AZ-204 Practice Exam 4 — 20 Questions

Question 1

You are designing a solution that stores sensitive customer data in Azure Blob Storage. The data must be encrypted at rest using a customer-managed key (CMK) stored in Azure Key Vault. Additionally, the solution must support automatic key rotation every 90 days. You need to configure the encryption settings. Which combination of Azure services and features should you use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use Azure Storage encryption with a customer-managed key stored in Azure Key Vault. Configure a key rotation policy in Key Vault to rotate the key every 90 days.. Azure Storage Service Encryption (SSE) supports customer-managed keys (CMK) stored in Azure Key Vault for encrypting blob data at rest. Automatic key rotation every 90 days can be achieved by configuring a key rotation policy in Azure Key Vault, which allows you to define a rotation frequency (e.g., 90 days) and automatically generate a new key version. This meets both the CMK and automatic rotation requirements without additional services.

Answer

Use Azure Information Protection to encrypt the blobs with a customer-managed key.

Answer

Use Azure Disk Encryption with Azure Key Vault to encrypt the storage account.

Answer

Use Azure Storage Service Encryption (SSE) with Microsoft-managed keys and enable automatic key rotation.

Question 2

You are developing an API using Azure API Management (APIM). The API is backed by an Azure Function that processes requests. You need to implement caching for responses that are expensive to compute. The cache should expire after 10 minutes. What should you configure in APIM?

Accepted Answer

Add a cache-lookup and cache-store policy to the API operation.. Azure API Management (APIM) provides built-in caching policies—`cache-lookup` and `cache-store`—that can be applied directly to an API operation. These policies cache the response from the backend (the Azure Function) and respect the `cache-control` header or a specified duration, such as 10 minutes, without requiring an external cache. This is the simplest and most direct way to implement response caching for expensive-to-compute operations within APIM.

Answer

Configure Azure Redis Cache as an external cache in APIM.

Answer

Implement response caching in the Azure Function code.

Answer

Use Azure Front Door to cache responses.

Question 3

You are a developer for a startup that is building a real-time chat application on Azure. The application uses Azure Web PubSub to broadcast messages to clients. The security team requires that only authenticated users can connect to the Web PubSub service. You plan to use Microsoft Entra ID for authentication. The application backend is an Azure Function that generates access tokens. What is the correct course of action to secure the Web PubSub service?

Accepted Answer

Enable managed identity for the Azure Function, assign it the 'Web PubSub Service Owner' role, and use the Web PubSub SDK to generate a client access token after authenticating the user.. It uses managed identity to securely authenticate the Azure Function to the Web PubSub service without exposing any secrets. The Function then generates a client access token only after the user is authenticated via Microsoft Entra ID, ensuring that only authenticated users can connect to the Web PubSub service. This approach follows the principle of least privilege and avoids distributing shared access keys or connection strings to clients.

Answer

Configure the Web PubSub service to use a shared access key and distribute it to clients via the Function.

Answer

Set the Web PubSub service's 'Anonymous mode' to 'Allow anonymous connections' and authenticate users at the application level.

Answer

Use the Web PubSub connection string (access key) in the Function to generate a client token, and store the connection string in Azure Key Vault.

Question 4

A retail company uses Azure Logic Apps to integrate with third-party APIs. One Logic App sends purchase orders to a supplier's HTTP endpoint. The supplier requires that the request include an OAuth 2.0 access token obtained from their authorization server. The company wants to manage the client credentials (client ID and client secret) securely and rotate them automatically. The Logic App must also log all requests for auditing. What should you do?

Accepted Answer

Use the 'HTTP + Swagger' connector, define the OAuth2 security scheme, store the client secret in Key Vault, and configure the Logic App to use a system-assigned managed identity to access Key Vault.. It combines the HTTP + Swagger connector to define the OAuth2 security scheme inline, stores the client secret in Azure Key Vault for secure management and automatic rotation, and uses a system-assigned managed identity to access Key Vault without hardcoding credentials. This approach ensures the Logic App can securely retrieve the client secret, request an OAuth 2.0 token from the supplier's authorization server, and log all HTTP requests via the connector's built-in logging capabilities.

Answer

Use the built-in HTTP action with a system-assigned managed identity and request a token from the supplier's authorization server using the managed identity.

