AZ-204 Practice Test 18 — 15 Questions

Question 1

Your application uses Azure Cosmos DB for NoSQL. You need to query items by a property that is not the partition key. The container has 10,000 RU/s. How can you optimize this query to minimize cost and latency?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a composite index that includes the property and the partition key.. Creating a composite index that includes the queried property and the partition key allows the query to be served efficiently from a single physical partition, avoiding a costly cross-partition fan-out. This reduces both RU consumption and latency, as the query can use the index without scanning all partitions.

Answer

Increase the RU/s to handle cross-partition queries.

Answer

Change the partition key to the property you query on.

Answer

Enable analytical store and use Synapse Link.

Question 2

You are designing a solution that writes millions of small log records (each 200 bytes) to Azure Blob Storage. The logs are written every second, always appended to a single file. The file must be read periodically by a batch process that reads the entire file. You need to maximize write throughput and minimize storage costs. Which blob type and access strategy should you choose?

Accepted Answer

Use Append blobs and write each log entry as an append block. Append blobs are optimized for append operations, making them ideal for writing millions of small log records sequentially to a single file. Data is written in append blocks. For millions of small log entries, these entries would typically be buffered and written together as larger append blocks (up to 4 MB each) to optimize performance and and stay within the append blob's 50,000 block limit. This provides high throughput for append-heavy workloads and minimizes storage costs by storing data in a single blob.

Answer

Use Block blobs and append the data to a single blob

Answer

Use Page blobs and write each log entry to a page

Answer

Use Block blobs and create a new blob for each log entry

Question 3

You are designing a solution that uses Azure Batch for parallel processing of large datasets. Each task requires significant CPU and memory. You need to minimize compute costs while ensuring tasks complete within a deadline. Which pool configuration should you use?

Accepted Answer

Low-priority VMs with a task retry policy. Low-priority VMs (now called Spot VMs) offer significant cost savings but can be preempted. Using them with a task retry policy ensures completion. Dedicated VMs are more expensive.

Answer

A mix of dedicated and low-priority VMs without retry

Answer

Use Azure Container Instances instead of Batch

Answer

Dedicated VMs only

Question 4

You are developing a solution that uses Azure Container Registry (ACR) to store Docker images. You need to ensure that only authorized users can deploy images from ACR to an AKS cluster. What should you do?

Accepted Answer

Use the AKS cluster's managed identity with AcrPull role assignment.. Using an AKS cluster's managed identity with the AcrPull role assignment enables secure, password-less authentication to ACR. Option A is incorrect because AKS RBAC controls Kubernetes resources, not ACR permissions. Option B is incorrect because storing ACR credentials as Kubernetes secrets is less secure and requires manual management. Option D is incorrect because enabling the admin account on ACR is a shared credential approach that is not recommended for production.

Answer

Configure AKS RBAC to limit image pull permissions.

Answer

Use Kubernetes secrets to store ACR credentials.

Answer

Enable the admin account on ACR and use the credentials in AKS.

Question 5

Your company wants to send email notifications to users via a third-party email service (SendGrid) from an Azure Logic App. What is the recommended way to securely store the SendGrid API key?

Accepted Answer

Store the API key in Azure Key Vault and use a managed identity to retrieve it. Azure Key Vault securely stores secrets and can be accessed by Logic Apps via managed identity, providing the most secure and recommended approach. Option B is wrong because app settings are less secure and can be exposed in configuration files or logs. Option C is wrong because hardcoding secrets in workflow definitions is insecure and violates best practices. Option D is wrong because environment variables are not specifically designed for secret management and lack the security controls of Key Vault.

Answer

Store the API key in an App Setting of the Logic App

Answer

Hardcode the API key in the Logic App workflow definition

Answer

Store the API key in an environment variable on the integration service environment

Question 6

You develop an app that uses Azure Cosmos DB for NoSQL. The app requires reading a specific item by ID with low latency. You need to ensure the query is as fast as possible. What should you use?

Accepted Answer

Use a point read with the item's ID and partition key.. A point read by ID and partition key is the fastest operation in Cosmos DB, directly accessing the item without query engine overhead. Option A is wrong because stored procedures still involve query processing and are not as fast as point reads. Option B is wrong because cross-partition queries add latency. Option D is wrong because even with a composite index, a SQL query requires query engine processing, whereas a point read is a direct lookup.

