AZ-204 Practice Test 14 — 15 Questions

Question 1

A company uses Azure Functions to process messages from Azure Service Bus. The function currently uses the Consumption plan. They notice that during high load, messages are processed slowly due to scaling latency. Which change would improve throughput most?

Accepted Answer

Switch to the Premium plan. The Premium plan for Azure Functions provides pre-warmed instances and faster scaling, eliminating the cold start and scaling latency inherent in the Consumption plan. This directly addresses the bottleneck during high load by ensuring that new instances are allocated instantly, thereby improving message processing throughput from Service Bus.

Answer

Set the maximum instance count to 20

Answer

Increase the function's batch size to 100

Answer

Enable Service Bus sessions

Question 2

You are developing a solution that uses Azure Container Registry (ACR) to store Docker images. You need to ensure that only authorized users can deploy images from ACR to an AKS cluster. What should you do?

Accepted Answer

Use the AKS cluster's managed identity with AcrPull role assignment.. Option D is correct because using a managed identity for AKS and assigning AcrPull role on ACR provides secure, password-less authentication. Option A is wrong because admin account is not recommended. Option B is wrong because AKS cannot use username/password directly. Option C is wrong because namespace roles do not control ACR access.

Answer

Configure AKS RBAC to limit image pull permissions.

Answer

Use Kubernetes secrets to store ACR credentials.

Answer

Enable the admin account on ACR and use the credentials in AKS.

Question 3

You are troubleshooting a containerized application running on Azure Kubernetes Service (AKS). The application logs indicate that it cannot connect to an Azure SQL Database using a managed identity. The pod is configured with a user-assigned managed identity. Which step is most likely missing?

Accepted Answer

The AKS cluster does not have the Azure AD Pod Identity add-on enabled. The AKS cluster requires the Azure AD Pod Identity add-on (or the newer Workload Identity) to enable pods to authenticate to Azure resources using managed identities. Without this add-on, the pod's user-assigned managed identity cannot be used to obtain tokens for connecting to Azure SQL Database, even if the identity is correctly assigned to the pod.

Answer

The Azure SQL Database firewall is blocking the pod IP

Answer

The pod's service account is not linked to the managed identity

Answer

The managed identity is not in the same Microsoft Entra ID tenant as the AKS cluster

Question 4

Which THREE factors should you consider when choosing between Azure Functions (Consumption plan) and Azure Container Instances for running a background job that processes messages from Azure Service Bus?

Accepted Answer

Scaling behavior (automatic vs. manual).. Option A is correct because Azure Functions on the Consumption plan automatically scales out based on the number of incoming Service Bus messages, handling up to 200 concurrent instances per function app, while Azure Container Instances require manual scaling or external orchestration (e.g., KEDA) to adjust the number of container groups. This makes scaling behavior a key differentiator when choosing between the two services for a background job.

Answer

Ability to use custom base images.

Answer

Native support for Service Bus trigger.

Question 5

You are designing a serverless application using Azure Functions. The solution must process messages from an Azure Service Bus queue and update a Cosmos DB database. Which binding configuration should you use on the function?

Accepted Answer

Service Bus trigger with Cosmos DB output binding. Option D is correct because the requirement specifies processing messages from an Azure Service Bus queue and updating a Cosmos DB database. A Service Bus trigger binds the function to the queue, and a Cosmos DB output binding writes the processed data directly to Cosmos DB, enabling a seamless serverless workflow without additional code for database operations.

Answer

Service Bus trigger with Table storage output binding

Answer

Blob trigger with Cosmos DB output binding

Answer

HTTP trigger with Cosmos DB input binding

Question 6

Which TWO of the following are valid use cases for Azure Queue Storage? (Choose TWO.)

Accepted Answer

Building a reliable messaging layer between microservices.. Option A is correct because Azure Queue Storage provides a reliable, persistent message queue that enables asynchronous communication between microservices. It guarantees at-least-once delivery and supports message visibility timeouts, making it ideal for decoupling components in a distributed architecture.

Answer

Broadcasting messages to multiple subscribers.

Answer

Storing large JSON documents for later retrieval.

Answer

Streaming high-volume telemetry data for real-time analytics.

Question 7

You are developing a background job that runs every hour on Azure App Service. The job must be resilient to restarts and should not affect the web app's performance. Which technology should you use?

Accepted Answer

WebJobs (triggered). WebJobs (triggered) are designed specifically for running background tasks on Azure App Service. They run as separate processes from the web app, ensuring they do not affect the web app's performance, and they are resilient to restarts because the Azure WebJobs SDK automatically handles restart and retry logic. This makes them the ideal choice for a scheduled hourly job that must survive App Service restarts.

Answer

A background thread in the web application

Answer

Azure Logic Apps

Answer

Azure Functions (Consumption plan)

Question 8

You are developing a microservices application deployed on Azure Kubernetes Service (AKS). You need to ensure that service-to-service communication is encrypted using mutual TLS (mTLS) without modifying application code. What should you do?

Accepted Answer

Deploy Azure Service Mesh and enable mTLS.. Azure Service Mesh (e.g., Open Service Mesh or Istio-based) provides a transparent infrastructure layer that can automatically inject sidecar proxies into pods and enforce mTLS for all service-to-service communication without requiring any changes to application code. This meets the requirement of encrypting traffic with mutual TLS while keeping the application code untouched.