Answer

Use the built-in HTTP action in the Logic App, store the client secret in Azure Key Vault, and retrieve it using the Key Vault connector. Then request a token from the supplier's authorization server.

Answer

Use the 'Managed API' connector for the supplier, configure it with client ID and secret in the connection parameters, and enable 'Azure AD Integration' on the Logic App.

Question 5

Refer to the exhibit. You have an HTTP-triggered Azure Function that writes the request body to a blob in the 'samples-workitems' container. The function runs successfully but does not create a blob. What is the most likely cause?

Accepted Answer

The storage account connection string is not set in the function app settings. The most likely cause is that the storage account connection string is not set in the function app settings. Azure Functions require the connection string for the storage account to be configured via the `AzureWebJobsStorage` app setting (or a custom connection setting referenced in the binding). Without it, the runtime cannot authenticate or communicate with Blob Storage, so the output binding silently fails to write the blob, even though the function executes successfully.

Answer

The container name 'samples-workitems' is invalid

Answer

The blob name pattern {rand-guid} is not supported

Answer

The blob output binding syntax is incorrect

Question 6

You are developing an application that stores user secrets. You need to ensure that the secrets are encrypted at rest and rotated automatically. Which Azure service should you integrate?

Accepted Answer

Azure Key Vault.. Azure Key Vault is the correct choice because it provides centralized management of secrets, keys, and certificates with built-in encryption at rest using FIPS 140-2 Level 2 validated hardware security modules (HSMs). It also supports automatic rotation of secrets through integration with Azure Event Grid and Azure Functions, enabling you to schedule or trigger key rotation policies without manual intervention.

Answer

Azure Storage.

Answer

Azure Security Center.

Answer

Microsoft Entra ID.

Question 7

You are deploying a web app to Azure App Service. The app uses environment-specific configuration (e.g., connection strings). You need to manage these settings without redeploying the app. Which feature should you use?

Accepted Answer

App Service application settings. App Service application settings (option B) are the correct feature because they allow you to store environment-specific configuration (e.g., connection strings, app settings) as key-value pairs that are injected into the app at runtime. These settings can be changed in the Azure portal, CLI, or PowerShell without redeploying the application code, making them ideal for managing configuration across different environments (development, staging, production). The settings are automatically encrypted at rest and overridden for the specific App Service slot when using deployment slots.

Answer

Azure App Configuration service

Answer

ARM template parameters

Answer

Azure Key Vault references in App Service

Question 8

You are developing a mobile app backend using Azure Functions. The app allows users to upload profile pictures. The pictures are stored in Azure Blob Storage and the metadata (user ID, blob URL, upload timestamp) is stored in Azure SQL Database. You need to implement a process that automatically generates a thumbnail for each uploaded picture and updates the metadata with the thumbnail URL. The thumbnail generation is CPU-intensive and may take up to 30 seconds per image. The solution should be serverless and cost-effective. Which combination of Azure services should you use?

Accepted Answer

Use an Azure Blob Storage trigger to invoke an Azure Function that generates the thumbnail and updates Azure SQL Database.. Azure Blob Storage triggers are designed to invoke an Azure Function automatically when a new blob is created, which is ideal for this serverless, event-driven workflow. The function can generate the thumbnail (even with a 30-second CPU-intensive task, as Azure Functions support up to 10-minute execution on the Premium plan) and then update the Azure SQL Database with the thumbnail URL, all without managing infrastructure.

Answer

Use an Azure VM with a scheduled task to poll for new blobs and generate thumbnails.

Answer

Use an Azure Queue Storage trigger to invoke an Azure Function that processes the image and updates Azure SQL Database.

Answer

Use Azure Event Grid to trigger an Azure Logic App that generates the thumbnail and updates Azure SQL Database.

Question 9

You deploy a containerized background job to Azure Container Instances (ACI). The job should automatically restart only if it exits with a non-zero exit code (i.e., crashes). You want to minimize costs. Which restart policy should you configure?

Accepted Answer

OnFailure. The OnFailure restart policy is correct because it restarts the container only when it exits with a non-zero exit code, indicating a crash or error. This matches the requirement to automatically restart only on failure while minimizing costs, as it avoids unnecessary restarts on successful completions.

Answer

Always

Answer

Never

Answer

Retry

Question 10

You are migrating an on-premises .NET Framework app to Azure. The app uses Windows authentication and requires persistent storage. You want to minimize rework. Which Azure compute service should you choose?

