AZ-204 Practice Test 22 — 15 Questions

Question 1

You are developing an app that processes orders. When an order is placed, you need to send a confirmation email and update an inventory database. The email service may be slow but must not delay the order processing. Which approach should you use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Send the email asynchronously via a queue (e.g., Azure Queue Storage).. Sending the email asynchronously via a queue (e.g., Azure Queue Storage) decouples the slow email service from the order processing workflow. This ensures the order processing completes immediately without waiting for the email to be sent, meeting the requirement that the email must not delay order processing.

Answer

Scale out the email service to handle the load.

Answer

Use Azure Event Grid to trigger the email.

Answer

Call the email service synchronously and wait for the response.

Question 2

A Kubernetes-based image resize worker on AKS must pull images from Azure Container Registry without storing registry passwords in Kubernetes secrets. What should be used?

Accepted Answer

Attach the ACR to AKS or grant the kubelet managed identity AcrPull. Attaching an ACR to an AKS cluster or granting the kubelet managed identity the AcrPull role eliminates the need to store registry passwords in Kubernetes secrets. This leverages Azure AD managed identities for secure, password-less authentication, where the AKS cluster's kubelet uses its managed identity to authenticate with ACR via Azure Resource Manager tokens. The AcrPull role assignment authorizes the identity to pull images, ensuring credentials are never exposed in manifests or secrets.

Answer

Store the ACR admin password in every deployment manifest

Answer

Make the container registry public

Answer

Use an App Service deployment slot

Question 3

You deploy a microservices application to Azure Kubernetes Service (AKS). The application uses Azure Cache for Redis to store session state. Users report that they are frequently logged out. You suspect that the session data is being evicted from the cache. Which configuration change should you make to reduce evictions?

Accepted Answer

Increase the maxmemory-reserved setting or change eviction policy. Increasing the `maxmemory-reserved` setting allocates more memory exclusively for non-cache operations (like replication buffers), reducing the chance that session data is evicted under memory pressure. Alternatively, changing the eviction policy to `allkeys-lru` or `volatile-lru` can prioritize keeping recently used keys, which helps retain active session state. Both adjustments directly address the symptom of frequent evictions causing session loss.

Answer

Enable clustering for the cache

Answer

Enable data persistence using RDB or AOF

Answer

Upgrade to a higher-tier Azure Cache for Redis

Question 4

Your Azure Functions app uses Durable Functions to orchestrate a workflow. The orchestration sometimes fails with a 'FunctionRuntimeException' due to a timeout. You need to increase the maximum orchestration time. What should you modify?

Accepted Answer

Set 'maxOrchestrationTimeout' in the host.json file. D is correct because in Durable Functions, the maximum orchestration time is controlled by the 'maxOrchestrationTimeout' setting in the host.json file. This setting specifies the maximum duration an orchestration instance can run before it times out, and increasing it directly addresses the 'FunctionRuntimeException' due to timeout. The default value is 7 days, but you can extend it as needed.

Answer

Add an app setting 'AzureFunctionsJobHost__functionTimeout'

Answer

Change the Azure Storage account to a Premium account

Answer

Increase the 'functionTimeout' in host.json

Question 5

You need to monitor the performance of an Azure App Service web app. Which metric indicates high CPU usage?

Accepted Answer

CPU Time. CPU Time is the correct metric for monitoring high CPU usage in an Azure App Service web app because it directly measures the total amount of CPU processing time consumed by the application. When CPU usage is high, the CPU Time metric will show elevated values, reflecting the actual seconds of processor time used, which is the most direct indicator of CPU load.

Answer

Data In/Out

Answer

Requests per second

Answer

Memory working set

Question 6

You are using Azure Monitor to collect logs from multiple Azure resources. You need to query logs to find all error events from the last 24 hours. Which query language should you use?

Accepted Answer

Kusto Query Language (KQL). Azure Monitor uses Kusto Query Language (KQL) as its native query language for log analytics. KQL is specifically designed for querying large volumes of structured and semi-structured data in Azure Data Explorer and Log Analytics workspaces, making it the correct choice for retrieving error events from the last 24 hours.

