AZ-204 Practice Test 2 — 10 Questions

Question 1

You are monitoring a web application with Application Insights. The application occasionally returns HTTP 500 errors. You want to be notified immediately when the error rate exceeds 5% of all requests in a rolling 5-minute window. Which feature of Application Insights should you configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a log alert using a Kusto query that calculates the percentage of failed requests over the last 5 minutes, with an alert condition when the result exceeds 0.05.. A log alert using a Kusto query allows you to calculate the exact percentage of failed requests over a rolling 5-minute window and trigger when that percentage exceeds 0.05 (5%). This is the only option that supports a dynamic, percentage-based threshold on a rolling time window, which is required for the stated condition. Metric alerts on 'Failed requests' measure absolute counts, not percentages, and Smart Detection does not allow custom percentage thresholds.

Answer

Create a Smart Detection rule for anomalous failures.

Answer

Create a metric alert on the 'Failed requests' metric with a threshold of 5%.

Answer

Create an availability test that checks for HTTP 200 responses and alert on failures.

Question 2

You are building an Azure Logic App that must call a third-party REST API secured with OAuth 2.0 Client Credentials flow. The client ID and client secret are stored in Azure Key Vault. You need to securely obtain an access token and include it in requests to the API. Which approach should you use in the Logic App?

Accepted Answer

Enable a system-assigned managed identity for the Logic App, grant it access to Key Vault, use the 'Get secret' action to retrieve the client secret into a variable, then use the HTTP action with 'Active Directory OAuth' authentication referencing that variable for the secret.. It securely retrieves the client secret from Azure Key Vault at runtime using a managed identity, avoiding any hardcoded secrets. The Logic App's system-assigned managed identity is granted access to Key Vault, then the 'Get secret' action fetches the secret into a variable, which is passed to the HTTP action's 'Active Directory OAuth' authentication. This approach follows the principle of least privilege and eliminates secret exposure in connection definitions or source code.

Answer

Use the HTTP action with 'Active Directory OAuth' authentication and hardcode the client secret in the connection parameters.

Answer

Create an Azure API connection (custom connector) with the OAuth 2.0 settings and store the secret in the connector's definition.

Answer

Store the client secret in an Azure App Service application setting and reference it in the Logic App via a connector.

Question 3

You are developing an ASP.NET Core web app that uses Azure SQL Database. The SQL connection string contains a password that must be rotated every 30 days. The app runs on Azure App Service. You want to store the connection string securely and enable automatic rotation without redeploying the app. Which approach should you use?

Accepted Answer

Store the connection string in an App Setting and use Key Vault references. Configure a Key Vault policy to automatically rotate the secret.. Azure App Service supports Key Vault references in App Settings, allowing you to securely store the connection string in Key Vault and reference it without exposing the password. By configuring a Key Vault policy to automatically rotate the secret (e.g., using a scheduled rotation or event-driven trigger), the password can be rotated every 30 days without redeploying the app, as the App Service runtime resolves the reference at runtime.

Answer

Store the connection string in an App Setting as a plain text value and use deployment slots to swap when the password changes.

Answer

Use a managed identity to access the SQL database directly, bypassing the connection string entirely.

Answer

Store the connection string in Azure Key Vault and use an ARM template with a secret reference at deployment time.

Question 4

You need to grant a user from another Microsoft Entra ID tenant access to a specific blob container in your Azure Storage account. The solution must use Azure RBAC and minimize administrative overhead. What should you do?

Accepted Answer

Invite the user as a guest in your Microsoft Entra ID tenant and assign the Storage Blob Data Reader role to the container.. It uses Azure RBAC to grant cross-tenant access by inviting the user as a guest in your Microsoft Entra ID tenant, then assigning the Storage Blob Data Reader role at the container scope. This minimizes administrative overhead by leveraging existing role assignments without managing shared keys or SAS tokens, and it follows the principle of least privilege by scoping access to a specific container.

Answer

Generate a shared access signature (SAS) with read permissions for the container.

Answer

Add the user as a Storage Blob Data Reader at the storage account level.

Answer

Share the storage account key with the user.

Question 5

You are building an Azure Logic App that must call an external REST API. The API requires an API key passed in the Authorization header. You need to store the API key securely and reference it in the Logic App without exposing it in the workflow definition. What should you do?

Accepted Answer

A. Azure Logic Apps can securely reference API keys stored in Azure Key Vault using a managed identity. By configuring the Logic App with a system-assigned or user-assigned managed identity, you grant it access to retrieve the secret from Key Vault at runtime without hardcoding the key in the workflow definition or connection parameters. This approach ensures the API key is never exposed in the Logic App's JSON definition or source control.

