AZ-204 Practice Test 21 — 15 Questions

Question 1

You deploy a microservices architecture on Azure Kubernetes Service (AKS). Some pods report OOMKilled errors. Which diagnostic step should you take first?

Accepted Answer

Review container resource requests and limits in the pod YAML. The OOMKilled error indicates that a container exceeded its memory limit. The first diagnostic step is to review the container's resource requests and limits in the pod YAML to determine if the memory limit is set too low for the workload. This directly addresses the root cause before scaling or checking node-level metrics.

Answer

Enable cluster autoscaler to add more nodes

Answer

Check node memory utilization with kubectl top nodes

Answer

Configure horizontal pod autoscaler based on memory

Question 2

You are developing a real-time analytics application that ingests IoT sensor data every second. The data is written to Azure Blob Storage as small JSON files (each ~1 KB). The application also needs to query the data based on device ID and timestamp. You need to design a storage solution that allows efficient querying without writing custom code for indexing. You have decided to use Azure Data Lake Storage Gen2. What should you do to optimize query performance?

Accepted Answer

Use a folder structure like /deviceid/yyyy/mm/dd/hh/ and set the device ID as the partition key.. Azure Data Lake Storage Gen2 supports hierarchical namespaces, which allow you to organize data into folders and subfolders. By structuring the path as /deviceid/yyyy/mm/dd/hh/, you effectively partition the data by device ID and time, enabling efficient querying with tools like Azure Synapse or PolyBase without custom indexing. This leverages the directory structure as a natural partition key, minimizing the data scanned during queries.

Answer

Use Append Blobs to combine small writes into larger blobs.

Answer

Store all JSON files in a single folder and use Azure Data Lake Analytics to query.

Answer

Store the data in Azure SQL Database instead of Blob Storage.

Question 3

You are developing a microservices-based application deployed to Azure Kubernetes Service (AKS). One of the microservices needs to securely retrieve secrets (e.g., database connection strings) from Azure Key Vault. The application uses managed identity for authentication. You need to implement a solution that meets the following requirements: 1) The microservice should retrieve secrets from Key Vault without storing any credentials in the application code or configuration files. 2) The solution must support automatic rotation of secrets without application restart. 3) The solution should minimize latency and avoid direct calls to Key Vault on every request. 4) The application is written in .NET 8 and uses the Azure SDK. What should you do?

Accepted Answer

Use Azure.Identity.DefaultAzureCredential to authenticate to Key Vault and retrieve secrets on application startup, caching them in memory with a configurable expiration time. Use a background service to refresh the cache before expiration.. It uses DefaultAzureCredential to authenticate to Key Vault via managed identity (no credentials stored), caches secrets in memory to minimize latency and avoid direct calls on every request, and uses a background service with configurable expiration to refresh the cache before expiration, supporting automatic secret rotation without application restart.

Answer

Store the connection string in an environment variable in the AKS pod spec and update the variable when the secret rotates.

Answer

Generate a client certificate in Key Vault and mount it as a volume in the AKS pod. Use the certificate to authenticate to Key Vault and retrieve secrets on each request.

Answer

Use the Azure Key Vault Secrets provider for the .NET Configuration API and set reloadOnChange to true to automatically reload secrets.

Question 4

You have an Azure App Service that runs a web API. The API is accessed by multiple client applications. You need to implement authentication and authorization using Microsoft Entra ID. The solution must allow client applications to obtain access tokens using the OAuth 2.0 client credentials flow. Which authentication setting should you configure in the App Service?

Accepted Answer

Use the built-in authentication module with Microsoft Entra ID as the identity provider.. Configuring the built-in authentication module in Azure App Service with Microsoft Entra ID as the identity provider allows the App Service to validate access tokens issued by Microsoft Entra ID. Client applications can use the OAuth 2.0 client credentials flow to obtain tokens from Microsoft Entra ID and then present them to the App Service. The built-in auth module does not perform token acquisition; it only validates tokens at the gateway level, simplifying the validation process for the app.

