AZ-204 Practice Test 17 — 15 Questions

Question 1

You have an Azure Function app that uses .NET 8 isolated process. The function must connect to an Azure SQL database using a managed identity. The function app has a system-assigned managed identity enabled. Which code snippet correctly retrieves the access token?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

var credential = new DefaultAzureCredential(); var token = await credential.GetTokenAsync(new TokenRequestContext(new[] {"https://database.windows.net/.default"}));. It uses `DefaultAzureCredential` to obtain an access token for Azure SQL Database by specifying the resource URI `https://database.windows.net/.default` in a `TokenRequestContext`. In a .NET 8 isolated process function app with a system-assigned managed identity, `DefaultAzureCredential` automatically attempts managed identity authentication as one of its credential sources, making it the recommended approach. The `GetTokenAsync` method requires a `TokenRequestContext` object, not a plain string, to correctly request the token for the Azure SQL resource.

Answer

new SqlConnection(connectionString) using Integrated Security=true;

Answer

var token = await new Azure.Identity.DefaultAzureCredential().GetTokenAsync("https://database.windows.net");

Answer

var credential = new ManagedIdentityCredential(); var token = await credential.GetTokenAsync("https://database.windows.net");

Question 2

Refer to the exhibit. You are reviewing an Azure Policy definition. When applied to a subscription, what is the effect of this policy?

Accepted Answer

Deny deployment of resources in locations other than eastus or westus. The policy definition uses the 'deny' effect with a condition that evaluates to true when the resource location is not equal to 'eastus' or 'westus'. This means any deployment attempt to a region outside these two will be blocked. The 'deny' effect prevents the resource creation entirely, rather than just auditing or modifying it.

Answer

Audit resources in locations other than eastus or westus

Answer

Append a tag to resources in eastus or westus

Answer

Deny deployment of resources in eastus or westus

Question 3

An application uses Azure Functions with a Durable Functions extension to orchestrate a workflow. The workflow calls multiple external APIs. The developer needs to handle transient failures when calling these APIs. Which pattern should the developer implement?

Accepted Answer

Implement retry logic with exponential backoff. Durable Functions provides built-in support for automatic retry with exponential backoff via the `CallActivityWithRetryAsync` method or by configuring retry policies in orchestrator functions. This pattern is specifically designed to handle transient failures when calling external APIs, as it automatically retries failed operations with increasing delays, reducing load on the downstream service and improving resilience.

Answer

Use a saga pattern

Answer

Use a request-reply pattern

Answer

Use a circuit breaker pattern

Question 4

You are developing a web application that uses Azure Cosmos DB for NoSQL. You need to perform a point read by document ID and partition key. Which API method should you use to achieve the best performance and lowest cost?

Accepted Answer

Call ReadItemAsync with the partition key and document ID.. The `ReadItemAsync` method is the most efficient way to perform a point read in Azure Cosmos DB for NoSQL because it directly accesses the document by its partition key and ID, using the resource ID (self-link) for a single request unit (RU) cost of exactly 1 RU for a 1 KB document. This bypasses the query engine entirely, providing the lowest latency and cost.

Answer

Call QueryAsync with a SQL query that filters by ID.

Answer

Call CreateItemAsync and check for conflict.

Answer

Call ReadManyAsync with a list of IDs.

Question 5

Refer to the exhibit. You have a custom RBAC role definition. A user assigned this role reports they can read, write, and delete blobs, but cannot list the containers in the storage account. What is the most likely reason?

Accepted Answer

The user does not have the Reader role on the storage account to navigate in the Azure portal.. The user can perform blob operations (read, write, delete) because the custom RBAC role includes the necessary data actions (e.g., Microsoft.Storage/storageAccounts/blobServices/containers/blobs/*). However, listing containers requires the control plane action Microsoft.Storage/storageAccounts/blobServices/containers/read, which is not included in the role. Without the Reader role on the storage account (which grants this action), the user cannot list containers in the Azure portal, even though they can interact with blobs directly via tools that bypass the portal's container enumeration.

Answer

The role does not grant delete permissions on containers.

Answer

The role lacks dataActions for reading blobs.

Answer

The role does not include the action to list containers.