Answer

B

Answer

C

Answer

D

Question 6

You are developing an Azure Function that runs on a Consumption Plan. The function calls an external API that enforces a rate limit of 10 requests per second. When the function scales out to multiple instances, you must ensure the rate limit is not exceeded. Which pattern should you implement?

Accepted Answer

Use a queue-based load leveling pattern with an Azure Storage Queue.. A queue-based load leveling pattern uses an Azure Storage Queue to buffer incoming requests, allowing the function to process them at a controlled rate. This decouples the function's scaling from the external API's rate limit, ensuring that even with multiple function instances, the total request rate does not exceed 10 requests per second. The queue acts as a buffer, and the function can be configured to dequeue and process messages at a fixed rate, effectively smoothing out spikes in demand.

Answer

Use a singleton attribute on the function to ensure only one instance runs.

Answer

Use a static SemaphoreSlim in the function code to limit concurrent calls.

Answer

Configure the function's host.json to limit concurrency to 1.

Question 7

You have an Azure Storage account with cool tier blobs. You need to implement lifecycle management to move blobs to the archive tier after 30 days if they have not been accessed, and delete them after 365 days. Which lifecycle management rule action should you configure?

Accepted Answer

Use a rule with condition 'daysAfterLastAccessTimeGreaterThan' to tier and delete, and enable blob access tracking.. The requirement specifies 'if they have not been accessed', which requires tracking last access time. Lifecycle management rules support the 'daysAfterLastAccessTimeGreaterThan' condition, but blob access tracking must be enabled for this condition to work. Option A includes both the condition and enabling access tracking, making it the correct choice. Option D uses 'daysAfterModificationGreaterThan', which tracks last modification time, not access time, so it does not meet the requirement.

Answer

Use a rule with condition 'daysAfterLastAccessTimeGreaterThan' to tier and delete.

Answer

Use a rule with condition 'daysAfterSnapshotCreationGreaterThan' to tier and delete.

Answer

Use a rule with condition 'daysAfterModificationGreaterThan' to tier after 30 days and delete after 365 days.

Question 8

You are monitoring an Azure web application with Application Insights. You need to identify the top 5 slowest API endpoints over the last 7 days. The results should show the endpoint URL, average response time, and request count. Which feature or query should you use?

Accepted Answer

Use the 'Performance' blade under 'Investigate' in the Application Insights resource.. The 'Performance' blade in Application Insights provides a pre-built, optimized view that automatically aggregates request data by endpoint URL, displaying average response time and request count. It allows you to sort by average duration to quickly identify the top 5 slowest API endpoints over the last 7 days without writing any custom query.

Answer

Use Log Analytics and run a query on the 'requests' table to aggregate by URL and sort by avg(duration).

Answer

Use the 'Application Map' feature to visualize dependencies and endpoints.

Answer

Configure Smart Detection to automatically identify slow API endpoints.

Question 9

Your company uses Azure Key Vault to store secrets. You need to ensure that only a specific Microsoft Entra ID application can read a particular secret, while other applications are denied access. You want to apply the principle of least privilege. Which access control method should you configure?

Accepted Answer

Assign the application to the Key Vault Secrets User RBAC role at the secret scope. Azure RBAC allows you to assign the Key Vault Secrets User role at the secret scope, which grants read access exclusively to the specified Microsoft Entra ID application for that particular secret. This aligns with the principle of least privilege by restricting access to only the necessary secret, without granting broader permissions at the vault level.

Answer

Assign the application to the Key Vault Contributor RBAC role

Answer

Use Key Vault access policies

Answer

Use managed identity and assign the Key Vault Secrets User role at the vault scope

Question 10

You are monitoring an Azure App Service with Application Insights. You need to create a custom dashboard that shows the number of requests over time and the average server response time. Which Application Insights feature should you use to create this dashboard?

Accepted Answer

Metrics Explorer. Metrics Explorer is the correct feature because it allows you to create custom charts and dashboards by selecting specific metrics like 'Requests' and 'Server response time' from your Application Insights resource. You can aggregate these metrics over time and pin them to an Azure dashboard for monitoring. Live Metrics Stream shows real-time data but cannot be used for historical charting or dashboard pinning, while Analytics (Logs) requires Kusto queries for custom visualizations and is not optimized for simple metric dashboards.

Answer

Live Metrics Stream

Answer

Analytics (Logs)

Answer

Availability Tests