AZ-204 Practice Test 15 — 15 Questions

Question 1

You have an Azure App Service web app that experiences high CPU usage during peak hours. You need to scale out automatically based on CPU load. What should you configure?

Accepted Answer

Configure an autoscale rule to scale out based on CPU percentage.. Azure App Service autoscale rules allow you to scale out (increase instance count) based on a metric like CPU percentage. This automatically adds more instances when CPU exceeds a threshold, distributing the load and reducing CPU usage per instance during peak hours.

Answer

Manually increase the instance count during peak hours.

Answer

Configure an autoscale rule to scale up the App Service plan.

Answer

Use Azure Front Door to distribute load across multiple instances.

Question 2

Refer to the exhibit. You created a custom RBAC role definition. A user assigned this role at the subscription scope. What can the user do?

Accepted Answer

Read Azure SQL Database configurations and data. The custom RBAC role definition includes the 'Microsoft.Sql/servers/databases/read' action, which grants read access to Azure SQL Database configurations and data at the subscription scope. This action allows the user to view database settings and query data, but does not permit write or create operations.

Answer

Read any resource in the subscription

Answer

Write to Azure SQL Databases

Answer

Create new Azure SQL Databases

Question 3

An Azure App Service application has slow API requests. The developer needs distributed tracing across requests and dependencies. What should be enabled?

Accepted Answer

Application Insights with dependency tracking. Application Insights with dependency tracking is the correct choice because it provides distributed tracing across requests and dependencies, enabling developers to correlate end-to-end transactions in a microservices or multi-component application. It automatically collects telemetry for HTTP calls, database queries, and other external service calls, which is essential for diagnosing slow API requests in an Azure App Service environment.

Answer

Azure Policy compliance scan

Answer

Storage account static website logs

Answer

Cost Management budgets only

Question 4

Arrange the steps to deploy a containerized application to Azure Container Instances (ACI) from Azure Container Registry (ACR) in the correct order.

Accepted Answer

Create an Azure Container Registry, push the container image to the registry, create a container group in Azure Container Instances, configure the container group settings, then start the container group.. First create ACR, push image, create container group, configure settings, then start.

Answer

Push the container image, create an Azure Container Registry, create a container group, configure settings, then start.

Answer

Create a container group, create an Azure Container Registry, push the container image, configure settings, then start.

Answer

Create an Azure Container Registry, create a container group, push the container image, configure settings, then start.

Question 5

Which FOUR are valid ways to authenticate to Azure Blob Storage from an application? (Choose four.)

Accepted Answer

Use the storage account access key.. The storage account access key provides full administrative access to the storage account, including Blob Storage. It is a simple, shared-key authentication method using HMAC-SHA256 to sign requests. Option B is correct because OAuth2 tokens obtained from Microsoft Entra ID for a user are a supported authentication method for Azure Blob Storage, enabling fine-grained access control. Option C is correct because a shared access signature (SAS) token provides delegated access to storage resources with specified permissions and expiry. Option E is correct because a managed identity assigned to an Azure resource (e.g., a VM or App Service) can be used to authenticate to Blob Storage without storing credentials. Option D is incorrect because client certificates are not a supported authentication method for direct access to Azure Blob Storage; they are used for device authentication or authenticating to Azure AD as a service principal.

Answer

Use a client certificate.

Question 6

Refer to the exhibit. You run this KQL query in Azure Monitor Logs. What does the timechart display?

Accepted Answer

Multiple lines, one for each result code, showing request count over time. The KQL query uses `summarize count() by ResultCode, bin(TimeGenerated, 5m)` which groups requests by both `ResultCode` and 5-minute time bins. When rendered with `render timechart`, each distinct `ResultCode` value produces a separate series (line) on the chart, showing the request count over time for that result code. This is why multiple lines appear, one per result code.

Answer

A single line of total requests over time

Answer

Total requests per 5 minutes

Answer

Requests grouped by result code only

Question 7

Tailwind Traders uses Azure Logic Apps to orchestrate a multi-step business process. The workflow must call an external REST API that requires OAuth 2.0 authentication. The API is registered in Microsoft Entra ID. The Logic App must authenticate using a system-assigned managed identity. The API's app registration has been configured to accept tokens from the managed identity. Which connector should the team use in the Logic App to call the API, and how should they configure authentication?

Accepted Answer

Use the HTTP connector. In the connector's authentication settings, choose 'Managed Identity' and select the system-assigned identity. Set the audience to the API's Application ID URI.. The HTTP connector with 'Managed Identity' authentication is the correct choice because the Logic App needs to call an external REST API that accepts tokens from a system-assigned managed identity. By selecting 'Managed Identity' and setting the audience to the API's Application ID URI, the Logic App automatically acquires an access token from Microsoft Entra ID using the system-assigned identity, without needing to manage credentials. This aligns with the requirement for OAuth 2.0 authentication using a managed identity.

Answer

Use the HTTP connector with 'Active Directory OAuth' authentication. Provide the client ID and client secret of a service principal.

Answer

Use the custom connector. In the custom connector's authentication, choose 'Managed Identity' and provide the managed identity's principal ID.

Answer

Use the Azure API Management connector. Configure it to use OAuth 2.0 with the managed identity.

