AZ-204 Practice Test 19 — 15 Questions

Question 1

You are designing a serverless application using Azure Functions that processes high-volume events from Azure Event Hubs. The events are then written to Azure Cosmos DB. The function must guarantee at-least-once delivery and be resilient to failures. The Cosmos DB account uses the SQL API and is configured with a single write region. You need to design the function to handle transient failures when writing to Cosmos DB without losing events. What should you do?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use the Cosmos DB output binding with built-in retry policy and configure the trigger to checkpoint only after successful writes.. Using the Cosmos DB output binding with its built-in retry policy automatically handles transient failures by retrying writes. By configuring the Event Hubs trigger to checkpoint only after a successful write, you ensure that events are not acknowledged until they are durably stored in Cosmos DB, guaranteeing at-least-once delivery and resilience to failures.

Answer

Increase the Event Hubs trigger's batch size to reduce the number of writes.

Answer

Implement a poison message queue to store failed events and reprocess them later.

Answer

In the function code, manually write to Cosmos DB and then manually checkpoint the Event Hubs partition.

Question 2

You are deploying a container group to Azure Container Instances that runs a stateful application. The application writes data to the /data directory. You need to ensure that the data is preserved if the container restarts. Which volume mount type should you use?

Accepted Answer

Azure Files share. Azure Files shares provide persistent, shared storage that can be mounted into Azure Container Instances (ACI) using the SMB 3.0 protocol. This ensures that data written to the /data directory survives container restarts because the share exists independently of the container lifecycle. EmptyDir volumes are ephemeral and tied to the pod's lifetime, making them unsuitable for stateful applications that require data persistence across restarts.

Answer

EmptyDir

Answer

Secret

Answer

ConfigMap

Question 3

You are designing a cost-effective solution to store log files that are accessed infrequently after 30 days. The logs must be retained for 7 years for compliance. Data must be available within 1 hour of a request. Which Azure Blob Storage access tier and lifecycle management rule should you use?

Accepted Answer

Use Hot tier for 30 days, then Cool tier until 90 days, then Archive tier until deletion after 7 years.. It balances cost and compliance: the Hot tier handles initial frequent writes, Cool tier reduces cost for infrequent access after 30 days, and Archive tier provides the lowest-cost storage for long-term retention while still allowing rehydration within 1 hour (via High Priority rehydration). The lifecycle rule deletes the blobs after 7 years to meet compliance requirements.

Answer

Use Hot tier initially, then move to Archive after 30 days, and delete after 7 years.

Answer

Use Archive tier immediately and set a lifecycle rule to delete after 7 years.

Answer

Use Cool tier initially, then move to Archive after 30 days, and delete after 7 years.

Question 4

You are developing a .NET Core application that uses Azure Service Bus queues. You need to implement a dead-lettering mechanism for messages that cannot be processed after 5 delivery attempts. Which property should you set on the queue to automate this?

Accepted Answer

maxDeliveryCount. The maxDeliveryCount property on an Azure Service Bus queue defines the maximum number of attempts to deliver a message before it is automatically moved to the dead-letter queue. Setting this property to 5 ensures that after five failed delivery attempts, the message is dead-lettered, meeting the requirement without custom code.

Answer

defaultMessageTimeToLive

Answer

lockDuration

Answer

requiresDuplicateDetection

Question 5

Your web app hosted on Azure App Service is experiencing high memory usage. You need to capture a memory dump for analysis without restarting the app. Which diagnostic feature should you use?

Accepted Answer

Azure App Service Diagnostics (Diagnose and solve problems). Azure App Service Diagnostics (Diagnose and solve problems) provides a built-in 'Memory Dump' tool that allows you to capture a full or mini memory dump of your app's process without requiring a restart. This is accessed through the Azure portal under the 'Diagnose and solve problems' blade, specifically via the 'Collect Memory Dump' diagnostic tool, which uses the Windows Debugging Tools to snapshot the w3wp.exe process while the app continues running.

