AZ-204 Practice Test 14 — 15 Questions

Question 1

Wide World Importers has an Azure API Management (APIM) instance that exposes several APIs. One API is a custom REST API hosted on an Azure App Service. The API requires authentication via a subscription key. APIM is configured to require subscription keys for all APIs. The team wants to offload authentication to APIM so that backend services do not need to validate keys. However, the backend API also needs to know the identity of the calling application for logging. The team decides to use APIM's OAuth 2.0 authorization with Microsoft Entra ID. The backend API should receive the JWT token from APIM. How should the team configure APIM to pass the token to the backend?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

In the inbound processing policy, add a 'validate-jwt' policy to validate the token. Then add a 'set-header' policy to copy the token from the Authorization header (or from the context) and forward it to the backend.. APIM can use the 'validate-jwt' policy to verify the OAuth 2.0 token from Microsoft Entra ID, and then a 'set-header' policy to forward the original JWT token (e.g., from the Authorization header or context variable) to the backend. This offloads authentication from the backend while preserving the caller's identity for logging, as the backend receives the token without needing to validate it again.

Answer

Use the 'ip-filter' policy to restrict access to known IPs. The backend trusts requests from APIM's IP.

Answer

Remove the subscription key requirement for that API. APIM will not pass any authentication information to the backend.

Answer

Configure APIM to use client certificate authentication for the backend. The certificate is presented to the backend, which extracts the identity from the certificate.

Question 2

Arrange the steps to create and use a shared access signature (SAS) for an Azure Storage blob in the correct order.

Accepted Answer

Create storage account, create container, upload blob, generate SAS, construct URL, then access.. First create storage and container, upload blob, generate SAS, construct URL, then access.

Answer

Upload blob, create storage account, create container, generate SAS, construct URL, then access.

Answer

Generate SAS, create storage account, create container, upload blob, construct URL, then access.

Answer

Create storage account, create container, generate SAS, upload blob, construct URL, then access.

Question 3

Your team uses Azure DevOps to deploy a web app to Azure App Service. The deployment fails intermittently with a '500 Internal Server Error' after successful code upload. You want to capture a memory dump of the process when the error occurs. What should you configure?

Accepted Answer

Use App Service Diagnostics to collect a memory dump. App Service Diagnostics provides a built-in 'Collect Memory Dump' tool that can be triggered on specific HTTP error codes, such as 500 Internal Server Error. This allows you to capture a full process dump of the web app when the error occurs, enabling offline analysis of the failure without modifying application code.

Answer

Configure an autoscale rule in Azure Monitor

Answer

Set up Azure API Management policies

Answer

Enable Application Insights Snapshot Debugger

Question 4

A document rendering job hosted on App Service returns intermittent 502 errors during deployment. The team wants zero-downtime release with validation before traffic moves. What should be implemented?

Accepted Answer

Deploy to a staging slot, validate health, then swap. Deploying to a staging slot allows the new version of the app to be fully initialized and validated via health checks before traffic is routed to it. The swap operation in Azure App Service moves the production traffic to the staging slot without any downtime, as the slots share the same front-end and the swap is atomic. This directly addresses the 502 errors caused by incomplete deployments and ensures zero-downtime release with validation.

Answer

Deploy directly to production during business hours

Answer

Disable health checks

Answer

Restart the App Service plan before each deployment

Question 5

You need to store and retrieve large binary files (up to 100 GB each) with low latency. The files will be accessed by multiple geographic regions. Which Azure storage solution should you recommend?

Accepted Answer

Azure Blob Storage with geo-redundant storage (GRS).. Azure Blob Storage is designed for storing large binary objects (up to 4.7 TB per blob) and offers low-latency access via HTTP/HTTPS. Geo-redundant storage (GRS) replicates data to a paired secondary region, providing durability and availability for multi-region access. This combination meets the requirements for large files (up to 100 GB) and low-latency retrieval from multiple geographic regions.

Answer

Azure Queue Storage with messages.

Answer

Azure Files with Azure File Sync.

Answer

Azure SQL Database with file tables.

Question 6

A company runs an ASP.NET Core web app on Azure App Service. They need to implement health checks that monitor the app's dependencies, such as a database and an external API. The health endpoint should return a 200 status if all dependencies are healthy, a 503 if any dependency is unhealthy, and a 400 if the request is malformed. Which approach should you take?

Accepted Answer

Implement custom health checks using the ASP.NET Core Health Checks middleware.. The ASP.NET Core Health Checks middleware allows you to implement custom health checks that monitor specific dependencies like a database and an external API. You can configure the middleware to return a 200 OK status when all checks pass, a 503 Service Unavailable when any check fails, and a 400 Bad Request for malformed requests by using the appropriate response writer and status code mapping.

Answer

Use the ASP.NET Core Diagnostics middleware to generate a health page.

Answer

Configure Application Insights availability tests.

Answer

Use the built-in health check endpoint in Azure App Service.

Question 7

Your company has a storage account with a hierarchical namespace enabled (Azure Data Lake Storage Gen2). You need to authorize an application to write data to a specific container using a managed identity. The application runs on an Azure VM with a system-assigned managed identity. Which role assignment should you use?

Accepted Answer

Assign the 'Storage Blob Data Contributor' role on the container to the managed identity.. The 'Storage Blob Data Contributor' role grants read, write, and delete permissions to blob data at the container scope. For Azure Data Lake Storage Gen2 with a hierarchical namespace, this role provides the necessary ACL-based access for a managed identity to write data to a specific container, without granting control plane permissions.

Answer

Assign the 'Contributor' role on the storage account to the managed identity.

Answer

Assign the 'Storage Blob Data Reader' role on the container to the managed identity.