Question 6

Refer to the exhibit. You deployed an Azure Storage account with this ARM template. Users outside the allowed IP range receive '403 Forbidden' errors. What is the MOST likely cause?

Accepted Answer

The network ACL default action is Deny. The default action for network ACLs in Azure Storage is 'Deny' when no explicit rules match. Since the ARM template only allows traffic from the IP range 203.0.113.0/24, all other IP addresses are implicitly denied, resulting in 403 Forbidden errors for users outside that range.

Answer

The access tier is Cool

Answer

The minimum TLS version is set to TLS1_2

Answer

The IP rule allows only 203.0.113.0/24

Question 7

You are developing a microservices application deployed on Azure Kubernetes Service (AKS). You need to ensure that service-to-service communication is encrypted using mutual TLS (mTLS) without modifying application code. What should you do?

Accepted Answer

Deploy Azure Service Mesh and enable mTLS.. Azure Service Mesh (e.g., Open Service Mesh or Istio-based) provides a transparent infrastructure layer that can automatically inject sidecar proxies into pods and enforce mTLS for all service-to-service communication without requiring any changes to application code. This meets the requirement of encrypting traffic with mutual TLS while keeping the application code untouched.

Answer

Use Azure Application Gateway Ingress Controller with mTLS.

Answer

Enable Azure Kubernetes Service (AKS) pod-to-pod encryption.

Answer

Configure Azure Network Security Groups to enforce encryption.

Question 8

Your company wants to implement a zero-trust security model for its Azure resources. Which THREE practices should you adopt? (Choose three.)

Accepted Answer

Implement just-in-time (JIT) access for administrative roles. Just-in-time (JIT) access for administrative roles reduces the attack surface by granting elevated permissions only when needed and for a limited time. In Azure, JIT is implemented via Azure AD Privileged Identity Management (PIM), which enforces activation requests, approval workflows, and automatic deactivation. This aligns with the zero-trust principle of 'never trust, always verify' by minimizing standing privileges.

Answer

Place all resources behind a firewall

Answer

Use a VPN to connect to the corporate network

Question 9

Which THREE are best practices for implementing an API using Azure API Management? (Choose three.)

Accepted Answer

Use policies to enforce throttling and quotas.. A is correct because Azure API Management policies allow you to enforce throttling and quotas at the API level, protecting your backend from excessive traffic. By defining rate limits and quota policies, you can control the number of requests a client can make within a specified time window, ensuring fair usage and preventing abuse.

Answer

Use the Consumption tier for production APIs with custom domains.

Answer

Expose the backend service URLs directly to clients.

Question 10

Which TWO are best practices when using Azure Service Bus for high-throughput messaging?

Accepted Answer

Enable batching of messages when sending. Enabling batching allows the client to accumulate multiple messages into a single AMQP or SBMP frame, reducing the number of network round trips and improving throughput. This is particularly effective in high-throughput scenarios where the overhead of individual sends becomes a bottleneck.

Answer

Enable duplicate detection for all queues

Answer

Use sessions to guarantee ordering

Answer

Send messages larger than 256 KB to reduce the number of messages

Question 11

Which TWO of the following are valid ways to authenticate an Azure function to an Azure SQL database using managed identity?

Accepted Answer

Create a user-assigned managed identity, assign it to the function app, and use its client ID in the connection string.. A user-assigned managed identity can be created, assigned to the function app, and then used in the SQL connection string by specifying the client ID (e.g., 'User ID=<client_id>;Authentication=Active Directory Managed Identity;'). This allows the function to authenticate to Azure SQL without storing credentials. Option E is also correct because enabling a system-assigned managed identity and setting the connection string with 'Authentication=Active Directory Managed Identity' lets the function app authenticate using its own identity, which is automatically managed by Azure.

Answer

Create a service principal and assign it to the function app.

Answer

Use the function app's default connection string with a username and password.

Answer

Upload a client certificate to the function app and use it to authenticate.

Question 12

Match each Azure compute service to its execution model.

Accepted Answer

Azure Functions: Serverless, event-driven compute that runs code in response to triggers. Azure compute services offer different execution models: Azure Functions (serverless, event-driven), Azure Logic Apps (serverless workflow), Azure Kubernetes Service (container orchestration). Common confusions involve associating serverless with containers or PaaS with orchestration.

