AZ-204 Practice Test 16 — 15 Questions

Question 1

You are creating an Azure Functions app that uses a Blob Storage trigger to process new files. The function must process files only when they are completely written (i.e., no ongoing writes). You need to avoid processing partially written files. Which TWO configurations should you consider?

Accepted Answer

Use the 'BlobTrigger' with the 'LeaseBlob' property set to 'True'.. Option D is correct because setting the 'LeaseBlob' property to 'True' in the BlobTrigger binding acquires a lease on the blob before processing, ensuring that no other process (including ongoing writes) can modify the blob. This prevents processing partially written files. Option E is correct because setting 'ScanBlob' to 'True' forces the trigger to scan the blob's metadata and content to verify it is complete before firing, which helps avoid triggering on incomplete writes.

Answer

Increase the 'BatchSize' to reduce the frequency of trigger evaluations.

Answer

Check the blob's 'LastModified' timestamp in the function code to verify no recent changes.

Answer

Use a timer-triggered function that lists blobs and processes those with a stable size.

Question 2

You are designing a microservices solution using Azure Container Apps. One service must be exposed externally via HTTPS, while others should only be accessible within the environment. You need to configure networking for this scenario. What should you do?

Accepted Answer

Configure each container app's ingress: set the external service to 'External' and the internal services to 'Internal'.. Option C is correct because Azure Container Apps allows you to control ingress at the individual container app level. Setting the external service's ingress to 'External' makes it reachable from the internet via HTTPS, while setting internal services to 'Internal' restricts access to only within the Container Apps environment, using the internal FQDN. This provides the required isolation without needing separate environments or complex network policies.

Answer

Enable external ingress at the environment level and use network policies to restrict access.

Answer

Deploy the external service in a different environment and use an internal load balancer.

Answer

Use a Dapr sidecar to route requests between services.

Question 3

Your company develops a multi-tenant SaaS application hosted on Azure Kubernetes Service (AKS). Each tenant has isolated compute resources. You need to ensure that no single tenant can consume all cluster resources and affect others. You also want to optimize resource utilization by packing pods efficiently. You evaluate the following approaches: A) Use namespace resource quotas per tenant and let the Kubernetes scheduler handle packing. B) Deploy each tenant to a separate AKS cluster. C) Use Azure Policy to enforce pod resource limits. D) Use a service mesh to control traffic between tenants. Which approach should you recommend?

Accepted Answer

Use namespace resource quotas per tenant and let the Kubernetes scheduler handle packing.. Option A is correct because namespace resource quotas per tenant provide hard limits on compute resources (CPU, memory) and object counts, preventing any single tenant from exhausting cluster resources. The Kubernetes scheduler then efficiently packs pods within those quotas, optimizing utilization without manual intervention. This approach balances isolation and resource efficiency in a multi-tenant AKS environment.

Answer

Use a service mesh to control traffic between tenants.

Answer

Use Azure Policy to enforce pod resource limits.

Answer

Deploy each tenant to a separate AKS cluster.

Question 4

You are developing a serverless application using Azure Functions that processes order messages from an Azure Service Bus queue. Each order message is approximately 64 KB in size. The function must process messages in order and exactly once. The current implementation uses a Service Bus trigger with batch processing enabled. You notice that occasionally duplicate messages are processed. You need to ensure exactly-once processing while maintaining message ordering. What should you do?

Accepted Answer

Enable sessions on the Service Bus queue and update the function trigger to use sessions.. Option B is correct because enabling sessions on the Service Bus queue and using a session-enabled trigger guarantees message ordering and exactly-once processing. Sessions group related messages into a logical sequence, and the Service Bus trigger locks the entire session, ensuring that messages within a session are processed in order and that no other consumer can process the same session concurrently. This prevents duplicate processing while maintaining the required ordering.

Answer

Disable batch processing in the function trigger and process messages one at a time.

Answer

Increase the lock duration on the Service Bus queue to 5 minutes.

Answer

Set the maxDeliveryCount property on the queue to 1.

Question 5

You are deploying an Azure App Service that uses a Linux container to host a custom web application. You need to configure continuous deployment from a GitHub repository. Which TWO actions should you take?