Accepted Answer

Azure App Service on Windows. Azure App Service on Windows (D) supports Windows authentication natively via its built-in integration with Azure Active Directory and on-premises Active Directory through Azure AD Domain Services or hybrid identity setups. It also provides persistent storage options like Azure Files or blob storage attached to the web app, minimizing rework by allowing the existing .NET Framework app to run with minimal code changes in a Platform-as-a-Service (PaaS) environment.

Answer

Azure Spring Apps

Answer

Azure Functions

Answer

Azure Container Instances

Question 11

You are designing a solution to process thousands of images uploaded to Azure Blob Storage. Each image must be resized and metadata extracted. The processing must be serverless and cost-effective. Which Azure service should you use?

Accepted Answer

Azure Functions with Blob Storage trigger. Azure Functions with a Blob Storage trigger is the correct choice because it provides a serverless, event-driven compute model that automatically scales to process thousands of images as they are uploaded to Blob Storage. The trigger binds directly to a blob container, invoking a function for each new blob, which allows you to resize images and extract metadata without managing infrastructure, making it both cost-effective and efficient for high-throughput workloads.

Answer

Azure Container Instances with Blob Storage SDK

Answer

Azure Logic Apps with Blob Storage connector

Answer

Azure Event Grid with Webhook to a custom service

Question 12

You are a developer at a global e-commerce company. The company uses Azure Blob Storage to store product images and customer uploads. The application is deployed in the East US region. You need to design a solution that meets the following requirements: - Customers upload images (up to 10 MB) that must be immediately accessible worldwide after upload. - You must minimize egress costs for data transfer from Azure to customers. - The solution must be resilient to regional outages. - You must not use any custom caching logic. Which approach should you implement?

Accepted Answer

Use Azure Front Door with caching enabled, and point it to a single Blob Storage account in East US.. Azure Front Door with caching enabled provides global HTTP caching at Microsoft edge nodes, which minimizes egress costs by serving cached content from the edge closest to the user. It also offers built-in regional failover for resilience, and requires no custom caching logic. This meets all requirements: immediate global accessibility, minimized egress costs, regional outage resilience, and no custom caching.

Answer

Use read-access geo-redundant storage (RA-GRS) and direct customers to the secondary endpoint for reads.

Answer

Use Premium Block Blob storage in multiple regions and use Traffic Manager for routing.

Answer

Use Azure CDN from Microsoft with the storage account as origin, and enable geo-replication on the storage account.

Question 13

Your web app running on Azure App Service requires access to a storage account using managed identity. You enable the system-assigned managed identity on the App Service and assign the 'Storage Blob Data Contributor' role at the storage account scope. However, the app receives 403 errors when trying to read blobs. What is the most likely cause?

Accepted Answer

The managed identity token is being requested with the wrong audience. You need to specify 'https://storage.azure.com' as the resource.. When using managed identity with Azure Storage, the access token must be requested with the correct audience (resource). For Azure Blob Storage, the audience must be 'https://storage.azure.com'. If the app requests the token with a different audience (e.g., the default Azure Resource Manager endpoint 'https://management.azure.com'), the token will be rejected by the storage service, resulting in a 403 error despite the role assignment being in place.

Answer

Managed identity is not supported for Azure App Service; use a connection string instead.

Answer

The role assignment has not propagated yet; wait 30 minutes.

Answer

The storage account has a firewall rule that blocks the App Service outbound IPs.

Question 14

A web app experiences intermittent high latency. You discover that the Azure SQL database is experiencing a high number of connection timeouts. The application uses Entity Framework Core with the default connection pooling settings. You need to improve database connection reliability without changing the application code. What should you do?

Accepted Answer

Set the Minimum Pool Size to 10 in the connection string.. Setting the Minimum Pool Size to 10 pre-creates a baseline of open connections in the pool, reducing the frequency of new connection creations during traffic spikes. This mitigates intermittent connection timeouts caused by the default pool starting empty and struggling to keep up with demand under high latency. Since the application uses Entity Framework Core with default pooling, this change is applied via the connection string without modifying code.

Answer

Increase the maximum pool size in the connection string.

Answer

Set the Connection Lifetime to 300 seconds.

Answer

Enable Multipool in the connection string.