Answer

Enable the 'Token store' in the Authentication / Authorization blade.

Answer

Configure the app to use the Microsoft.Identity.Web library to validate tokens.

Answer

Upload a client certificate and configure certificate-based authentication.

Question 5

You deploy a container to Azure Container Instances. The container needs to persist data when it restarts. You mount an Azure Files share to a directory inside the container. Which volume type is this?

Accepted Answer

azureFile. Azure Container Instances supports mounting an Azure Files share as a volume to persist data across container restarts. The `azureFile` volume type references a pre-created Azure storage account and file share, which is mounted into the container's filesystem using SMB 3.0 protocol. This ensures data survives container crashes or restarts, as it is stored externally in Azure Files.

Answer

emptyDir

Answer

gitRepo

Answer

secret

Question 6

You are building an Azure Logic App that must send a confirmation email to users after a purchase. Your company uses Office 365 for email and you want to use the corporate email address. Which connector should you use?

Accepted Answer

Office 365 Outlook. The Office 365 Outlook connector is the correct choice because it provides direct, managed integration with Office 365 email services, allowing the Logic App to send emails using the corporate email address without needing to configure SMTP server details or handle authentication manually. This connector supports OAuth 2.0 authentication, which is the recommended and secure method for accessing Office 365 resources, and it is specifically designed for enterprise Office 365 accounts.

Answer

SMTP

Answer

SendGrid

Answer

Outlook.com

Question 7

An API receives JWT access tokens from Microsoft Entra ID. Which two token properties should the API validate before accepting a request? The architecture review board prefers a managed Azure-native control.

Accepted Answer

Issuer and signature are valid for the trusted tenant. The API must validate the issuer (iss) claim to ensure the token was issued by a trusted tenant (e.g., https://login.microsoftonline.com/{tenant-id}/v2.0) and verify the token's digital signature using the public keys from the OpenID Connect metadata endpoint. This prevents tokens from untrusted tenants or forged tokens from being accepted. Additionally, the API must validate the audience (aud) claim to ensure the token was specifically intended for this API, preventing it from being used by unintended applications.

Answer

The user's display name is present

Answer

The token was sent in a query string

Question 8

Refer to the exhibit. You deploy this ARM template to an App Service named 'myapp'. After deployment, users report they are able to access the app without being prompted to log in. What is the most likely reason?

Accepted Answer

The Azure Active Directory registration is missing the client secret.. The ARM template configures the `identityProviders` section with Azure Active Directory settings, but without a `clientSecret` property. The EasyAuth middleware requires a valid client secret to complete the OAuth 2.0 authorization code flow; without it, the authentication provider is effectively disabled, allowing unauthenticated access.

Answer

The redirect URI is not configured in the Azure AD app registration.

Answer

The issuer URL is incorrect; it should include the tenant ID.

Answer

The client ID is from a different tenant.

Question 9

Your company uses Azure API Management to expose APIs to external partners. You need to validate that each incoming request includes a valid JSON Web Token (JWT) issued by your Microsoft Entra ID tenant, and reject requests without valid tokens. What should you configure?

Accepted Answer

Add a validate-jwt policy in the inbound processing policy. The validate-jwt policy is the correct choice because it allows API Management to inspect the JWT token in the inbound request, verify its signature against the Microsoft Entra ID tenant’s keys, and enforce claims such as issuer and audience. This policy rejects requests with missing, expired, or invalid tokens, meeting the requirement to validate each incoming request.

Answer

Configure an OAuth 2.0 authorization server in API Management

Answer

Require a subscription key for each API

Answer

Use an IP access restriction policy

Question 10

You are developing an API that will be hosted on Azure API Management (APIM). The API must be accessible only to clients that present a valid JSON Web Token (JWT) issued by Microsoft Entra ID. Which APIM policy should you use to validate the JWT?

