AZ-204 Practice Test 20 — 15 Questions

Question 1

You need to securely connect an on-premises application to Azure Blob Storage without exposing data to the public internet. Which feature should you use?

Accepted Answer

Azure Private Endpoint. Azure Private Endpoint uses a private IP address from your virtual network to connect to Azure Blob Storage over the Microsoft backbone network, ensuring traffic never traverses the public internet. This provides a secure, private connection for on-premises applications via VPN or ExpressRoute, meeting the requirement to avoid public exposure.

Answer

IP firewall rules on the storage account

Answer

Storage account access keys

Answer

Shared access signature (SAS) with stored access policy

Question 2

Your company uses Azure Key Vault to manage encryption keys for data at rest in Azure Storage. You need to ensure that the storage account uses a customer-managed key (CMK) stored in Key Vault. Additionally, you need to periodically rotate the key automatically. Which configuration should you implement?

Accepted Answer

Create a key in Key Vault, assign the storage account's managed identity access to that key, and configure a Key Vault rotation policy to automatically rotate the key regularly. It combines the three essential elements for using a customer-managed key (CMK) with automatic rotation in Azure Key Vault. First, you must create a key in Key Vault (not use the default system-managed key). Second, the storage account's managed identity must be granted 'Get', 'Unwrap Key', and 'Wrap Key' permissions on that key so it can encrypt/decrypt the storage account's root key. Third, you configure a Key Vault rotation policy (using the Azure Key Vault key rotation feature) to automatically create new key versions on a schedule (e.g., every 90 days), which the storage account automatically picks up without manual intervention.

Answer

Enable soft-delete and purge protection on the Key Vault to allow key recovery during rotation

Answer

Use Azure Key Vault's default key (system-managed) and rely on built-in rotation

Answer

Manually rotate the key every 90 days by generating a new version and updating the storage account

Question 3

Which Azure Blob Storage access tier is optimized for infrequently accessed data with a minimum storage duration of 30 days?

Accepted Answer

Cool. The Cool tier is optimized for infrequently accessed data and has a minimum storage duration of 30 days, matching both requirements. The Archive tier is for infrequently accessed data but requires a minimum storage duration of 180 days, so it does not meet the 30-day requirement. The Hot tier is for frequently accessed data. The Premium tier is for high-performance, frequently accessed data. 'Transactional' is not a standard Azure Blob Storage access tier. Therefore, among the given options, only Cool satisfies all criteria.

Answer

Transactional

Answer

Archive

Answer

Premium

Answer

Hot

Question 4

Adventure Works is developing a payment processing system on Azure. The system uses an Azure Service Bus queue to decouple the frontend from the backend. The frontend sends a message to the queue. A backend service, running as an Azure WebJob, processes the message and calls a third-party payment gateway via HTTPS. The backend must authenticate to the payment gateway using a client certificate stored in Azure Key Vault. The WebJob must be able to access the certificate without storing any secrets in configuration. The WebJob runs in an App Service plan with system-assigned managed identity enabled. Which approach should the team use to retrieve the certificate and authenticate to the payment gateway?

Accepted Answer

In the WebJob code, use SecretClient from Azure.Security.KeyVault.Secrets to retrieve the certificate as a secret. Parse the secret value to X509Certificate2. Use the certificate in HttpClientHandler to call the payment gateway.. The WebJob can use its system-assigned managed identity to authenticate to Azure Key Vault without storing any secrets. The SecretClient from Azure.Security.KeyVault.Secrets retrieves the certificate as a secret, which can be parsed into an X509Certificate2 object. This certificate is then used in an HttpClientHandler to authenticate to the payment gateway via HTTPS, fulfilling all requirements securely.

Answer

Store the certificate as a .pfx file in a blob container with a SAS token. Download the blob using the SAS token and load the certificate.

Answer

Create a service principal with a client secret, store the secret in Key Vault. Use ClientSecretCredential to authenticate to Key Vault and retrieve the certificate.

Answer

Store the certificate thumbprint in application settings. Use the Azure App Service certificate store to load the certificate by thumbprint.

