AZ-204 Practice Test 15 — 15 Questions

Question 1

A healthcare organization uses Azure API Management (APIM) to expose FHIR APIs to external partners. The FHIR backend is an Azure API for FHIR that requires OAuth 2.0 tokens from Microsoft Entra ID. APIM must validate tokens before forwarding requests to the backend. The organization also needs to rate-limit requests per subscription key and log all requests to Azure Monitor for audit. Which combination of APIM policies should be implemented?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use validate-jwt to validate the token, rate-limit to throttle requests per subscription key, and log-to-event-hub to send logs.. Validate-jwt is the appropriate policy to validate OAuth 2.0 tokens from Microsoft Entra ID before forwarding requests to the FHIR backend. The rate-limit policy enforces throttling per subscription key, which is the standard way to rate-limit based on API Management subscription keys. The log-to-event-hub policy sends logs to Azure Monitor via Event Hubs for audit purposes, meeting all requirements.

Answer

Use validate-jwt, set-header to add the subscription key, and log-to-event-hub.

Answer

Use check-header to verify the token, rate-limit to throttle requests, and log-to-event-hub to send logs.

Answer

Use validate-jwt to validate the token, quota to limit total requests, and log-to-event-hub.

Question 2

You develop an Azure Function that writes to Azure Blob Storage. During testing, you notice that the function fails intermittently with a 503 (Service Unavailable) error. What is the most likely cause?

Accepted Answer

The storage account is throttling requests due to high volume. A 503 (Service Unavailable) error from Azure Blob Storage indicates that the storage service is temporarily unable to handle the request, typically due to server-side load. The most common cause is throttling when the storage account exceeds its scalability targets (e.g., 20,000 requests per second per account for blob storage). This aligns with intermittent failures under high request volume, not with configuration or existence issues.

Answer

The storage account firewall is blocking the function

Answer

The function does not have proper authentication

Answer

The blob container does not exist

Question 3

Refer to the exhibit. You run the Get-AzStorageAccount cmdlet and see the output above. You need to enable the hierarchical namespace feature for this storage account. What should you do first?

Accepted Answer

Delete the storage account and create a new one with -EnableHierarchicalNamespace $true.. The hierarchical namespace feature (which enables Azure Data Lake Storage Gen2) cannot be enabled on an existing storage account; it must be set at creation time. Therefore, you must delete the current account and create a new one with the `-EnableHierarchicalNamespace $true` parameter. Option D is correct because it follows this immutable requirement.

Answer

Change the replication to LRS.

Answer

Set the -EnableHierarchicalNamespace parameter to true on the existing account.

Answer

Change the access tier to Hot.

Question 4

You are developing a .NET Core application that needs to authenticate users via Microsoft Entra ID and call Microsoft Graph API. You register an app in the Microsoft Entra admin center and configure the necessary permissions. However, when the app tries to acquire a token, it receives an 'interaction_required' error. What is the most likely cause?

Accepted Answer

The application is requesting admin-restricted permissions without admin consent.. The 'interaction_required' error occurs when the application requests permissions that require admin consent, but the user is not an admin or admin consent has not been granted. In Microsoft Entra ID, certain Graph API permissions (e.g., User.Read.All, Mail.Read) are marked as admin-restricted and require an admin to consent via the admin consent endpoint. Without this consent, the token acquisition fails with this specific error.

Answer

The client secret is expired or invalid.

Answer

The scope parameter is incorrectly formatted.

Answer

The redirect URI does not match the registered redirect URI.

Question 5

Your company uses Azure Service Bus topics and subscriptions to send order notifications. You notice that some messages are not being delivered to a subscription. The subscription has a SQL filter that matches messages with a 'region' property equal to 'EU'. You verify that the messages have 'region' set to 'eu' (lowercase). What is the most likely cause?

Accepted Answer

The SQL filter is case-sensitive and 'EU' does not match 'eu'.. The SQL filter in Azure Service Bus is case-sensitive by default. The filter condition 'region = ''EU''' requires an exact match, including case. Since the messages have 'region' set to 'eu' (lowercase), they do not satisfy the filter condition and are therefore not delivered to the subscription. This is the most likely cause of the missing messages.