Answer

Application Insights Profiler

Answer

Snapshot Debugger

Answer

Diagnostic settings

Question 6

You are developing a solution that stores user-uploaded profile pictures. Users upload pictures that are then displayed on their profile page. After 30 days, if the user hasn't logged in, the system moves the picture to cold storage. You need to choose the initial access tier for the container to optimize cost and performance for frequently accessed pictures. Which tier should you use?

Accepted Answer

Hot. The Hot tier is the correct initial access tier because the profile pictures are frequently accessed immediately after upload (e.g., displayed on profile pages). The Hot tier is optimized for high-frequency read/write operations with the lowest latency, making it cost-effective for data that is accessed often. After 30 days of inactivity, the system moves the picture to cold storage, so the initial tier should prioritize performance for active data, not long-term archival cost savings.

Answer

Cool

Answer

Archive

Answer

Premium

Question 7

You are developing an Azure Function that processes messages from an Azure Service Bus queue. The function uses a Service Bus queue trigger and runs on a Consumption Plan. The queue receives a high volume of messages in bursts. You need to ensure that the function scales out to handle the load but does not exceed 10 concurrent instances. Which configuration should you apply?

Accepted Answer

Set the 'functionAppScaleLimit' application setting to 10 in the function app.. The 'functionAppScaleLimit' application setting controls the maximum number of instances for a function app running on the Consumption plan. Setting it to 10 ensures the app does not scale beyond 10 instances. The 'maxConcurrentCalls' property only limits per-instance concurrency.

Answer

Set the 'maxConcurrentCalls' property to 10 in the host.json file.

Answer

Set the 'maxMessageBatchSize' property to 10 in the host.json file.

Answer

Restrict the Service Bus queue to have a maximum concurrency of 10 at the namespace level.

Question 8

You need to monitor the real-time CPU utilization of an Azure virtual machine. Which Azure Monitor feature is designed for this purpose?

Accepted Answer

Metrics. Azure Monitor Metrics is the correct feature because it collects and stores numeric time-series data from Azure resources, including CPU utilization, at near-real-time intervals (typically every 1 minute for Azure VMs). Metrics are lightweight, low-latency, and designed for real-time monitoring and alerting, making them ideal for tracking CPU usage without the overhead of log ingestion.

Answer

Logs

Answer

Alerts

Answer

Workbooks

Question 9

Your Azure Functions app (running on the Consumption plan) processes messages from an Azure Storage queue. Occasionally, the function fails due to a timeout after 5 minutes. You need to increase the maximum execution time without changing the plan. What should you do?

Accepted Answer

Set the functionTimeout property in host.json to 10 minutes. On the Consumption plan, the `functionTimeout` property in host.json can be set up to 10 minutes (default is 5 minutes). Since the function fails after 5 minutes, increasing `functionTimeout` to 10 minutes resolves the timeout without changing the plan. Option B is incorrect because migrating to Premium or Dedicated plan changes the plan, violating the constraint. Option C is incorrect because Durable Functions do not extend the per-function execution timeout; the individual function still has the same limit. Option D is incorrect because the visibility timeout affects when a message reappears, not the function's execution timeout.

Answer

Migrate the function app to the Premium or Dedicated plan

Answer

Use Durable Functions to split the work

Answer

Increase the visibility timeout of the queue message

Question 10

You have an application that stores user profile pictures in Azure Blob Storage. Users upload images via a web app. You need to ensure that the images are served securely over HTTPS and that only authenticated users can access them. The web app uses Azure App Service with built-in authentication. You want to avoid storing any access keys in the web app's configuration. What should you do to grant the web app access to the blobs?

Accepted Answer

Enable system-assigned managed identity on the App Service and assign the 'Storage Blob Data Reader' role on the blob container.. Enabling a system-assigned managed identity on the App Service allows it to authenticate to Azure Storage without storing any credentials. By assigning the 'Storage Blob Data Reader' role on the blob container, the web app can securely access blobs using Azure AD authentication, which is the recommended approach for server-side access. This avoids storing access keys or SAS tokens in configuration, meeting the security requirement.

