AZ-204 Practice Test 22 — 15 Questions

Question 1

Your application stores user profile images in Azure Blob Storage. You need to serve these images to users with low latency from a domain name that you own. What should you use?

Accepted Answer

Create an Azure CDN endpoint with a custom domain and point it to the blob container.. Azure CDN is the best choice for serving static images from Blob Storage with low latency using a custom domain. While Azure Front Door can also serve content with low latency, it is primarily a global load balancer and application acceleration service, and for simple image serving from blob storage, CDN is more cost-effective and directly designed for caching static content. Option A (static website hosting) does not provide edge caching for low latency. Option C (Azure DNS) only resolves the domain; it doesn't provide caching.

Answer

Enable static website hosting and configure a custom domain directly on the storage account.

Answer

Configure a custom domain in Azure DNS and point it to the storage account endpoint.

Answer

Use Azure Front Door with a custom domain.

Question 2

Your company uses Azure API Management (APIM) to expose several APIs. One of the backend APIs requires an API key that is stored in Azure Key Vault. You need to configure APIM to retrieve the API key from Key Vault and pass it to the backend in a header without exposing the key in policy definitions. Which APIM feature should you use?

Accepted Answer

Use a named value that references the Key Vault secret, and reference that named value in a set-header policy.. Named values in Azure API Management can be configured to reference secrets stored in Azure Key Vault. When a named value is linked to a Key Vault secret, APIM automatically retrieves the secret value at runtime and can inject it into policies (e.g., a set-header policy) without the secret ever appearing in plaintext in the policy definition. This approach ensures the API key is securely managed and not exposed in source control or policy code.

Answer

Use a policy expression with the context.Variables to store the key.

Answer

Store the API key directly in the backend settings of the API.

Answer

Use the authentication-managed-identity policy to authenticate to Key Vault and retrieve the secret.

Question 3

You are designing a solution to ingest billions of small IoT sensor messages (each ~500 bytes). Messages arrive at high velocity and must be retained for 90 days. You need to query the data efficiently by device ID and timestamp. You want to minimize storage cost and write latency. Which Azure Storage solution should you use?

Accepted Answer

Azure Table Storage. Azure Table Storage is ideal for this scenario because it provides a cost-effective, schema-less NoSQL store that supports high-volume ingestion of billions of small messages with low write latency. Its partition key (device ID) and row key (timestamp) design enables efficient point queries by device and time range, while the 90-day retention aligns with Table Storage's lifecycle management capabilities.

Answer

Azure Blob Storage with JSON logs

Answer

Azure Queue Storage

Answer

Azure File Storage

Question 4

Your company stores API keys and connection strings in Azure Key Vault. You need to grant an Azure Function read access to these secrets using the principle of least privilege. Which identity type should you assign to the Function App?

Accepted Answer

System-assigned managed identity. A system-assigned managed identity is the correct choice because it is directly tied to the lifecycle of the Azure Function, automatically managed by Azure, and requires no manual credential rotation. It provides the most restrictive scope (only that specific Function App) and adheres to the principle of least privilege by granting access only to the identity that needs it, without the overhead of managing a separate identity or service principal.

Answer

User-assigned managed identity

Answer

Service principal

Answer

Access policy on the Key Vault

Question 5

You have implemented a long-running order processing workflow using Azure Durable Functions. The orchestration may run for hours and involves multiple activity functions. You need to monitor the status of all running orchestrations and receive alerts when an orchestration fails. Which approach provides the most comprehensive and real-time monitoring?

Accepted Answer

Enable Application Insights for the Functions app and use its telemetry to monitor orchestration execution and set alerts.. Application Insights provides comprehensive, real-time monitoring for Durable Functions by automatically capturing orchestration lifecycle events, including failures, retries, and durations. It enables proactive alerting on failure metrics (e.g., 'orchestration-failed') without polling, and offers rich diagnostic tools like distributed tracing and custom querying. This is the most integrated and feature-rich approach for monitoring long-running orchestrations.

Answer

Use the Durable Functions HTTP API to poll the status of each orchestration.

Answer

Use Azure Monitor to create alerts on custom metrics published by the Durable Functions.

Answer

Use Azure Logic Apps to periodically check the orchestration status and send alerts.

Question 6

You have an Azure App Service web app that uses a system-assigned managed identity. The app needs to read a secret stored in Azure Key Vault. You need to grant the app the minimum required permissions to access the secret. Which RBAC role should you assign to the managed identity at the Key Vault scope?

Accepted Answer

Key Vault Secrets User. The Key Vault Secrets User role grants the minimum required permission to read secrets from Azure Key Vault. This role provides the 'Microsoft.KeyVault/vaults/secrets/getSecret/action' permission, which is exactly what the app needs to retrieve the secret value. It does not grant any write or management capabilities, adhering to the principle of least privilege.