Question 8

Which TWO Azure services can be used to implement serverless event-driven architectures?

Accepted Answer

Azure Logic Apps. Azure Logic Apps is correct because it provides a fully managed integration platform for orchestrating workflows that respond to events from various sources, such as HTTP requests, Azure services, or third-party apps, using a visual designer and connectors. Azure Functions is correct because it offers event-driven compute capabilities where code executes in response to triggers like HTTP requests, queue messages, or timer events, enabling serverless architectures without managing infrastructure.

Answer

Azure Batch

Answer

Azure Container Instances

Answer

Azure Virtual Machines

Question 9

You need to deploy an Azure Functions app that runs on a dedicated App Service plan. The function must be triggered by an HTTP request and call a downstream API that requires OAuth 2.0 authentication. Which approach should you use to store the API credentials securely?

Accepted Answer

Use Key Vault references in the function app settings. Azure Key Vault references in function app settings allow you to securely store and retrieve sensitive information like OAuth 2.0 credentials (client ID, client secret) without exposing them in code or configuration files. The function app resolves these references at runtime using a managed identity, ensuring credentials are never stored in plaintext or accessible via source control.

Answer

Use Azure App Configuration with plain text

Answer

Store credentials in a configuration file in the deployment package

Answer

Store credentials in the function code as constants

Question 10

You deploy the above policy to an Azure API Management API. What is the effect?

Accepted Answer

Limits the API to 100 calls per 60 seconds per subscription key.. The policy shown is a rate-limit policy in Azure API Management that uses the `rate-limit-by-key` element with a `counter-key` attribute set to `@(context.Subscription.Key)`. This limits the number of calls per subscription key, not per IP or backend. The `calls` attribute is set to 100 and the `renewal-period` is 60 seconds, so it enforces 100 calls per 60 seconds per subscription key.

Answer

Limits the total bandwidth to 100 MB per 60 seconds.

Answer

Limits the API to 100 calls per 60 seconds from the backend.

Answer

Limits the API to 100 calls per 60 seconds per client IP address.

Question 11

You are designing a solution to store application secrets. You need to ensure that secrets are encrypted at rest and access is audited. Which TWO Azure services should you use?

Accepted Answer

Azure Monitor. Azure Monitor is correct because it provides the auditing and logging capabilities required to track access to secrets. By enabling diagnostic settings on Key Vault, you can send audit events (e.g., secret get, set, delete) to a Log Analytics workspace, storage account, or Event Hub, which are then queryable via Azure Monitor Logs. This satisfies the requirement for access auditing.

Answer

Azure SQL Database

Answer

Azure Storage Account with encryption

Answer

Azure App Configuration

Question 12

Your application uses Azure Cosmos DB with the SQL API. You notice that read requests are being throttled (HTTP 429) during peak hours. You need to improve read performance without changing the application code. Which action should you take?

Accepted Answer

Increase the provisioned throughput (RU/s) for the container. Throttling (HTTP 429) occurs when the consumed request units per second exceed the provisioned throughput. Increasing the provisioned RU/s for the container directly raises the capacity, allowing more read requests per second without any code changes. This is the simplest and most direct way to eliminate throttling under peak load.

Answer

Add a composite index to the container

Answer

Enable multi-region writes for the Cosmos DB account

Answer

Change the default consistency level to Strong

Question 13

A booking backend uses Azure Functions with HTTP triggers. The developer wants to reject unauthenticated calls before function code executes. Which feature should be configured?

Accepted Answer

App Service Authentication / Easy Auth with Microsoft Entra ID. App Service Authentication (Easy Auth) with Microsoft Entra ID allows the developer to reject unauthenticated calls before the function code executes by configuring the 'Action to take when request is not authenticated' to 'Log in with Microsoft Entra ID' or 'Return HTTP 401 Unauthorized'. This is enforced at the App Service platform layer, meaning the function trigger code never runs for unauthenticated requests, which is exactly the requirement.

Answer

Application Insights sampling

Answer

Deployment slots

Answer

Function timeout

Question 14

An Azure Container Instance running a claims processing function requires a password at startup. The password must not be visible in the portal or container logs. What should be used?

Accepted Answer

Secure environment variable. Secure environment variables in Azure Container Instances are encrypted at rest and in transit, and are never exposed in the Azure portal, container logs, or to other users. This ensures the password remains confidential while being available to the container at startup, meeting the requirement of not being visible in the portal or logs.

Answer

Plain environment variable

Answer

Public blob containing the password

Answer

Container command-line argument

Question 15

You are developing an application that writes blobs to Azure Blob Storage. The application requires high throughput and must handle transient failures. You need to implement a retry policy. Which approach should you use?

Accepted Answer

Configure the retry policy in the Azure.Storage.Blobs SDK. The Azure.Storage.Blobs SDK provides built-in retry policies (e.g., ExponentialRetry, FixedRetry) that handle transient failures automatically with configurable delays, retry counts, and backoff strategies. This is the recommended approach because it integrates directly with the SDK's client pipeline, respects service throttling, and avoids blocking threads or reinventing error handling logic.

Answer

Use a circuit breaker pattern

Answer

Implement a custom retry loop with Thread.Sleep

Answer

Generate a SAS token with a long expiry