Question 5

You are a developer for a company that runs a critical e-commerce application on Azure. The application consists of an Azure App Service web app, an Azure SQL Database, and an Azure Cache for Redis. The web app experiences occasional performance degradation that you suspect is due to inefficient database queries caused by caching issues. You have enabled Application Insights on the web app. You need to identify the root cause of the performance issues and optimize the solution. The solution must minimize cost and administrative overhead. You have the following options:

Option A: Configure Azure SQL Database Intelligent Insights to automatically tune database queries.
Option B: Use Application Insights Profiler to capture and analyze database query performance.
Option C: Implement Redis cache-aside pattern and ensure that all database queries check the cache first.
Option D: Enable Azure SQL Database Query Performance Insight to identify the most costly queries and then implement caching.

Which option should you recommend?

Accepted Answer

Enable Azure SQL Database Query Performance Insight to identify the most costly queries and then implement caching.. The scenario requires identifying the root cause of performance degradation due to inefficient database queries caused by caching issues. Query Performance Insight in Azure SQL Database pinpoints the most resource-intensive and longest-running queries, allowing you to target exactly which queries need caching. After identifying these costly queries, implementing a Redis cache-aside pattern reduces redundant database hits, directly addressing the suspected caching issue while minimizing cost and administrative overhead.

Answer

Implement Redis cache-aside pattern and ensure that all database queries check the cache first.

Answer

Configure Azure SQL Database Intelligent Insights to automatically tune database queries.

Answer

Use Application Insights Profiler to capture and analyze database query performance.

Question 6

Your company has an application running on Azure Virtual Machines that needs to access secrets in Azure Key Vault. You want to restrict network access to the Key Vault so that only the virtual network/subnet containing the VMs can reach it. You also want to ensure that the solution works with the least management overhead. Which configuration should you use?

Accepted Answer

Configure Key Vault firewall to allow access from the virtual network and subnet using service endpoints.. Configuring Key Vault firewall with virtual network service endpoints allows you to restrict access to the Key Vault to a specific virtual network and subnet without exposing the VMs to the internet. This approach leverages Azure's backbone network for traffic, providing secure and direct connectivity with minimal management overhead, as service endpoints are automatically maintained by Azure.

Answer

Configure Key Vault firewall with IP-based rules that allow the VM's public IP address.

Answer

Configure a Private Endpoint for the Key Vault in the same virtual network as the VMs.

Answer

Use a shared access signature (SAS) to access Key Vault secrets.

Question 7

A company deploys a stateful application as a container in Azure Container Instances (ACI). They need persistent storage that can be shared across multiple container instances and retain data after container restarts. Which volume mount should they use?

Accepted Answer

Azure Files share. Azure Files shares provide fully managed SMB file shares in the cloud that can be mounted as volumes in Azure Container Instances. This allows multiple container instances to read and write to the same persistent storage concurrently, and data persists independently of container lifecycles, surviving restarts or deletions. The scenario requires shared, persistent storage across instances, which Azure Files uniquely supports among the given options.

Answer

emptyDir

Answer

Host path

Answer

Secret volume

Question 8

Which THREE actions should you take to securely access Azure Key Vault from an Azure App Service? (Choose three.)

Accepted Answer

Grant the managed identity the 'Key Vault Secrets User' role.. Granting the managed identity the 'Key Vault Secrets User' role uses Azure RBAC to authorize the App Service to read secrets from Key Vault without requiring any keys or secrets to be stored in the application. This aligns with the principle of least privilege and eliminates the need for client secrets or certificates in code or configuration.

Answer

Configure network restrictions on the Key Vault to allow only the App Service's outbound IP.

Answer

Store the Key Vault URL and a client secret in App Service application settings.

Question 9

You need to expose an on-premises API securely to external partners without opening firewall ports. Which Azure service should you use?

Accepted Answer

Azure API Management. Azure API Management is the correct choice because it acts as a secure gateway for exposing on-premises APIs to external partners without opening firewall ports. It can connect to on-premises backends via a VPN or Azure ExpressRoute, and it handles authentication, throttling, and transformation at the gateway layer, keeping the internal network isolated.