Answer

The subscription is disabled.

Answer

The subscription has no filter defined.

Answer

The subscription has a correlation filter instead.

Question 6

You are deploying a microservice that needs to read secrets (e.g., connection strings) from Azure Key Vault. The service runs on Azure Kubernetes Service (AKS). You want to minimize code changes and automatically rotate secrets. Which approach should you use?

Accepted Answer

Use the Azure Key Vault Provider for Secrets Store CSI Driver on AKS.. The Azure Key Vault Provider for Secrets Store CSI Driver mounts secrets as volumes or environment variables in AKS pods without requiring application code changes. It automatically rotates secrets by syncing with Key Vault at a configurable polling interval, minimizing code changes and enabling seamless secret rotation.

Answer

Use the Azure Key Vault SDK in the application code to fetch secrets.

Answer

Store secrets as environment variables in the container image.

Answer

Use Azure App Configuration with Key Vault references.

Question 7

You are developing a web app that experiences intermittent slow responses. You enable Application Insights and notice that the server-side request duration is normally under 200ms, but some requests take over 5 seconds. Which diagnostic tool should you use to identify the root cause?

Accepted Answer

Application Insights Profiler. The Application Insights Profiler is the correct tool because it provides a flame chart of per-request CPU and wall-clock time, allowing you to identify which code path is causing the 5-second latency. Unlike other tools, the Profiler captures detailed execution traces for slow requests, pinpointing the exact method or dependency that is blocking the thread.

Answer

Availability Tests

Answer

Snapshot Debugger

Answer

Live Metrics Stream

Question 8

You need to enable client-side encryption for data stored in Azure Blob Storage. The encryption keys must be managed by your organization using Azure Key Vault. What should you use?

Accepted Answer

Azure Storage client-side encryption library with Key Vault. Client-side encryption requires the application to encrypt data before uploading it to Azure Blob Storage, and the Azure Storage client-side encryption library integrates with Azure Key Vault to allow your organization to manage the encryption keys. This approach ensures that the storage service never has access to the plaintext data or the keys, meeting the requirement for client-side encryption with customer-managed keys.

Answer

Azure Disk Encryption

Answer

Azure Information Protection

Answer

Azure Storage service-side encryption with customer-managed keys

Question 9

You are configuring an Azure App Service web app to authenticate users with Microsoft Entra ID. You need to ensure that only users from your organization's tenant can access the app. Which setting should you configure?

Accepted Answer

Set the Issuer URL to https://login.microsoftonline.com/{tenant-id}/v2.0. Setting the Issuer URL to `https://login.microsoftonline.com/{tenant-id}/v2.0` restricts token validation to only tokens issued by your specific Microsoft Entra ID tenant. This ensures that only users from your organization's tenant can authenticate, as the app will reject tokens from other tenants or the common endpoint.

Answer

Set the Issuer URL to https://login.microsoftonline.com/common/v2.0

Answer

Set the Client ID to the application's Application ID.

Answer

Set the Allowed token audiences to include the app's Application ID URI.

Question 10

You are developing a solution that uses Azure Container Instances (ACI) to run a batch processing job. The job runs for approximately 30 minutes and requires access to a configuration file stored in Azure Files. You need to ensure the container instance can access the file share securely without using a public endpoint. Which TWO actions should you take?

Accepted Answer

Mount the Azure Files share using the storage account name and key.. Mounting an Azure Files share using the storage account name and key is a supported method in Azure Container Instances. This approach uses the SMB protocol to directly attach the file share to the container, providing access to the configuration file without requiring a public endpoint. The storage account key is passed securely as part of the container group configuration, and the mount is handled internally within the Azure infrastructure.

Answer

Use a managed identity assigned to the container group to authenticate to the storage account.

Answer

Use a shared access signature (SAS) token to mount the file share.

Answer

Enable the storage account's firewall to allow access from the container group's public IP.

Question 11

Which TWO authentication methods can be used to authorize access to Azure Blob Storage without requiring shared keys?