Answer

Transact-SQL (T-SQL)

Answer

PromQL

Answer

PowerShell

Question 7

Contoso is building a serverless application using Azure Functions. One function needs to read messages from an Azure Event Hub and store them in Azure Blob Storage. The function uses the Event Hubs trigger. The team wants to authenticate to both Event Hubs and Blob Storage using managed identities. The Function app has system-assigned managed identity enabled. Which role assignments are required on the Event Hubs namespace and the storage account?

Accepted Answer

Assign the 'Azure Event Hubs Data Receiver' role to the managed identity on the Event Hubs namespace. Assign the 'Storage Blob Data Contributor' role to the managed identity on the storage account.. The function uses an Event Hubs trigger, which requires the 'Azure Event Hubs Data Receiver' role to read messages from the Event Hubs namespace. To write data to Azure Blob Storage, the 'Storage Blob Data Contributor' role is needed on the storage account. Both roles are assigned to the function app's system-assigned managed identity, enabling secure, keyless authentication.

Answer

Assign the 'Azure Event Hubs Data Sender' role and 'Storage Blob Data Reader' role.

Answer

Assign the 'Azure Event Hubs Data Reader' role (which does not exist) and 'Storage Blob Data Contributor' role.

Answer

Assign the 'Azure Event Hubs Data Owner' role and 'Storage Blob Data Owner' role.

Question 8

You have an Azure Storage account with hierarchical namespace enabled (Azure Data Lake Storage Gen2). You need to provide an application with delegated access to a specific directory and its contents, with the ability to list, read, and write files. The access must be scoped to the directory and not allow access to other parts of the storage account. Which approach should you use?

Accepted Answer

Configure access control lists (ACLs) on the directory and assign the application's managed identity.. Azure Data Lake Storage Gen2 supports POSIX-like access control lists (ACLs) that can grant granular permissions to a specific directory and its contents. By configuring ACLs on the target directory and assigning the application's managed identity, you can precisely scope list, read, and write access to that directory without affecting other parts of the storage account. This approach avoids the need for account-level keys or RBAC roles, which would grant broader permissions.

Answer

Generate a shared access signature (SAS) token for the directory.

Answer

Assign the 'Storage Blob Data Contributor' RBAC role to the application at the storage account level.

Answer

Use the storage account access key in the application.

Question 9

A developer needs to call a third-party REST API from an Azure Function app. The API requires OAuth2 client credentials flow. Which approach should they use to securely store and retrieve the client secret?

Accepted Answer

Store in Azure Key Vault. Azure Key Vault is the secure store for secrets like client secrets. Option A is wrong because environment variables are not secure. Option B is wrong because App Configuration is for configuration. Option D is wrong because Managed Identity does not store secrets; it provides identity.

Answer

Store in application settings as environment variable

Answer

Store in Azure App Configuration

Answer

Use Managed Identity

Question 10

You have an Azure App Service web app that experiences intermittent slowness. You enable Application Insights and notice that the "Failed Requests" metric is low, but "Server Response Time" is high for a subset of requests. You want to identify the specific code path causing the delay. Which feature should you use?

Accepted Answer

Profiler.. C is correct because the Application Insights Profiler captures detailed call stacks and execution timing for slow requests, allowing you to pinpoint the exact code path causing high server response time. Unlike other features, Profiler is specifically designed for performance troubleshooting by tracing request execution at the code level.

Answer

Live Metrics.

Answer

Snapshot Debugger.

Answer

Availability tests.

Question 11

Messages failing to process are redelivered by Azure Service Bus. After a message has been delivered and abandoned the maximum number of times (MaxDeliveryCount), where does Service Bus move the message?

Accepted Answer

The message is moved to the dead-letter sub-queue of the original queue. When a message in Azure Service Bus is delivered and abandoned the maximum number of times (as defined by the MaxDeliveryCount property, default 10), the message is automatically moved to the dead-letter sub-queue of the original queue. This dead-letter sub-queue stores messages that cannot be processed successfully, allowing you to inspect and handle them separately without losing the message entirely.

