RBAC role (e.g., 'Key Vault Secrets User') is granted in Key Vault, the identity has no permissions to read secrets, resulting in a 403 Forbidden response. The 403 indicates the request reached Key Vault but was denied due to missing authorization.

Answer

The app is using the wrong endpoint

Answer

The managed identity is not enabled in the App Service

Answer

The Key Vault firewall is blocking the request

Question 4

A company uses Azure Logic Apps to integrate with a third-party REST API. The API has a rate limit of 100 requests per minute. You need to ensure that the Logic App respects this limit. Which connector feature should you configure?

Accepted Answer

Concurrency control.. Concurrency control in Azure Logic Apps allows you to limit the number of concurrent workflow instances (when applied to the trigger) or parallel iterations (when applied to a 'For each' loop). By configuring this setting, you can proactively manage the rate at which requests are sent to an external API, helping to prevent exceeding rate limits. For example, if each Logic App run makes one API call, setting the concurrency limit on the trigger to a value that aligns with the rate limit (e.g., 100, if runs are short and the trigger fires frequently) can help throttle the overall request volume by queuing additional runs. This proactively manages the request volume, unlike a retry policy which reacts to failures.

Answer

Retry policy.

Answer

Swagger connector.

Answer

API Management.

Question 5

Your Azure Functions app uses a consumption plan and processes messages from an Azure Service Bus queue. You notice that message processing takes up to 10 minutes, and some messages are being processed multiple times. What is the most likely cause?

Accepted Answer

The lock duration on the Service Bus queue is shorter than the processing time.. The default lock duration for a Service Bus queue is 30 seconds, which is far shorter than the 10-minute processing time. When the lock expires, the message becomes visible to other consumers, causing duplicate processing. While Azure Functions attempts to automatically renew the message lock during processing, this auto-renewal has a maximum duration (default 5 minutes). Since the processing time (10 minutes) exceeds this duration, the lock will eventually expire, leading to the message becoming available for re-delivery.

Answer

The max delivery count for the queue is set too low.

Answer

The function host is configured with a low maximum instance count.

Answer

The function does not handle poison messages correctly.

Question 6

You need to deploy a containerized application to Azure Container Instances (ACI) with a public IP address and DNS name label. The container must restart automatically if it exits unexpectedly. Which configuration should you use?

Accepted Answer

Set restart policy to Always and assign a DNS name label.. Setting the restart policy to Always ensures the container automatically restarts if it exits unexpectedly, which is the required behavior. Assigning a DNS name label to the container group makes it accessible via a public IP address and a fully qualified domain name (FQDN) in the format ..azurecontainer.io, meeting the requirement for a public IP address and DNS name label.

Answer

Deploy the container into an Azure Virtual Network.

Answer

Set restart policy to Never and configure a public IP.

Answer

Set restart policy to OnFailure and use a private IP address.

Question 7

You are developing a solution that uses Azure Container Instances to run a batch job. The job requires 8 GB of memory and 4 vCPUs. You need to minimize costs. Which container group configuration should you choose?

Accepted Answer

Linux container with 8 GB and 4 vCPUs in a single container group. Azure Container Instances bills per container group, not per container within the group. A single Linux container with 8 GB and 4 vCPUs in one container group meets the job's requirements with the lowest cost, as it avoids the overhead of multiple containers or groups. Splitting resources across containers or using separate groups would increase costs without benefit.

Answer

Linux containers split into two containers (4 GB each) in the same group

Answer

Windows container with 8 GB memory and 4 vCPUs

Answer

Linux container with 8 GB and 4 vCPUs, but using two separate container groups

Question 8

You are deploying a multi-tier application: a frontend web app (Azure App Service) that calls a backend API (another Azure App Service). Both apps use Microsoft Entra ID for authentication. The frontend needs to authenticate to the backend on behalf of the signed-in user. You need to configure the OAuth 2.0 flow correctly. You have already registered both applications in Microsoft Entra ID. Which configuration should you apply?

Accepted Answer

In the frontend app registration, grant API permissions for the backend using the 'Delegated permissions' type. In the backend app registration, expose an API scope. The frontend uses the on-behalf-of flow (OBO) to exchange the user's token for a token to call the backend.. The frontend needs to act on behalf of the signed-in user, which requires delegated permissions. The backend must expose an API scope so the frontend can request it. The OAuth 2.0 On-Behalf-Of (OBO) flow is designed for this scenario: the frontend receives a token for itself, then exchanges it via the OBO flow for a token scoped to the backend API, preserving the user's identity and consent.

Answer

In the frontend app registration, enable the implicit grant flow for access tokens. The frontend gets a token for the backend directly from the authorization endpoint.

Answer

In the frontend app registration, set the redirect URI to the backend URL. The frontend uses the authorization code flow to get a token for the backend directly.

Answer

In the frontend app registration, grant API permissions for the backend using the 'Application permissions' type. In the backend app registration, expose an API scope. The frontend uses the client credentials flow to get a token for the backend.

