AZ-204 Practice Test 18 — 15 Questions

Question 1

You need to securely transfer an on-premises database backup to Azure Blob Storage. The backup file is 500 GB. You have limited bandwidth (10 Mbps) and need the transfer to complete within 24 hours. What is the best solution?

Accepted Answer

Use Azure Data Box to physically ship the data to Azure.. Given the 500 GB backup file and a 10 Mbps bandwidth limit, the theoretical maximum transfer time over the internet is approximately 500 GB * 8 bits/byte / (10 Mbps) = 400,000 seconds ≈ 111 hours, far exceeding the 24-hour requirement. Azure Data Box is the best solution because it allows you to physically ship the data on a secure, ruggedized device, bypassing network constraints entirely and ensuring the transfer completes within the required timeframe.

Answer

Use Azure File Sync to replicate the backup to Azure Files.

Answer

Use AzCopy to copy the backup file directly to Blob Storage.

Answer

Set up an ExpressRoute connection and use AzCopy.

Question 2

Which THREE are valid ways to authenticate to Azure Blob Storage from an application? (Choose three.)

Accepted Answer

Use the storage account access key.. Option A is correct because the storage account access key provides full administrative access to the storage account, including Blob Storage. It is a simple, shared-key authentication method using HMAC-SHA256 to sign requests, and is commonly used for development or scenarios where fine-grained access control is not required.

Answer

Use an OAuth2 token obtained from Microsoft Entra ID for a user.

Answer

Use a client certificate.

Question 3

You are developing a web application that uses Azure Files shares for storing user documents. Users complain that they sometimes see stale file listings. The application uses the SMB protocol. What should you do to ensure the file listing is always current?

Accepted Answer

Set the SMB_DIRECTORY_CACHE_MAX_AGE registry key to 0 on clients.. Option A is correct because the SMB protocol caches directory listings on the client side to improve performance. By setting the SMB_DIRECTORY_CACHE_MAX_AGE registry key to 0, you disable this caching, forcing the client to always fetch the latest directory listing from the Azure file share. This ensures that users see current file listings instead of stale cached data.

Answer

Enable soft delete for the file share.

Answer

Switch to using REST API for file listings.

Answer

Disable CDN caching for the storage account.

Question 4

You are implementing a microservices solution on Azure Kubernetes Service (AKS). You need to securely store and retrieve connection strings to a database without hardcoding them in the application code. The solution should automatically rotate secrets every 90 days. What should you use?

Accepted Answer

Azure Key Vault with Key Vault Secrets Provider for AKS. Azure Key Vault with the Key Vault Secrets Provider for AKS allows mounting secrets as volumes, and Key Vault supports automatic rotation and versioning. Option A is correct because it integrates rotation. Option B lacks automatic rotation. Option C is for non-Kubernetes environments. Option D is a service not a store.

Answer

Kubernetes Secrets with a CronJob to update them

Answer

Azure Managed Identity for the pod

Answer

Azure App Configuration with a managed identity

Question 5

Your company uses Azure DevOps for CI/CD. The security team requires that all pull request (PR) merges to the main branch be signed with a valid code signing certificate to ensure code integrity. Which Azure DevOps feature should you enforce?

Accepted Answer

Set up branch protection with 'Require a merge commit' and enable 'Require signed commits'. Branch policy with 'Require a merge commit' forces signed commits; the policy can require a valid signature from a trusted certificate. Option A is required for infrastructure. Option C is for governance. Option D is for pipeline validation, not commit signing.

Answer

Configure a service hook to validate signatures using Azure Functions

Answer

Use Azure Policy to require code signing on the repository

Answer

Add a build validation step in the PR pipeline that checks signatures

Question 6

You are developing an Azure Function that processes messages from an Azure Service Bus queue. The function must use a managed identity to authenticate to the Service Bus to avoid managing secrets. Which configuration step is essential for this setup?

Accepted Answer

Enable system-assigned managed identity on the function app and assign the 'Azure Service Bus Data Receiver' role to the identity. Option C is correct because using a managed identity eliminates the need to manage secrets or connection strings. By enabling a system-assigned managed identity on the function app and assigning the 'Azure Service Bus Data Receiver' role to that identity, the function can authenticate to Azure Service Bus via Azure AD (OAuth 2.0) without any stored credentials. This is the recommended approach for secure, secretless authentication in Azure Functions.

Answer

Store the Service Bus connection string in the function app settings

Answer

Create a Key Vault reference to the connection string

Answer

Use the Service Bus SDK with a SharedAccessSignatureToken

Question 7

Your organization uses Azure Policy to enforce compliance. You need to ensure that all Azure SQL databases have Advanced Data Security (ADS) enabled. What type of Azure Policy effect should you use to automatically enable ADS if it is not already enabled?

Accepted Answer

DeployIfNotExists. DeployIfNotExists effect can deploy a resource or configuration if it does not exist. Option A is correct. Option B audits but doesn't remediate. Option C denies non-compliant resources but does not automatically enable. Option D is for removing resources.

Answer

Audit

Answer

Modify

Answer

Deny

Question 8

Which THREE permissions should be granted to an application's managed identity to allow it to read secrets from Azure Key Vault and use them to access Azure Storage?

Accepted Answer

Key Vault Secrets User role (includes get and list). Option D is correct because the Key Vault Secrets User role grants the 'get' and 'list' permissions on secrets, which is exactly what the application's managed identity needs to read secrets from Azure Key Vault. Option E is correct because the Storage Blob Data Contributor role on the storage account provides the necessary permissions to access and use the storage account (e.g., read/write blobs) after retrieving the secret (such as a connection string or key). Together, these two roles enable the managed identity to both retrieve secrets and access Azure Storage.