Answer

Use Azure Application Gateway Ingress Controller with mTLS.

Answer

Enable Azure Kubernetes Service (AKS) pod-to-pod encryption.

Answer

Configure Azure Network Security Groups to enforce encryption.

Question 9

You deploy an Azure Function app that uses the Premium plan. The function processes messages from an Azure Service Bus queue. Under heavy load, some messages are processed multiple times. You need to ensure exactly-once processing without losing messages. What should you do?

Accepted Answer

Enable duplicate detection on the Service Bus queue.. Option A is correct because enabling duplicate detection on the Service Bus queue ensures that the Service Bus broker itself discards duplicate messages based on a user-defined time window. This prevents the function from processing the same message multiple times, even if the function host restarts or the message is re-delivered due to transient failures. Duplicate detection works by tracking the MessageId of each message and ignoring any subsequent message with the same MessageId within the detection window.

Answer

Use Peek-Lock mode instead of Receive and Delete.

Answer

Set the maxDeliveryCount to 1 on the queue.

Answer

Reduce the batch size in the function host.json.

Question 10

You are deploying a microservice to Azure Container Apps. The service requires a custom domain and SSL/TLS certificate. Which resource should you configure to meet these requirements?

Accepted Answer

Azure Container Apps environment with a custom domain and certificate attached. Option A is correct because Container Apps supports custom domains and certificates via the environment. Option B is wrong because API Management is a separate service. Option C is wrong because Front Door is for global load balancing. Option D is wrong because App Gateway is for traditional web apps.

Answer

Azure Front Door with a custom domain

Answer

Azure API Management in front of the Container App

Answer

Azure Application Gateway with SSL termination

Question 11

Which TWO actions should you take to ensure high availability for a stateful ASP.NET application deployed on Azure App Service?

Accepted Answer

Enable ARR Affinity (client affinity) to maintain session state.. Option A is correct because enabling ARR Affinity (client affinity) ensures that all requests from a given client session are routed to the same instance, preserving in-memory session state. Without this, a stateful ASP.NET application would lose session data if subsequent requests are load-balanced to different instances, causing session state errors.

Answer

Scale up the App Service plan to a higher tier.

Answer

Store session state in Azure Files share.

Answer

Disable session state to allow any instance to handle requests.

Question 12

You are building a serverless API using Azure Functions. The API must authenticate requests using Microsoft Entra ID. You need to restrict access to users from a specific Microsoft Entra tenant only. What should you configure in the function app?

Accepted Answer

Set the 'Issuer URL' to the specific tenant's endpoint.. Option D is correct because setting the 'Issuer URL' to the specific tenant's endpoint (e.g., https://login.microsoftonline.com/{tenant-id}/v2.0) tells Azure Functions to validate that the token was issued by that exact tenant. This restricts access to users from that tenant only, as tokens from other tenants will fail issuer validation.

Answer

Set the 'Allowed Token Audiences' to the application ID.

Answer

Enable 'Require Authentication' and set the action to 'Login with Microsoft Entra ID'.

Answer

Set the 'Client ID' to the application ID.

Question 13

Which TWO actions can you perform using Azure Container Registry (ACR) tasks?

Accepted Answer

Schedule a task to patch base images. ACR Tasks supports automated patching of base images through the 'base image update' trigger. When a base image in a public or private registry is updated, ACR Tasks can automatically rebuild any container images that depend on it, ensuring security patches are applied without manual intervention. This is configured via the `--base-image-trigger-enabled` flag in the `az acr task create` command.

Answer

Import images from another registry

Answer

Deploy images to AKS

Answer

Automatically scan images for vulnerabilities

Question 14

You need to deploy a web application to Azure App Service. The application requires a custom domain name and SSL/TLS certificate. You want to automate the deployment using Azure CLI. Which command should you use to upload the SSL certificate to the App Service?

Accepted Answer

az webapp config ssl upload. Option A is correct because az webapp config ssl upload is the correct Azure CLI command to upload a certificate to an App Service. Option B is wrong because az appservice web config ssl upload does not exist. Option C is wrong because az webapp certificate upload is incorrect syntax. Option D is wrong because az appservice certificate import imports a certificate from Key Vault, not a direct upload.

Answer

az appservice web config ssl upload

Answer

az appservice certificate import

Answer

az webapp certificate upload

Question 15

You are developing a web application that processes images uploaded by users. The images must be resized and analyzed for offensive content before being stored. You need to implement the solution with minimal latency and cost. What should you do?

Accepted Answer

Use an Azure Function triggered by Blob Storage, with Consumption plan.. Option D is correct because using an Azure Function triggered by Blob Storage on a Consumption plan provides a serverless, event-driven architecture that automatically scales to process each image upload with minimal latency and cost. The Consumption plan charges only for execution time and resources used, making it cost-effective for sporadic workloads, while the Blob Storage trigger ensures immediate processing upon upload without polling or additional infrastructure.

Answer

Use Azure Batch to process images in parallel.

Answer

Use Durable Functions to orchestrate the resizing and analysis.

Answer

Use Azure Logic Apps with a trigger for each upload.