Question 9

You need to upload large files (up to 100 GB) to Azure Blob Storage from a web application. The upload must be resilient to network failures and support pausing/resuming. Which approach should you use?

Accepted Answer

Use block blob with multiple blocks and parallel upload.. Block blobs support uploading large files (up to ~4.75 TB) by splitting the file into multiple blocks, uploading them in parallel for speed, and committing the block list atomically. This approach provides resilience to network failures (individual blocks can be retried) and supports pausing/resuming by tracking which blocks have been uploaded.

Answer

Upload the blob as a single PUT operation.

Answer

Use append blob.

Answer

Use AzCopy from the server.

Question 10

Refer to the exhibit. You are deploying an ARM template that assigns the 'Storage Blob Data Contributor' role to the managed identity of an App Service named 'myapp' at the storage account 'mystorageacct' scope. The deployment fails with an error that 'principalId' is null. What is the most likely cause?

Accepted Answer

The App Service 'myapp' does not have a managed identity enabled.. The error 'principalId' is null indicates that the ARM template is attempting to assign a role to a principal that does not exist. In this scenario, the principal is the managed identity of the App Service 'myapp'. If the App Service does not have a managed identity enabled, the 'principalId' property in the role assignment resource will be null, causing the deployment to fail. Enabling a system-assigned or user-assigned managed identity on the App Service is required before the role assignment can succeed.

Answer

The role definition ID is incorrect.

Answer

The storage account name 'mystorageacct' does not exist.

Answer

The role assignment name is not unique.

Question 11

Your company uses Microsoft Entra ID for identity management. You need to ensure that users accessing a line-of-business application from unmanaged devices must complete a multi-factor authentication (MFA) challenge. What should you configure?

Accepted Answer

Create a Conditional Access policy that requires MFA for users accessing the application, with a condition for 'Device state' set to 'Unmanaged'.. A Conditional Access policy in Microsoft Entra ID allows you to target specific applications and require MFA based on the device state condition. By setting the device state condition to 'Unmanaged', the policy applies only to devices that are not managed by your organization (e.g., not joined or compliant with Intune), ensuring that users on unmanaged devices must complete an MFA challenge before accessing the line-of-business application.

Answer

Configure a device compliance policy in Microsoft Intune.

Answer

Create a Conditional Access policy that requires MFA for all users.

Answer

Enable risk-based Conditional Access in Microsoft Entra ID Protection.

Question 12

You have a web application that writes user-uploaded images to Azure Blob Storage. The application uses a shared access signature (SAS) token with read and write permissions. Users report that sometimes they receive 'AuthorizationFailure' errors when uploading images, but the issue is intermittent. What is the most likely cause?

Accepted Answer

The SAS token has expired and the application is not regenerating it before it expires. SAS tokens have a defined expiration time. If the application does not regenerate the token before it expires, uploads will intermittently fail with 'AuthorizationFailure' errors. The intermittent nature is explained by the token being valid for some requests and expired for others, depending on when the token was last refreshed.

Answer

The blob container has a soft-delete policy that is preventing uploads

Answer

The storage account firewall is blocking requests from the web application's IP

Answer

The SAS token was generated with an incorrect IP range restriction

Question 13

You need to provide temporary access to a file in Azure Blob Storage for a duration of one hour. The solution must not require authentication. What should you generate?

Accepted Answer

A shared access signature (SAS) with read permission and an expiration time of one hour.. A shared access signature (SAS) with read permission and a one-hour expiration provides time-limited, delegated access to a specific blob without requiring authentication. The SAS token is appended to the URL and grants the specified permissions for the defined duration, meeting the requirement of temporary access without authentication.

Answer

Storage account key.

Answer

Enable anonymous public read access on the container.

Answer

A user delegation key.

Question 14

You want to ensure that data in an Azure Storage account is replicated across multiple Azure regions to protect against regional outages. Which replication option should you choose?

Accepted Answer

Geo-redundant storage (GRS). Geo-redundant storage (GRS) replicates your data synchronously three times within a primary region using LRS, then asynchronously replicates to a secondary region hundreds of miles away. This ensures data survives a complete regional outage because the secondary copy is available for read or write access after a failover, meeting the requirement for cross-region protection.

Answer

Locally-redundant storage (LRS)

Answer

Read-access geo-redundant storage (RA-GRS)

Answer

Zone-redundant storage (ZRS)

Question 15

A company runs a critical web app on Azure App Service that must handle traffic spikes without downtime. They set up autoscaling rules based on CPU percentage. However, during a spike, the app becomes unresponsive before new instances are added. What should they do?

Accepted Answer

Use pre-warming instances with a scheduled scaling rule. Pre-warming instances with a scheduled scaling rule ensures that additional instances are already running and ready to handle traffic before the CPU spike occurs. This avoids the cold-start delay inherent in reactive autoscaling, where new instances take time to provision and initialize, causing unresponsiveness during rapid spikes.

Answer

Switch to memory-based autoscaling

Answer

Decrease the scale-in cooldown period

Answer

Increase the CPU percentage threshold for scale-out