AZ-204 Practice Test 13 — 15 Questions

Question 1

You are designing a solution that runs background jobs to process images. The jobs can run up to 10 minutes each. You need to ensure the jobs are resilient to failures and can be retried automatically. Which Azure service should you use?

Accepted Answer

Azure Queue Storage with an Azure Function trigger. Azure Queue Storage with an Azure Function trigger is the correct choice because it provides a reliable, message-based architecture for background job processing. Queue messages persist until processed, and the Azure Function trigger automatically retries on failure (up to 5 times by default, with configurable policies). This handles the 10-minute job duration via the queue's visibility timeout, which can be set to match the job's maximum runtime, ensuring messages are not prematurely reprocessed.

Answer

Azure Logic Apps with a recurrence trigger

Answer

Azure Service Bus with a WebJob

Answer

Azure Event Grid with a Logic App

Question 2

You need to deploy a containerized application to Azure that must be restarted automatically if it crashes. The solution should minimize management overhead. Which compute service should you use?

Accepted Answer

Azure Container Instances. Azure Container Instances (ACI) is the correct choice because it provides a serverless container platform that automatically restarts containers if they crash when configured with a restart policy of 'Always' or 'OnFailure'. This minimizes management overhead by eliminating the need to manage underlying infrastructure, orchestration, or virtual machines, making it ideal for simple, stateless containerized applications that require automatic recovery.

Answer

Azure Functions

Answer

Azure Kubernetes Service (AKS)

Answer

Azure Virtual Machines

Question 3

You are designing a solution that uses Azure Functions to process events from Azure Event Hubs. Which TWO features should you enable to ensure the function processes events in order and exactly once?

Accepted Answer

Implement checkpointing in the function. Option C is correct because checkpointing in Azure Functions allows the function to record the last successfully processed event offset and partition. When the function resumes, it reads from that checkpoint, ensuring that events are processed exactly once within the partition, even if the function restarts or scales.

Answer

Durable Functions

Answer

Process events in batches

Answer

Use a retry policy in the function

Question 4

You are designing a solution that uses Azure Container Instances (ACI) to run a batch job. The job must run only once a day and should not incur costs when idle. Which configuration should you use?

Accepted Answer

Use a scheduled job that creates a container group with restart policy Never and delete after completion. Option C is correct because Azure Container Instances (ACI) supports a restart policy of 'Never' for one-off batch jobs, and you can orchestrate the creation and deletion of the container group using a scheduled job (e.g., Azure Logic Apps, Azure Functions, or a cron-based trigger). This ensures the container runs exactly once per day and incurs no cost when idle, as the container group is deleted after completion.

Answer

Use Azure Kubernetes Service with a node pool that scales to zero

Answer

Deploy a container group with a restart policy of Always

Answer

Use Azure Container Apps with scale-to-zero minimum replicas

Question 5

A company runs a critical web app on Azure App Service that must handle traffic spikes without downtime. They set up autoscaling rules based on CPU percentage. However, during a spike, the app becomes unresponsive before new instances are added. What should they do?

Accepted Answer

Use pre-warming instances with a scheduled scaling rule. Option C is correct because pre-warming instances with a scheduled scaling rule ensures that additional instances are already running and ready to handle traffic before the CPU spike occurs. This avoids the cold-start delay inherent in reactive autoscaling, where new instances take time to provision and initialize, causing unresponsiveness during rapid spikes.

Answer

Switch to memory-based autoscaling

Answer

Decrease the scale-in cooldown period

Answer

Increase the CPU percentage threshold for scale-out

Question 6

Your Azure Container Apps solution uses Dapr for microservices communication. Which THREE Dapr building blocks are essential for service-to-service invocation and state management?

Accepted Answer

Service Invocation. Service Invocation (A) is correct because Dapr's service invocation building block enables direct, secure service-to-service communication using gRPC or HTTP, with built-in mTLS, retries, and observability. State Management (E) is correct because it provides a key-value store abstraction for managing state across microservices, supporting pluggable state stores like Redis, Cosmos DB, or SQL Server. Pub/Sub (C) is correct because it enables asynchronous event-driven communication between services, decoupling producers and consumers via message brokers like Kafka, RabbitMQ, or Azure Service Bus.

Answer

Bindings

Answer

Actors

Question 7

Your company develops a microservices application deployed to Azure Kubernetes Service (AKS). You need to enable secure communication between services using managed identities. Which Azure service should you use to manage the identities and access control for the pods?

Accepted Answer

Microsoft Entra Workload ID. Microsoft Entra Workload ID (formerly Azure AD Workload Identity) is the correct choice because it integrates with Kubernetes to automatically project an Azure AD-managed identity into each pod. This allows pods to authenticate to Azure resources (e.g., Key Vault, Storage) without managing secrets, using federated identity credentials that map a Kubernetes service account to an Azure AD application or user-assigned managed identity.

Answer

Azure Service Bus

Answer

Azure Key Vault

Answer

Azure Policy

Question 8

You are migrating an on-premises .NET Framework app to Azure. The app uses Windows authentication and requires persistent storage. You want to minimize rework. Which Azure compute service should you choose?

Accepted Answer

Azure App Service on Windows. Azure App Service on Windows (D) supports Windows authentication natively via its built-in integration with Azure Active Directory and on-premises Active Directory through Azure AD Domain Services or hybrid identity setups. It also provides persistent storage options like Azure Files or blob storage attached to the web app, minimizing rework by allowing the existing .NET Framework app to run with minimal code changes in a Platform-as-a-Service (PaaS) environment.