Answer

Azure Traffic Manager

Answer

Azure Application Gateway

Answer

Azure Front Door

Question 10

Your Azure Function app processes messages from an Azure Service Bus queue. The function is triggered by Service Bus messages. Occasionally, the function throws an unhandled exception after the message is processed but before the function completes. What happens to the message?

Accepted Answer

The message is abandoned and becomes available for other consumers after the lock duration expires.. In Azure Functions with a Service Bus trigger, the function runtime manages the lock on the message. If an unhandled exception occurs after the message has been processed but before the function returns, the runtime interprets this as a failure to complete the message. As a result, the message is abandoned, meaning the lock is released, and the message becomes available for redelivery to other consumers after the lock duration expires. This behavior ensures that messages are not lost but can be retried.

Answer

The message is moved to the dead-letter queue.

Answer

The message is completed automatically despite the exception.

Answer

The message is automatically removed from the queue.

Question 11

You have an Azure App Service web app that experiences high CPU usage during peak hours. You need to scale out automatically based on CPU load. Which scaling solution should you use?

Accepted Answer

Autoscale with a CPU percentage rule. Autoscale with a CPU percentage rule is the correct solution because Azure App Service supports built-in autoscaling that can automatically increase or decrease the number of instances based on a metric like CPU percentage. This allows the web app to handle peak-hour traffic by scaling out when CPU usage exceeds a defined threshold, ensuring performance without manual intervention.

Answer

Manual scaling

Answer

Traffic Manager

Answer

Scale sets autoscale

Question 12

You have enabled Application Insights on your Azure Web App. You notice that some server-side exceptions are not appearing in the Application Insights portal. What is the most likely reason?

Accepted Answer

The exceptions are being caught and handled in code without being re-thrown or explicitly logged. Application Insights only captures exceptions that are unhandled or explicitly logged via the SDK. If an exception is caught in a try-catch block and not re-thrown or logged using `TelemetryClient.TrackException()`, it will not appear in the portal. This is a common oversight when developers handle exceptions silently without instrumentation.

Answer

The Application Insights SDK is not installed in the application

Answer

The developer forgot to set the Instrumentation Key in the application configuration

Answer

The web app is running on a Free tier App Service plan

Question 13

An Azure App Service application has memory pressure. The developer needs distributed tracing across requests and dependencies. What should be enabled?

Accepted Answer

Application Insights with dependency tracking. Application Insights with dependency tracking enables distributed tracing by automatically collecting telemetry across HTTP requests, database calls, and external service dependencies. This allows developers to correlate end-to-end transactions and identify the root cause of memory pressure, such as a specific dependency causing excessive resource consumption.

Answer

Azure Policy compliance scan

Answer

Cost Management budgets only

Answer

Storage account static website logs

Question 14

A single-page app signs in users with Microsoft Entra ID and calls a protected API. The app cannot safely keep a client secret. Which OAuth flow should be used? The architecture review board prefers a managed Azure-native control.

Accepted Answer

Authorization code flow with PKCE. The authorization code flow with PKCE (Proof Key for Code Exchange) is the correct choice because it is designed for public clients (like single-page apps) that cannot securely store a client secret. PKCE uses a dynamically generated cryptographic code verifier and challenge to prevent authorization code interception attacks, making it the recommended OAuth 2.0 flow for SPAs calling protected APIs in Microsoft Entra ID.

Answer

Implicit flow

Answer

Client credentials flow

Answer

Resource owner password credentials flow

Question 15

Your API is secured using Azure AD (now Microsoft Entra ID) tokens. You need to validate the token in your custom code. Which library should you use to validate the token's signature, issuer, and audience?

Accepted Answer

Microsoft.IdentityModel.Tokens and System.IdentityModel.Tokens.Jwt. The Microsoft.IdentityModel.Tokens and System.IdentityModel.Tokens.Jwt libraries provide the core token validation logic (signature verification, issuer, audience) that can be used in custom code, independent of any framework. These libraries implement the JWT validation pipeline as defined in RFC 7519, allowing you to call TokenValidationParameters and JwtSecurityTokenHandler.ValidateToken() to manually verify the token's integrity and claims.

Answer

ASP.NET Core Identity

Answer

Microsoft Graph SDK

Answer

Microsoft Authentication Library (MSAL)