Answer

Use a stored procedure that reads the item.

Answer

Use a SQL query filtering by ID without partition key.

Answer

Use a SQL query with a composite index on ID.

Question 7

A company uses Azure API Management (APIM) to expose a set of REST APIs. A new requirement mandates that all API calls must be throttled per user based on usage tiers (Free, Basic, Premium). User identity is provided via a JWT token. Which policy should the developer configure in APIM to enforce this throttling?

Accepted Answer

rate-limit-by-key policy. The rate-limit-by-key policy is correct because it allows throttling based on a specific key extracted from the request, such as the user identity from a JWT token. This policy enables per-user rate limiting by using a policy expression to extract the 'sub' claim or a custom claim from the JWT as the counter key, which maps directly to the usage tiers requirement.

Answer

rate-limit policy

Answer

quota-by-key policy

Answer

IP-based throttling

Question 8

A company integrates an Azure Logic App with Microsoft Teams to send notifications when a new file is added to an Azure Blob storage container. The Logic App currently polls the blob container every minute. They want to reduce latency and avoid polling. What should they do?

Accepted Answer

Add an Event Grid subscription to the blob storage.. Azure Event Grid provides a reactive, event-driven model that eliminates the need for polling. By subscribing to the Blob Storage 'BlobCreated' event, the Logic App is triggered instantly when a new file is added, reducing latency to near real-time. This aligns with the requirement to avoid polling and improve responsiveness.

Answer

Increase the polling frequency to every 10 seconds.

Answer

Use Azure Data Factory to monitor the storage.

Answer

Use Azure Service Bus topics for file notifications.

Question 9

Your application runs on Azure App Service and needs to access Azure Queue Storage. You want to avoid storing connection strings in configuration files. Which approach should you use?

Accepted Answer

Use a system-assigned managed identity with RBAC role 'Storage Queue Data Contributor' on the queue.. Using a system-assigned managed identity for an Azure App Service allows it to authenticate to Azure Queue Storage without any stored secrets. By assigning the 'Storage Queue Data Contributor' RBAC role, the app gains the necessary permissions to read, write, and delete queue messages, and the identity is automatically managed by Azure AD, eliminating the need for connection strings.

Answer

Hardcode the connection string in the application code.

Answer

Use an environment variable in the App Service configuration.

Answer

Store the connection string in Azure Key Vault and retrieve it at runtime using Key Vault references.

Question 10

A report export service hosted on App Service returns intermittent 502 errors during deployment. The team wants zero-downtime release with validation before traffic moves. What should be implemented?

Accepted Answer

Deploy to a staging slot, validate health, then swap. Deploying to a staging slot and then swapping with production ensures zero-downtime because the swap operation warms up the target slot (staging) before routing traffic to it. The health check validation before swap confirms the new release is stable, preventing 502 errors from reaching users. This approach leverages Azure App Service deployment slots, which support traffic routing and warm-up during swap.

Answer

Deploy directly to production during business hours

Answer

Restart the App Service plan before each deployment

Answer

Disable health checks

Question 11

You need to store large files that are written once and then frequently read for the first 30 days. After 30 days, the files are rarely accessed (once or twice per year) but must remain available for 5 years. You want to minimize storage costs. Which storage tier and lifecycle management rule should you apply?

Accepted Answer

Hot tier with a lifecycle rule to move to Cool after 30 days. The Hot tier is optimized for frequent reads, and the lifecycle rule moves data to the Cool tier after 30 days when access drops, balancing performance and cost. After 30 days, the files are rarely accessed, so moving them to Cool (not Archive) keeps them available for occasional reads without the high retrieval costs and latency of Archive. This minimizes storage costs while meeting the 5-year retention requirement.

Answer

Cool tier with a lifecycle rule to move to Archive after 30 days

Answer

Hot tier with a lifecycle rule to move to Archive after 30 days

Answer

Archive tier with a lifecycle rule to move to Cool after 30 days

Question 12

Refer to the exhibit. You are configuring Azure Monitor autoscale for a virtual machine scale set using the above JSON metric configuration. The autoscale rule is supposed to scale out when average memory usage exceeds 80%. However, autoscale is not triggering even when memory usage is consistently above 90%. What is the most likely cause?