Answer

The message is permanently deleted from the queue

Answer

The message is returned to the front of the queue with its DeliveryCount reset to zero

Answer

The message expires and is discarded according to the Time-to-Live setting

Question 12

A workflow must process 500 customer records in parallel and then aggregate all results into a single summary report. The team wants to use Azure Durable Functions so the orchestration state is durable and the solution can resume after a Function App restart. Which Durable Functions pattern matches this requirement?

Accepted Answer

Fan-out/fan-in: start 500 activity functions in parallel with Task.WhenAll inside the orchestrator, then aggregate all returned results. The fan-out/fan-in pattern in Durable Functions is specifically designed to execute multiple activity functions in parallel using Task.WhenAll inside an orchestrator, then aggregate their results. This matches the requirement to process 500 customer records concurrently and produce a single summary report, while the orchestration state is durably persisted and can resume after a Function App restart.

Answer

Function chaining: call each activity function sequentially, collecting each result before starting the next

Answer

Async HTTP API: start the workflow with an HTTP trigger, return a 202 with a status URL, and have the client poll for completion

Answer

Monitor: use a Durable timer loop that checks a status table every 60 seconds until all records are marked processed

Question 13

You are developing an application that writes log entries to Azure Blob Storage. Each log entry is approximately 500 bytes, and you expect to generate millions of entries per day. The logs are rarely read, and when they are read, you need to retrieve ranges of logs sequentially. Which blob type should you use to minimize storage costs and maximize write throughput?

Accepted Answer

Append blobs. Append blobs are optimized for append operations, making them ideal for write-heavy, sequential logging scenarios. Each append operation adds data to the end of the blob, achieving high write throughput without the overhead of managing block lists. Since logs are rarely read and accessed sequentially, append blobs minimize storage costs compared to block blobs (which require block management overhead) and page blobs (which are designed for random access and are more expensive).

Answer

Block blobs

Answer

Page blobs

Answer

Azure Files shares

Question 14

The internal API team is deploying a containerized .NET API that receives sporadic requests — sometimes none for hours, then bursts of activity. Cost is a priority. The team wants the container to stop running when idle and start automatically when a request arrives, with no server management overhead. Which Azure service is the best fit?

Accepted Answer

Azure Container Apps with scale-to-zero enabled on the HTTP ingress. Azure Container Apps with scale-to-zero enabled on the HTTP ingress is the best fit because it allows the container to scale down to zero replicas when idle, automatically stopping the container to save costs, and scales back up to handle incoming HTTP requests with no server management overhead. This serverless platform abstracts Kubernetes infrastructure, meeting the team's requirement for minimal operational burden and cost efficiency.

Answer

Azure Kubernetes Service with the cluster autoscaler set to a minimum node count of zero

Answer

Azure App Service on a B1 (Basic) plan with Always On disabled

Answer

Azure Virtual Machine Scale Sets with scheduled scaling to zero instances overnight

Question 15

You are building a web application that uses Microsoft Entra ID for authentication. The application needs to call Microsoft Graph API to read user profiles and send emails on behalf of the signed-in user. You want to ensure that the user's consent is obtained only once and that the application can refresh tokens silently. Which OAuth 2.0 flow should you implement?

Accepted Answer

OAuth 2.0 Authorization Code flow with PKCE (Proof Key for Code Exchange).. The Authorization Code flow with PKCE is the recommended OAuth 2.0 flow for public client applications (like single-page apps or mobile apps) that need delegated access to Microsoft Graph. It allows the application to obtain an authorization code, exchange it for an access token and a refresh token, and use the refresh token to silently acquire new tokens without requiring the user to re-consent. This flow ensures that user consent is obtained only once and supports silent token refresh, meeting the requirements.

Answer

OAuth 2.0 Client Credentials flow.

Answer

OAuth 2.0 Implicit Grant flow.

Answer

OAuth 2.0 Resource Owner Password Credentials (ROPC) flow.