Answer

Azure Container Instances: Serverless, event-driven compute that runs code in response to triggers

Answer

Azure App Service: Container orchestration for managing and scaling clusters of containerized applications

Question 13

Your company develops a multi-tenant SaaS application hosted on Azure Kubernetes Service (AKS). Each tenant has isolated compute resources. You need to ensure that no single tenant can consume all cluster resources and affect others. You also want to optimize resource utilization by packing pods efficiently. You evaluate the following approaches: A) Use namespace resource quotas per tenant and let the Kubernetes scheduler handle packing. B) Deploy each tenant to a separate AKS cluster. C) Use Azure Policy to enforce pod resource limits. D) Use a service mesh to control traffic between tenants. Which approach should you recommend?

Accepted Answer

Use namespace resource quotas per tenant and let the Kubernetes scheduler handle packing.. Namespace resource quotas per tenant provide hard limits on compute resources (CPU, memory) and object counts, preventing any single tenant from exhausting cluster resources. The Kubernetes scheduler then efficiently packs pods within those quotas, optimizing utilization without manual intervention. This approach balances isolation and resource efficiency in a multi-tenant AKS environment.

Answer

Use a service mesh to control traffic between tenants.

Answer

Use Azure Policy to enforce pod resource limits.

Answer

Deploy each tenant to a separate AKS cluster.

Question 14

A production API needs proactive alerting for high telemetry cost. Which two elements are required for a useful Azure Monitor alert?

Accepted Answer

A signal or metric/log query that detects the condition. An Azure Monitor alert requires a signal—either a metric (e.g., number of API calls, or a custom metric for telemetry cost) or a log query (e.g., Application Insights traces analyzed for cost patterns)—that defines the condition to detect high telemetry cost. Without this signal, the alert has no data source to evaluate against a threshold or pattern, making proactive detection impossible. Additionally, a useful alert requires an action group to define what happens when the alert condition is met, such as sending notifications (email, SMS) or triggering automated actions (webhooks, runbooks). Without an action group, the alert would trigger but provide no practical benefit.

Answer

A public IP address on the app

Answer

A manually exported CSV report

Question 15

Trey Research uses Azure Service Bus for messaging between microservices. One microservice written in Node.js needs to send messages to a queue. The team wants to use managed identity to authenticate to Service Bus. The microservice runs in an Azure Container Instance (ACI) with a user-assigned managed identity. The identity has been granted 'Sender' role on the Service Bus namespace. The team uses the @azure/service-bus SDK. Which code snippet should the developer use to create a ServiceBusClient?

Accepted Answer

const { ServiceBusClient } = require('@azure/service-bus'); const { DefaultAzureCredential } = require('@azure/identity'); const credential = new DefaultAzureCredential(); const sbClient = new ServiceBusClient('<namespace>.servicebus.windows.net', credential);. DefaultAzureCredential (option B) is the correct choice because it automatically uses the managed identity of the Azure resource (ACI) when the environment variable AZURE_CLIENT_ID is set to the user-assigned identity's client ID. This approach works without hardcoding credentials. Option A (InteractiveBrowserCredential) is for interactive user scenarios and is inappropriate for a server-side application. Option C (ManagedIdentityCredential) would also work but requires explicitly passing the client ID, which is less flexible and not the recommended pattern. Option D uses a connection string, bypassing managed identity entirely.

Answer

const { ServiceBusClient } = require('@azure/service-bus'); const { InteractiveBrowserCredential } = require('@azure/identity'); const credential = new InteractiveBrowserCredential(); const sbClient = new ServiceBusClient('<namespace>.servicebus.windows.net', credential);

Answer

const { ServiceBusClient } = require('@azure/service-bus'); const { ManagedIdentityCredential } = require('@azure/identity'); const credential = new ManagedIdentityCredential(''); const sbClient = new ServiceBusClient('.servicebus.windows.net', credential);

Answer

const { ServiceBusClient } = require('@azure/service-bus'); const sbClient = new ServiceBusClient('<connection-string>');