Accepted Answer

The autoscale rule condition is not configured to use this metric.. The exhibit shows a metric configuration, but the autoscale rule itself must explicitly reference that metric in its condition. Without a rule condition that uses this metric, autoscale will not evaluate it, regardless of how the metric is configured. The JSON snippet only defines the metric source, not the scaling rule logic.

Answer

The aggregation interval is too long; it should be set to 1 minute.

Answer

The metric name is incorrect; it should be 'Percentage Memory'.

Answer

The aggregation type should be 'Maximum' instead of 'Average'.

Question 13

Your company develops a microservices-based application deployed on Azure Kubernetes Service (AKS). One of the microservices is a web API that processes user uploads and stores them in Azure Blob Storage. The API is stateless and scales horizontally. You need to implement authentication and authorization for the API using Microsoft Entra ID. The API should validate tokens issued by Entra ID and allow only users with the 'Files.Upload' scope. You need to configure the API's code and AKS deployment accordingly. Which approach should you use?

Accepted Answer

Use Azure AD pod identity in AKS to assign a managed identity to the pod, and implement token validation in the API code using the Microsoft.Identity.Web library.. Azure AD pod identity allows you to assign a managed identity to the pod, which the API can use to authenticate with Microsoft Entra ID. The Microsoft.Identity.Web library simplifies token validation and scope checking in ASP.NET Core applications, enabling the API to validate tokens issued by Entra ID and enforce the 'Files.Upload' scope. This approach aligns with the stateless, horizontally scalable nature of the microservice and avoids managing secrets.

Answer

Store the storage account access keys in the API configuration and validate requests using shared access signatures.

Answer

Configure the API to use client certificate authentication instead of tokens.

Answer

Expose the API through Azure API Management (APIM) and configure APIM to validate tokens and check scope.

Question 14

Northwind Traders is building a microservices architecture on Azure Kubernetes Service (AKS). One service needs to read messages from an Azure Service Bus queue and write them to an Azure SQL database. The solution must use managed identities for authentication. The AKS cluster is integrated with Microsoft Entra ID. The development team wants to avoid managing service principals and secrets. The team has chosen to use the Azure Identity SDK for authentication. The service will run as a pod in AKS. Which approach should the team use to authenticate to Service Bus and Azure SQL Database?

Accepted Answer

Deploy Azure AD Pod Identity (or Workload Identity) to assign a user-assigned managed identity to the pod. Use DefaultAzureCredential in the code. Grant the identity 'Listen' on Service Bus and 'Connect' on SQL Database.. Azure AD Pod Identity (or Workload Identity) allows you to assign a user-assigned managed identity to a pod, eliminating the need to manage service principals or secrets. The DefaultAzureCredential from the Azure Identity SDK automatically uses the pod's managed identity to authenticate to Azure services. Granting the identity 'Listen' on Service Bus and 'Connect' on SQL Database provides the minimum required permissions for the service to read messages and write to the database.

Answer

Generate a self-signed certificate, upload it to AKS, and use ClientCertificateCredential in the code.

Answer

Store Service Bus connection string and SQL connection string in Azure Key Vault. Use Key Vault SDK to retrieve them at runtime.

Answer

Create a service principal and store its client secret in a Kubernetes secret. Use ClientSecretCredential in the code. Assign the service principal permissions to Service Bus and SQL.

Question 15

You are developing a solution that processes large files uploaded to Azure Blob Storage. Each file must be processed by a long-running operation that may take up to 30 minutes. You need to use Azure Functions with a consumption plan. How should you handle the processing?

Accepted Answer

Use Durable Functions with a blob-triggered client function. D is correct because Azure Functions on a Consumption Plan have a default timeout of 5 minutes and a maximum of 10 minutes. A blob-triggered client function can start a Durable Functions orchestration, which can run for up to 30 minutes (or longer) by using the orchestration's timeout and retry capabilities, avoiding the Consumption Plan's timeout limit.

Answer

Use a Blob trigger function with a retry policy

Answer

Increase the function timeout to 30 minutes

Answer

Use an Event Grid trigger function to process the blob