Accepted Answer

Use the App Service built-in CI/CD feature to connect to GitHub.. Option B is correct because Azure App Service provides a built-in CI/CD feature that directly integrates with GitHub, enabling automatic deployment of code changes without additional configuration. Option C is also correct because the Deployment Center in App Service allows you to configure GitHub Actions as the CI/CD pipeline, which builds and deploys the container to the App Service on each push.

Answer

Set up an FTP trigger to poll the GitHub repository for changes.

Answer

Use the Kudu service to sync with GitHub.

Answer

Push the container image to Docker Hub and configure webhook.

Question 6

You are building a solution that uploads large files (up to 100 GB) to Azure Blob Storage. Users frequently experience timeout errors when uploading files over slow network connections. Which approach should you use to maximize reliability?

Accepted Answer

Use the Azure Storage SDK to upload the file as a block blob with multiple parallel blocks and implement retry logic with exponential backoff.. Option B is correct because uploading a large file as a block blob with multiple parallel blocks maximizes throughput and reliability over slow networks. The Azure Storage SDK automatically splits the file into blocks (up to 100 MB each), uploads them concurrently, and implements retry logic with exponential backoff to handle transient failures. This approach is specifically designed for large file uploads and mitigates timeout errors by keeping individual block transfers small and resumable.

Answer

Upload the file as a page blob in 512-byte chunks.

Answer

Increase the client-side timeout value to 10 minutes.

Answer

Use AzCopy with the /Z parameter to enable checkpointing.

Question 7

You are developing an application that stores sensitive user data in Azure Table Storage. You need to ensure that data is encrypted at rest and that only authorized users can access it. What should you implement?

Accepted Answer

Enable Azure Storage Service Encryption (SSE) and use Microsoft Entra ID for authentication.. Option B is correct because Azure Storage Service Encryption (SSE) is enabled by default for all storage accounts, encrypting data at rest. Additionally, using Microsoft Entra ID (formerly Azure AD) for authentication provides fine-grained access control via RBAC. Option A is wrong because client-side encryption is possible but not required; SSE already provides at-rest encryption. Option C is wrong because shared access signatures (SAS) provide delegated access but do not enforce RBAC. Option D is wrong because Azure Information Protection is a data classification solution, not for encryption.

Answer

Apply Azure Information Protection labels to the storage account.

Answer

Implement client-side encryption using the Azure Storage SDK and manage keys via Azure Key Vault.

Answer

Use shared access signatures (SAS) with a stored access policy to limit access to the data.

Question 8

You are designing a solution that requires atomic operations on a counter stored in Azure Blob Storage. The counter must be updated by multiple instances without conflicts. Which approach should you use?

Accepted Answer

Store the counter in Azure Cosmos DB and use stored procedures to increment atomically.. Option A is correct because Azure Cosmos DB stored procedures execute within the database engine's transactional scope, providing ACID-compliant atomic operations. This ensures that concurrent increments from multiple instances are serialized without conflicts, which is not natively supported by Azure Blob Storage's eventual consistency model.

Answer

Use Azure Queue Storage to queue increment messages.

Answer

Store the counter in Azure Table Storage and use optimistic concurrency with ETags.

Answer

Use Append Blob to append each increment as a new block and sum them later.

Question 9

You need to grant a user from another Microsoft Entra ID tenant access to a specific blob container in your Azure Storage account. The solution must use Azure RBAC and minimize administrative overhead. What should you do?

Accepted Answer

Invite the user as a guest in your Microsoft Entra ID tenant and assign the Storage Blob Data Reader role to the container.. Option B is correct because it uses Azure RBAC to grant cross-tenant access by inviting the user as a guest in your Microsoft Entra ID tenant, then assigning the Storage Blob Data Reader role at the container scope. This minimizes administrative overhead by leveraging existing role assignments without managing shared keys or SAS tokens, and it follows the principle of least privilege by scoping access to a specific container.

Answer

Generate a shared access signature (SAS) with read permissions for the container.

Answer

Add the user as a Storage Blob Data Reader at the storage account level.

Answer

Share the storage account key with the user.

Question 10

You need to provide temporary access to a file in Azure Blob Storage for a duration of one hour. The solution must not require authentication. What should you generate?