Accepted Answer

Microsoft Entra ID (formerly Azure AD) authentication. Microsoft Entra ID (formerly Azure AD) authentication and managed identities for Azure resources are both identity-based authentication methods that do not require shared keys. Entra ID authentication uses OAuth 2.0 tokens to authorize access to Blob Storage, while managed identities provide an automatically managed identity in Entra ID for Azure resources, eliminating the need for developers to manage credentials. Both methods support role-based access control (RBAC) for fine-grained permissions.

Answer

Shared access signature (SAS) token

Answer

Storage account access keys

Answer

Client certificate-based authentication

Question 12

Refer to the exhibit. You have an Azure Storage account with a blob container named container1. The container's public access level is set to Blob (anonymous read access for blobs only). You attempt to assign the custom role defined in the JSON using Azure PowerShell. The role assignment fails. What is the most likely reason?

Accepted Answer

The condition StringEquals expects publicAccess to be 'none', but the container has Blob (anonymous) access.. C is correct because the custom role includes a condition that uses the `StringEquals` operator to check that the `publicAccess` property of the container is set to `'none'`. Since `container1` has public access level set to `Blob (anonymous read access for blobs only)`, the condition evaluates to false, causing the role assignment to fail. Azure role assignments with conditions require all specified conditions to be met; otherwise, the assignment is rejected.

Answer

The action 'Microsoft.Storage/storageAccounts/blobServices/containers/read' is not a valid action.

Answer

The principal ID is invalid.

Answer

The resource scope is incorrectly formatted.

Question 13

You deploy the ARM template shown in the exhibit. After deployment, you need to change the replication to geo-redundant storage (GRS) with read access (RA-GRS). What should you do?

Accepted Answer

Update the 'sku.name' to 'Standard_RAGRS' and redeploy.. The ARM template initially deploys a storage account with 'Standard_GRS' (geo-redundant storage), but to enable read access to the secondary region (RA-GRS), you must change the SKU name to 'Standard_RAGRS'. Redeploying the template with this updated property updates the replication setting to RA-GRS, which provides both geo-redundancy and read access to the secondary endpoint.

Answer

Redeploy the same template; Standard_GRS already provides geo-redundancy.

Answer

Set the 'supportsHttpsTrafficOnly' property to false.

Answer

Change the 'accessTier' to 'Cool'.

Question 14

Arrange the steps to implement Azure Blob Storage lifecycle management to archive blobs after 30 days in the correct order.

Accepted Answer

Create storage account and container, then upload blobs, then navigate to Lifecycle Management, then add a rule with action to archive after 30 days.. First create storage and container, upload blobs, navigate to lifecycle, add rule with actions.

Answer

Upload blobs first, then create storage account and container, then navigate to Lifecycle Management, then add a rule.

Answer

Create storage account and container, then navigate to Lifecycle Management, then add a rule, then upload blobs.

Answer

Navigate to Lifecycle Management first, then create storage account and container, then upload blobs, then add a rule.

Question 15

You have an Azure Function app that uses .NET 8 isolated process. The function must connect to an Azure SQL database using a managed identity. The function app has a system-assigned managed identity enabled. Which code snippet correctly retrieves the access token?

Accepted Answer

var credential = new DefaultAzureCredential(); var token = await credential.GetTokenAsync(new TokenRequestContext(new[] {"https://database.windows.net/.default"}));. It uses `DefaultAzureCredential` to obtain an access token for Azure SQL Database by specifying the resource URI `https://database.windows.net/.default` in a `TokenRequestContext`. In a .NET 8 isolated process function app with a system-assigned managed identity, `DefaultAzureCredential` automatically attempts managed identity authentication as one of its credential sources, making it the recommended approach. The `GetTokenAsync` method requires a `TokenRequestContext` object, not a plain string, to correctly request the token for the Azure SQL resource.

Answer

new SqlConnection(connectionString) using Integrated Security=true;

Answer

var token = await new Azure.Identity.DefaultAzureCredential().GetTokenAsync("https://database.windows.net");

Answer

var credential = new ManagedIdentityCredential(); var token = await credential.GetTokenAsync("https://database.windows.net");