Answer

Store the storage account access key in the web app's configuration.

Answer

Enable anonymous public read access on the blob container.

Answer

Generate a SAS token with long expiration and store it in the web app's configuration.

Question 11

You are developing an Azure Function that reads secrets from Azure Key Vault. The function must not use any static credentials in configuration files. You need to authenticate to Key Vault using the function's own identity. Which Azure service feature should you enable?

Accepted Answer

Assign a managed identity to the function app and grant it access to the Key Vault. Azure Functions can use a system-assigned or user-assigned managed identity to authenticate to Azure Key Vault without storing any static credentials. When enabled, the function app obtains an Azure AD token from the Managed Identity endpoint (169.254.169.254) and uses it to access Key Vault secrets, eliminating the need for connection strings, keys, or certificates in configuration files.

Answer

Use storage account access keys to authenticate to Key Vault

Answer

Generate a shared access signature (SAS) token for the Key Vault

Answer

Create a service principal and store its certificate in the function app's local storage

Question 12

You have an Azure Event Grid topic that receives storage blob created events. You only want to process events for files with a '.jpg' extension. You need to minimize cost and latency. How should you filter the events?

Accepted Answer

Configure a subject filter in the Event Grid subscription with suffix '.jpg'. Event Grid subscriptions support subject filtering with prefix and suffix matching, allowing you to filter events at the Event Grid service level before they are delivered to your endpoint. By configuring a subject filter with suffix '.jpg', only blob created events for files ending in '.jpg' are sent to your Azure Function, minimizing both cost (fewer invocations) and latency (no unnecessary processing). This approach avoids the overhead of receiving and discarding unwanted events in your function code.

Answer

Filter inside the Azure Function code by checking the blob name extension

Answer

Use Azure Service Bus topics instead of Event Grid, with a filter on message properties

Answer

Create separate Event Grid topics for JPEG files and route only JPEG events

Question 13

Which THREE services can be used to implement a pub/sub messaging pattern in Azure?

Accepted Answer

Azure Service Bus Topics. Azure Service Bus Topics supports a pub/sub pattern by allowing multiple subscriptions to receive copies of messages sent to a topic. Each subscription acts as a logical queue, and messages are automatically routed to all subscriptions that match the filtering rules, enabling decoupled communication between publishers and subscribers.

Answer

Azure Notification Hubs

Answer

Azure Queue Storage

Question 14

Refer to the exhibit. You are using Azure CLI to list blobs in a container. The command fails with an authorization error. The storage account has firewall rules enabled, and you are running the CLI from a machine that is not on the allowed network list. What is the most likely cause of the failure?

Accepted Answer

The storage account firewall is blocking the request because your IP is not in the allow list. The storage account firewall explicitly blocks all traffic except from IP addresses or subnets in the allow list. Since the CLI is running from a machine whose IP is not on that list, the request is denied at the network layer before any authentication or authorization checks occur. This is the most direct cause of the authorization error.

Answer

You do not have the 'Storage Blob Data Reader' role assigned

Answer

The container name is misspelled

Answer

The storage account requires TLS 1.2 and your CLI uses an older version

Question 15

Your organization uses Azure Key Vault to store secrets. Developers need to retrieve secrets during application runtime. You want to minimize latency and avoid network overhead. Which approach should you recommend?

Accepted Answer

Implement caching of secrets in the application with a short time-to-live (TTL) and use Key Vault as the source of truth.. It directly addresses the need to minimize latency and network overhead by caching secrets locally with a short TTL, while still using Azure Key Vault as the authoritative source. This pattern reduces the frequency of network calls to Key Vault, which is critical for high-throughput applications where every millisecond matters. The short TTL ensures that secret updates are eventually reflected without stale data persisting indefinitely.

Answer

Enable the Key Vault firewall and allow only trusted Azure services.

Answer

Store the secrets directly in application configuration files.

Answer

Enable Key Vault soft-delete to ensure secrets are recoverable.