Accepted Answer

A shared access signature (SAS) with read permission and an expiration time of one hour.. Option D is correct because a shared access signature (SAS) with read permission and a one-hour expiration provides time-limited, delegated access to a specific blob without requiring authentication. The SAS token is appended to the URL and grants the specified permissions for the defined duration, meeting the requirement of temporary access without authentication.

Answer

Storage account key.

Answer

Enable anonymous public read access on the container.

Answer

A user delegation key.

Question 11

You have an Azure Storage account with hierarchical namespace enabled (Azure Data Lake Storage Gen2). You need to provide an application with delegated access to a specific directory and its contents, with the ability to list, read, and write files. The access must be scoped to the directory and not allow access to other parts of the storage account. Which approach should you use?

Accepted Answer

Configure access control lists (ACLs) on the directory and assign the application's managed identity.. Option C is correct because Azure Data Lake Storage Gen2 supports POSIX-like access control lists (ACLs) that can grant granular permissions to a specific directory and its contents. By configuring ACLs on the target directory and assigning the application's managed identity, you can precisely scope list, read, and write access to that directory without affecting other parts of the storage account. This approach avoids the need for account-level keys or RBAC roles, which would grant broader permissions.

Answer

Generate a shared access signature (SAS) token for the directory.

Answer

Assign the 'Storage Blob Data Contributor' RBAC role to the application at the storage account level.

Answer

Use the storage account access key in the application.

Question 12

You are designing a solution that stores customer order data in Azure Table Storage. The data includes OrderID (string), CustomerID (string), OrderDate (datetime), and TotalAmount (decimal). You need to query orders for a specific customer within a date range efficiently. Which partition key and row key design should you use?

Accepted Answer

PartitionKey = CustomerID, RowKey = OrderDate (inverted ticks for descending order). Option B is correct because Azure Table Storage queries are most efficient when they use PartitionKey for exact matches and RowKey for range scans. By setting PartitionKey = CustomerID, all orders for a specific customer are stored in the same partition, allowing fast retrieval. Using RowKey = OrderDate (inverted ticks for descending order) enables efficient date-range filtering within that partition, as Azure Table Storage supports range queries on RowKey.

Answer

PartitionKey = OrderDate, RowKey = OrderID

Answer

PartitionKey = OrderDate, RowKey = CustomerID

Answer

PartitionKey = OrderID, RowKey = CustomerID

Question 13

Which TWO of the following are valid methods for authenticating to Azure Blob Storage?

Accepted Answer

Shared Key (storage account key). Option C is correct because the Shared Key (storage account key) method uses the HMAC-SHA256 algorithm to sign a request string with the storage account key, providing full administrative access to the storage account. Option D is correct because Azure AD authentication with RBAC allows fine-grained access control to blob containers and blobs without exposing account keys, using OAuth 2.0 tokens.

Answer

Connection string with account key

Answer

Shared access signature (SAS) token

Answer

Client certificate authentication

Question 14

Your application uses Azure Blob Storage to store images. You need to automatically move blobs older than 30 days to the Cool tier and delete blobs older than 365 days. What should you implement?

Accepted Answer

Azure Blob Storage lifecycle management policy. Azure Blob Storage lifecycle management policies allow you to define rules that automatically transition blobs to cooler tiers (e.g., Cool) after a specified number of days and delete them after a different number of days. This is the native, cost-effective, and fully managed solution for automating tier transitions and deletions based on blob age, without requiring external compute or orchestration services.

Answer

Azure Automation runbook on a schedule

Answer

Azure Logic Apps with recurrence trigger

Answer

Azure Event Grid subscription with blob created event

Question 15

You are developing an application that uses Azure Queue Storage. The application processes messages and must ensure that a message is not lost if the processing fails. Which visibility timeout setting should you use?

Accepted Answer

Set a short visibility timeout like 30 seconds. Option A is correct because setting a short visibility timeout (e.g., 30 seconds) ensures that if message processing fails, the message becomes visible again quickly for retry, preventing permanent loss. Azure Queue Storage uses a visibility timeout to hide a dequeued message from other consumers; if the processing fails and the message is not deleted, it reappears after the timeout expires. A short timeout balances retry speed with processing time, avoiding indefinite hiding that could lead to message loss if the consumer crashes.

Answer

Set visibility timeout to 1 hour

Answer

Set visibility timeout to infinite

Answer

Set visibility timeout to 0 seconds