Accepted Answer

. The policy in Azure API Management is specifically designed to enforce the presence and validity of a JSON Web Token (JWT) in incoming requests. By setting the header-name attribute to 'Authorization' and failed-validation-httpcode to '401', the policy checks that the JWT in the Authorization header is cryptographically signed by Microsoft Entra ID and has not expired, rejecting invalid or missing tokens with a 401 Unauthorized response.

Answer

Answer

<authenticate-basic />

Answer

<check-header name="Authorization" failed-check-httpcode="401" />

Question 11

You are developing a microservice that processes images. After processing, it needs to store the result in Azure Blob Storage and send a message to Azure Service Bus for further processing. Which Azure SDK client should you use to minimize overhead?

Accepted Answer

Use the Azure.Storage.Blobs and Azure.Messaging.ServiceBus NuGet packages. The Azure.Storage.Blobs and Azure.Messaging.ServiceBus NuGet packages are the official, high-level Azure SDK client libraries that provide optimized, asynchronous APIs for interacting with Azure Blob Storage and Azure Service Bus. These libraries handle connection pooling, retry policies, serialization, and authentication automatically, minimizing overhead compared to lower-level approaches.

Answer

Deploy the microservice as an Azure Function

Answer

Call the Azure REST APIs directly using HttpClient

Answer

Use Azure SignalR Service for messaging

Question 12

An app uses Azure Event Grid to publish events. The events must be delivered to an Azure Function that processes them. Which Event Grid event delivery model should be used?

Accepted Answer

Push delivery. Azure Event Grid uses a push delivery model to send events to subscribers like Azure Functions. When an event occurs, Event Grid automatically forwards (pushes) the event to the configured endpoint via HTTP POST requests. This ensures near-real-time processing without the subscriber needing to poll for new events.

Answer

Pull delivery

Answer

Batch delivery

Answer

Poll delivery

Question 13

A company uses Azure API Management (APIM) to expose APIs to external partners. They need to enforce rate limiting per subscription key. Which APIM policy should be configured?

Accepted Answer

rate-limit. The rate-limit policy in Azure API Management is specifically designed to enforce rate limiting per subscription key, preventing individual API consumers from exceeding a defined number of calls within a specified time window (e.g., per second or per minute). This policy operates on a sliding window counter, ensuring fair usage across partners without affecting other subscribers. It is the correct choice because it directly targets subscription-based throttling at the API gateway level.

Answer

quota

Answer

ip-filter

Answer

throttling

Question 14

A developer is implementing Key Vault certificate retrieval. The application runs on Azure App Service and must avoid stored credentials. Which design should be used? The design must avoid adding custom operational scripts.

Accepted Answer

Enable managed identity and grant least-privilege access to the target resource. Managed identity (system-assigned or user-assigned) allows the App Service to authenticate to Key Vault without any stored credentials, because Azure automatically rotates the identity's service principal and provides an access token via the Azure Instance Metadata Service (IMDS) endpoint. By granting least-privilege access (e.g., a Key Vault access policy with only 'Get' on secrets), the design meets the requirement to avoid stored credentials and custom operational scripts.

Answer

Use a shared administrator account

Answer

Store a client secret in source control

Answer

Disable authentication for the target resource

Question 15

You are designing a solution to securely store connection strings for an Azure Function app that connects to Azure Service Bus. The connection string contains a Shared Access Key. The company policy requires that secrets be rotated every 90 days and that no secret is stored in source code or configuration files. The solution should minimize operational overhead. What should you use?

Accepted Answer

Store the connection string in Azure Key Vault and use a managed identity to access it from the Function app.. Azure Key Vault provides a centralized, secure store for secrets like connection strings, and using a managed identity allows the Azure Function app to authenticate to Key Vault without storing any credentials in code or configuration. This approach satisfies the rotation policy by enabling automatic or scheduled secret rotation in Key Vault, and it minimizes operational overhead by eliminating manual credential management.

Answer

Store the connection string in a JSON configuration file and use Azure Policy to enforce encryption.

Answer

Store the connection string in Azure App Configuration with encryption at rest using a customer-managed key.

Answer

Store the connection string as an environment variable in the Function app's application settings.