Answer

Azure Spring Apps

Answer

Azure Functions

Answer

Azure Container Instances

Question 9

Refer to the exhibit. You have an HTTP-triggered Azure Function that writes the request body to a blob in the 'samples-workitems' container. The function runs successfully but does not create a blob. What is the most likely cause?

Accepted Answer

The storage account connection string is not set in the function app settings. The most likely cause is that the storage account connection string is not set in the function app settings. Azure Functions require the connection string for the storage account to be configured via the `AzureWebJobsStorage` app setting (or a custom connection setting referenced in the binding). Without it, the runtime cannot authenticate or communicate with Blob Storage, so the output binding silently fails to write the blob, even though the function executes successfully.

Answer

The container name 'samples-workitems' is invalid

Answer

The blob name pattern {rand-guid} is not supported

Answer

The blob output binding syntax is incorrect

Question 10

Your company runs a batch processing job on Azure Batch. The job processes large datasets and requires access to Azure Storage. You need to ensure that the compute nodes can securely access the storage account without exposing credentials. What should you configure?

Accepted Answer

Managed identity for the Batch pool. Option C is correct because managed identities for Azure resources allow compute nodes to authenticate to Azure Storage without storing credentials. Option A is wrong because storage account keys are shared secrets. Option B is wrong because SAS tokens can be exposed. Option D is wrong because Azure AD service principals require managing credentials.

Answer

Azure AD service principal

Answer

Storage account access keys

Answer

Shared access signatures (SAS)

Question 11

You deploy the above ARM template resource for a web app. The web app reads the connection string from the 'DefaultConnection' name. However, the web app fails to connect to the database with an error 'Login failed for user 'myuser'. What is the most likely cause?

Accepted Answer

The SQL server is configured to use Microsoft Entra authentication only, not SQL authentication.. Option D is correct. The connection string includes a password in plain text. The recommended approach is to use managed identity and not include a password. The login failure could be due to the password being incorrect or the SQL server not allowing SQL authentication. However, the most likely cause based on best practices is that the SQL server is configured to use Microsoft Entra authentication only, and the connection string uses SQL authentication. Option A is wrong because the type is correct for SQL Azure. Option B is wrong because the connection string syntax is correct. Option C is wrong because the user ID should match the database user.

Answer

The user ID does not have access to the database.

Answer

The connection string type should be 'SQLServer' instead of 'SQLAzure'.

Answer

The connection string is missing 'Trusted_Connection=True;'.

Question 12

You develop an Azure Function that writes to Azure Blob Storage. During testing, you notice that the function fails intermittently with a 503 (Service Unavailable) error. What is the most likely cause?

Accepted Answer

The storage account is throttling requests due to high volume. A 503 (Service Unavailable) error from Azure Blob Storage indicates that the storage service is temporarily unable to handle the request, typically due to server-side load. The most common cause is throttling when the storage account exceeds its scalability targets (e.g., 20,000 requests per second per account for blob storage). This aligns with intermittent failures under high request volume, not with configuration or existence issues.

Answer

The storage account firewall is blocking the function

Answer

The function does not have proper authentication

Answer

The blob container does not exist

Question 13

You have an Azure Function app that uses a Service Bus queue trigger. The function processes messages, but sometimes it takes longer than 5 minutes to process a single message. You notice that the message is processed multiple times. What is the most likely cause?

Accepted Answer

The lock duration on the queue is shorter than the processing time. Option D is correct because the default lock duration for Service Bus queues is 60 seconds, and if processing takes longer, the lock is lost and the message becomes visible again, leading to duplicate processing. Option A is wrong because maxDeliveryCount is for poison messages. Option B is wrong because sessions are not related. Option C is wrong because the function's timeout does not affect the lock.

Answer

The function's timeout is set to 5 minutes

Answer

The maxDeliveryCount is set too high

Answer

The queue has sessions enabled

Question 14

You deploy a containerized application to Azure Container Instances (ACI). The application needs to store configuration settings that might change at runtime. You need to update the configuration without redeploying the container. What should you do?

Accepted Answer

Use environment variables in the container group. Environment variables in Azure Container Instances (ACI) can be set at container group creation or updated by redeploying the container group with new values. They are accessible at runtime without modifying the container image, allowing configuration changes without a full redeploy. This is the recommended approach for dynamic configuration in ACI because environment variables are lightweight, secure, and natively supported by the container runtime.

Answer

Mount an Azure Files share and update the configuration file

Answer

Use Application Settings in the container

Answer

Modify the container image to include new configuration

Question 15

You have an Azure App Service web app that experiences high CPU usage during peak hours. You need to scale out automatically based on CPU load. What should you configure?

Accepted Answer

Configure an autoscale rule to scale out based on CPU percentage.. Option C is correct because Azure App Service autoscale rules allow you to scale out (increase instance count) based on a metric like CPU percentage. This automatically adds more instances when CPU exceeds a threshold, distributing the load and reducing CPU usage per instance during peak hours.

Answer

Manually increase the instance count during peak hours.

Answer

Configure an autoscale rule to scale up the App Service plan.

Answer

Use Azure Front Door to distribute load across multiple instances.