Answer

Assign the 'Owner' role on the storage account to the managed identity.

Question 8

You are a developer for a large e-commerce company. The company has a global customer base and runs a critical web application on Azure App Service (Premium v3 plan) deployed in multiple regions. The application uses Azure Cosmos DB (multi-region writes enabled) for product catalog and session state. Recently, the operations team reported that during peak shopping hours (e.g., Black Friday), the application becomes slow and some users experience timeouts. You have implemented Application Insights to collect telemetry. After analyzing the data, you find that the Cosmos DB write operations are experiencing high latency (average 200ms) and occasional throttling (429 errors). The read latency is acceptable. The App Service instances are scaled out to 20 instances during peak, and CPU usage is around 70%. You need to optimize the solution to reduce write latency and eliminate throttling without over-provisioning resources. The solution must be cost-effective and require minimal code changes. What should you do?

Accepted Answer

Enable autoscale on the Cosmos DB container with a maximum throughput limit. Enabling autoscale on the Cosmos DB container allows the throughput to automatically scale up to the maximum limit during peak traffic, eliminating throttling (429 errors) and reducing write latency without manual intervention. This approach is cost-effective as it scales down during low traffic, and requires minimal code changes since it's a configuration change at the Cosmos DB level.

Answer

Scale up the App Service plan to a higher tier to increase CPU capacity

Answer

Implement Azure Cache for Redis to cache Cosmos DB read and write operations

Answer

Increase the provisioned RU/s manually before peak hours and decrease after

Question 9

You are designing a solution to store large amounts of unstructured data that is accessed infrequently (once a quarter). You need to minimize storage costs. Which Azure storage tier should you use?

Accepted Answer

Cool. The Cool tier is designed for data that is accessed infrequently (about once a quarter) and stored for at least 30 days, offering lower storage costs than Hot while still providing low-latency access. Since the data is unstructured and accessed only quarterly, Cool balances cost and availability without the long retrieval time or minimum storage duration of Archive.

Answer

Cold

Answer

Hot

Answer

Archive

Question 10

A company uses Azure Functions to process orders. The function needs to read messages from an Azure Service Bus queue. Which binding should the developer configure in the function.json?

Accepted Answer

serviceBusTrigger. The correct binding for reading messages from an Azure Service Bus queue in an Azure Functions app is `serviceBusTrigger`. This trigger binding listens to a Service Bus queue or topic subscription and invokes the function when a message arrives. Option D is correct because it specifically names the Service Bus trigger, which is designed for this purpose.

Answer

serviceBus

Answer

eventHubTrigger

Answer

queueTrigger

Question 11

You are deploying a containerized application using Azure Kubernetes Service (AKS). You need to ensure that sensitive configuration data, such as API keys, is not stored in container images. Which Kubernetes resource should you use?

Accepted Answer

Secret. Kubernetes Secrets are specifically designed to store sensitive data like API keys, connection strings, and passwords. They are stored in etcd as base64-encoded values (and can be encrypted at rest) and are injected into pods as environment variables or mounted as volumes, ensuring the sensitive data never resides in the container image.

Answer

Deployment

Answer

ConfigMap

Answer

PersistentVolume

Question 12

You have an Azure Cosmos DB container with a high number of physical partitions. You observe that some partitions are hitting the request unit (RU) limit while others are underutilized. What should you do to better distribute the workload?

Accepted Answer

Choose a different partition key that evenly distributes workload. The root cause of uneven RU consumption is a poorly chosen partition key that creates a hot partition. By selecting a partition key with high cardinality and even distribution, you ensure that requests and storage are spread uniformly across all physical partitions, preventing any single partition from throttling while others remain idle.

Answer

Add more composite indexes

Answer

Increase the total provisioned throughput

Answer

Change the default consistency level to eventual

Question 13

A web app for a claims processing function needs separate staging and production environments. The team must warm up the new version before swapping traffic. Which App Service feature should be used?

Accepted Answer

Deployment slots. Deployment slots are the correct Azure App Service feature for staging and production environments with traffic swapping. They allow you to deploy a new version to a staging slot, warm it up (e.g., by sending requests or using auto-swap with warm-up), and then swap the slot's traffic with the production slot, ensuring zero-downtime deployment and validation before going live.

Answer

Backup and restore

Answer

App Service access restrictions

Answer

Always On only

Question 14

A Cosmos DB container for session records receives hot-partition throttling because the partition key has only five possible values. What should the developer change? The design must avoid adding custom operational scripts.

Accepted Answer

Choose a partition key with higher cardinality and even request distribution. Hot-partition throttling occurs when a partition key has low cardinality (few distinct values), causing uneven request distribution and exceeding the physical partition's throughput limits. Choosing a partition key with higher cardinality and even request distribution spreads operations across more physical partitions, eliminating throttling without custom scripts.

Answer

Increase the default TTL

Answer

Enable analytical store only

Answer

Use a stored procedure for every write

Question 15

You are reviewing an ARM template snippet for an Azure App Service. The exhibit shows the site configuration. You need to ensure that the app supports WebSocket connections for a real-time feature. Which setting must be added?

Accepted Answer

Add 'webSocketsEnabled': true to siteConfig.. The 'webSocketsEnabled' property in the siteConfig of an Azure App Service ARM template explicitly enables WebSocket protocol support. WebSocket connections require a persistent, full-duplex communication channel over a single TCP connection, which is not enabled by default in Azure App Service. Setting this property to true allows the app to handle real-time features like chat or live notifications.

Answer

Set alwaysOn to false.

Answer

Set http20Enabled to false.

Answer

Change ftpsState to AllAllowed.