Answer

Key Vault Crypto User role

Answer

Key Vault Secrets Officer role (includes all operations)

Answer

Key Vault Reader role

Question 9

Your application uses Azure Functions and needs to authenticate to a downstream API using OAuth 2.0. The function app uses a system-assigned managed identity. Which token endpoint should the function app call to get a token for the downstream API?

Accepted Answer

http://169.254.169.254/metadata/identity/oauth2/token. The managed identity endpoint (http://169.254.169.254/metadata/identity/oauth2/token) is the Azure Instance Metadata Service (IMDS) endpoint that provides tokens for managed identities. Option A is wrong because the Entra ID token endpoint is for client credentials flow without managed identity. Option B is wrong because the function app's own endpoint is irrelevant. Option D is wrong because the downstream API's endpoint is not for token acquisition.

Answer

https://{function-app}.azurewebsites.net/.auth/login

Answer

https://{downstream-api}.azurewebsites.net/.auth/me

Answer

https://login.microsoftonline.com/{tenant}/oauth2/v2.0/token

Question 10

Your application uses Azure App Configuration with Microsoft Entra ID authentication. You want to ensure that only authorized services can read configuration values. What is the recommended approach?

Accepted Answer

Assign the App Configuration Data Reader role to the managed identity of the consuming service. Using managed identities with role-based access control (RBAC) is the recommended way to grant access to Azure App Configuration without managing credentials.

Answer

Enable public network access only from trusted IPs

Answer

Use access keys and rotate them frequently

Answer

Store connection strings in Azure Key Vault and retrieve them at runtime

Question 11

A company uses Azure Blob Storage to store sensitive documents. They want to ensure that data is encrypted at rest using customer-managed keys (CMK) stored in Azure Key Vault. They also need to be able to revoke access to the data immediately if a security breach is detected. Which feature should they enable?

Accepted Answer

Configure Azure Storage encryption with customer-managed keys in Azure Key Vault and enable soft delete and purge protection.. Option D is correct because enabling double encryption with CMK and then revoking the key in Key Vault renders the data inaccessible. Option A is wrong because infrastructure encryption uses platform-managed keys, not CMK. Option B is wrong because client-side encryption is performed by the client, not server-side. Option C is wrong because storage service encryption uses Microsoft-managed keys by default.

Answer

Enable infrastructure encryption for the storage account.

Answer

Use Azure Storage Service Encryption with Microsoft-managed keys.

Answer

Implement client-side encryption using Azure Key Vault.

Question 12

Refer to the exhibit. You have an Azure Policy definition as shown. Your team creates a storage account with network rules set to 'Deny' by default, and then adds an IP rule to allow traffic from a specific IP range. What compliance state will this storage account be reported as?

Accepted Answer

Compliant. The policy audits if the storage account type is 'Microsoft.Storage/storageAccounts' AND defaultAction equals 'Allow'. Since the defaultAction is 'Deny', the condition is false, so the resource is compliant. Option B is correct.

Answer

Error

Answer

Exempt

Answer

Non-compliant

Question 13

You are designing a solution for a multi-tenant SaaS application where each tenant's data is stored in separate Azure SQL databases. You need to ensure that no tenant can access another tenant's database, even if the application is compromised. What should you implement?

Accepted Answer

Assign each tenant a managed identity with a dedicated SQL login and database-level permissions. Option D is correct because using a per-tenant managed identity with a separate SQL login and database-level permissions ensures isolation. Option A is wrong because a single identity with row-level security is vulnerable if the app is compromised. Option B is wrong because connection pooling does not enforce isolation. Option C is wrong because server-level firewall does not prevent app-layer attacks.

Answer

Configure a server-level firewall rule for each tenant's IP range

Answer

Implement connection pooling with a single identity

Answer

Use a single database-level login and row-level security (RLS) to filter data

Question 14

You are deploying a function app that processes sensitive data. You need to ensure that all function app secrets (e.g., connection strings) are stored securely and automatically rotated. Which service should you use?

Accepted Answer

Azure Key Vault. Azure Key Vault is the service designed to securely store and manage secrets, keys, and certificates. It supports automatic rotation for secrets. Option A is correct. Option B is wrong because App Configuration is for configuration, not secret rotation. Option C is wrong because Azure DevOps is for CI/CD. Option D is wrong because Managed Identity is an identity mechanism, not a secret store.

Answer

Azure Managed Identity

Answer

Azure App Configuration

Answer

Azure DevOps Variable Groups

Question 15

Refer to the exhibit. You are deploying an ARM template that assigns the 'Storage Blob Data Contributor' role to the managed identity of an App Service named 'myapp' at the storage account 'mystorageacct' scope. The deployment fails with an error that 'principalId' is null. What is the most likely cause?

Accepted Answer

The App Service 'myapp' does not have a managed identity enabled.. The reference function retrieves the App Service resource after it has been created, but if the App Service does not have a managed identity enabled, the 'identity.principalId' will be null. The template likely did not enable the managed identity on the App Service. Option B is correct. Option A is wrong because the role definition ID is correct. Option C is wrong because the scope is correct. Option D is wrong because the name is unique.

Answer

The role definition ID is incorrect.

Answer

The storage account name 'mystorageacct' does not exist.

Answer

The role assignment name is not unique.