Question 15

You need to reduce costs for an Azure Functions app that runs intermittently. The current Consumption plan bills for execution time. Which change would be MOST cost-effective?

Accepted Answer

Migrate to Flex Consumption plan with higher memory. The Flex Consumption plan allows you to configure per-instance memory and concurrency settings, which can reduce costs for intermittent workloads by optimizing resource usage. Unlike the standard Consumption plan, Flex Consumption lets you set higher memory limits without paying for idle time, making it more cost-effective for functions that run sporadically but require more memory when active.

Answer

Switch to Premium plan with pre-warmed instances

Answer

Use an App Service plan with Always On

Answer

Deploy to Azure Container Instances

Question 16

Your company uses Microsoft Sentinel for security information and event management (SIEM). You need to detect and automatically respond to a potential credential theft attack where an anomalous number of failed logins are followed by a successful login from a different geographic location. Which Microsoft Sentinel feature should you use?

Accepted Answer

An analytics rule with an automated response. An analytics rule in Microsoft Sentinel can be configured to detect patterns like anomalous failed logins followed by a successful login from a different geography. The rule can then trigger an automated response, such as running a playbook or creating an incident, to remediate the threat in near real-time. This combines detection and automated action within a single rule, making it the correct choice for this scenario.

Answer

Microsoft Sentinel Data Connectors

Answer

Microsoft Defender for Identity

Answer

Microsoft Sentinel playbooks

Question 17

You are developing a web application that runs on Azure App Service. The application needs to store session state. Which Azure service provides the best performance and reliability for session state storage?

Accepted Answer

Azure Cache for Redis. Azure Cache for Redis provides the best performance and reliability for session state storage because it is an in-memory data store with sub-millisecond latency, designed for high-throughput, low-latency scenarios like session caching. It supports session state providers natively in ASP.NET and ASP.NET Core, ensuring fast reads and writes for each user request without the overhead of disk I/O or network latency associated with other storage options.

Answer

Azure Table Storage

Answer

Azure Blob Storage

Answer

Azure SQL Database

Question 18

You run the command above to create an Azure Container Instance. The container exits with a non-zero exit code. You need to check the logs to debug the issue. Which command should you use next?

Accepted Answer

az container logs --resource-group myRG --name mycontainer. The correct command is `az container logs` because it retrieves the stdout and stderr logs from a container that has exited, which is essential for debugging exit code failures. Since the container has already exited with a non-zero exit code, you need to inspect its logged output to understand the cause of the failure, and this command directly fetches those logs without requiring an active container.

Answer

az container attach --resource-group myRG --name mycontainer

Answer

az container exec --resource-group myRG --name mycontainer --exec-command /bin/sh

Answer

az container show --resource-group myRG --name mycontainer --query containers[0].instanceView.currentState.exitCode

Question 19

A developer accidentally deleted a secret from Azure Key Vault. Soft-delete is enabled with a retention period of 90 days. After 60 days, you attempt to recover the secret. What should you do?

Accepted Answer

Run the Azure CLI command: az keyvault secret recover. When soft-delete is enabled on Azure Key Vault, deleted secrets are retained for the specified retention period (90 days in this case). Since only 60 days have passed, the secret is still in a soft-deleted state and can be recovered using the `az keyvault secret recover` command, which restores the secret to an active state.

Answer

Enable purge protection on the Key Vault first, then recover the secret.

Answer

Recover is not possible because the retention period of 90 days has not elapsed.

Answer

Run the Azure CLI command: az keyvault secret undelete

Question 20

You are developing an Azure Functions app that processes orders. Each order triggers a function that writes to Azure Cosmos DB. You notice occasional throttling (429 errors) from Cosmos DB during peak hours. The function app uses the Consumption plan. What is the most cost-effective way to reduce throttling?

Accepted Answer

Implement retry logic with exponential backoff in the function code.. Implementing retry logic with exponential backoff is the most cost-effective way to handle transient 429 errors from Cosmos DB. The Azure Cosmos DB SDK already includes built-in retry policies, but custom retry logic in the function code can be tuned to match the workload, allowing the function to wait and retry during peak throttling without incurring additional costs from scaling or increasing throughput.

Answer

Increase the provisioned throughput (RU/s) of the Cosmos DB container.

Answer

Upgrade the function app to the Premium plan for dedicated instances.

Answer

Increase the function app's instance count by scaling out.