Answer

Key Vault Reader

Answer

Key Vault Secrets Officer

Answer

Contributor

Question 7

You are deploying a containerized application to Azure Container Instances (ACI). The application requires a connection string to an Azure SQL Database. The connection string contains a password that is stored as a secret in Azure Key Vault. The container image expects to read the connection string from an environment variable named SQL_CONNECTION_STRING. You want to pass the secret securely without embedding it in the YAML deployment file and without modifying the container image. The ACI container group will use a system-assigned managed identity that has access to the Key Vault secret. Which approach should you use?

Accepted Answer

Use a secure environment variable with a Key Vault reference syntax (e.g., secret://myvault/secretname). Azure Container Instances supports Key Vault references in environment variables using the `secret://` syntax, which allows you to securely inject secrets into containers at runtime without exposing them in the deployment YAML. The system-assigned managed identity is automatically used by the ACI infrastructure to authenticate to Key Vault and retrieve the secret, so no code changes to the container image are required.

Answer

Mount a volume from Azure Files containing the connection string

Answer

Use the managed identity inside the container to call the Key Vault SDK and retrieve the secret

Answer

Store the connection string as an environment variable in ACI configuration but mark it as secure

Question 8

You are building a serverless image-processing solution using Azure Functions. The function must automatically run whenever a new image is uploaded to a blob container and must scale out to handle high upload volumes. Which trigger and hosting plan should you use?

Accepted Answer

Blob trigger with Consumption plan. The Blob trigger is designed to automatically execute a function when a blob is created or updated in Azure Blob Storage, making it the correct choice for an image-processing solution that must run on new uploads. The Consumption plan provides automatic scaling to handle high upload volumes by allocating resources on demand, which aligns with the serverless, event-driven requirement.

Answer

Timer trigger with Consumption plan

Answer

HTTP trigger with Premium plan

Answer

Queue trigger with App Service plan

Question 9

You are deploying a new version of an ASP.NET Core web application to Azure App Service. You want to test the new version with a subset of users before making it available to everyone. You also need to be able to switch back instantly if issues are found. Which App Service feature should you use?

Accepted Answer

Use deployment slots with swapping.. Deployment slots in Azure App Service allow you to deploy a new version of your application to a staging slot, then gradually route a subset of user traffic to it using slot-specific routing rules (e.g., cookie-based affinity). If issues arise, you can instantly revert by swapping the slots back, which requires no redeployment and preserves the previous version's warm instances.

Answer

Create a separate App Service plan and deploy the new version there.

Answer

Use Azure DevOps deployment pipelines with deployment gates.

Answer

Use Azure Traffic Manager to route traffic between the old and new versions.

Question 10

You are deploying a Docker container to Azure Container Instances (ACI). The container must use GPU resources for machine learning inference. You need to select the appropriate option to provision GPU-enabled containers. What should you do?

Accepted Answer

Deploy the container to a container group with a GPU-enabled SKU (e.g., NV series).. Azure Container Instances supports GPU resources only when you deploy a container group using a GPU-optimized SKU, such as the NV-series (e.g., Standard_NC6s_v3). These SKUs provide NVIDIA Tesla GPUs (e.g., K80, P100, V100) that are directly exposed to the container, enabling hardware-accelerated machine learning inference. You must specify the GPU SKU in the container group's resource requests during deployment, and the container image must include the appropriate NVIDIA CUDA drivers or runtime.

Answer

Mount a GPU volume from the host.

Answer

Use Azure Batch with GPU-enabled pools.

Answer

Enable container GPU support in the Dockerfile.

Question 11

You deploy a web application in Azure App Service. You need to authenticate users via Microsoft Entra ID (Microsoft Entra ID) with minimal custom code. Which App Service feature should you configure?

Accepted Answer

App Service Authentication (Easy Auth). App Service Authentication (also known as Easy Auth) is the correct choice because it provides a turnkey authentication layer that integrates directly with Microsoft Entra ID. It requires minimal custom code by handling the OAuth 2.0 authorization code flow, token validation, and session management at the App Service platform level, allowing you to simply configure the identity provider in the Azure portal.

Answer

Microsoft Entra ID B2C

Answer

Application Gateway with WAF

Answer

App Service Managed Identity

Question 12

Your company has several Azure subscriptions, and you need to create a custom role that allows security engineers to start and stop Azure virtual machines but not delete them or modify their network interfaces. The role must be scoped to a specific resource group. How should you define this custom role?

Accepted Answer

Create a custom role with allowed actions for start and stop, and explicitly deny delete actions using NotActions.. Custom roles in Azure RBAC allow you to define granular permissions using Actions and NotActions. To allow start/stop but prevent delete, you can define a broad action like 'Microsoft.Compute/virtualMachines/*' (which includes start/stop and delete) and then use 'NotActions' to explicitly exclude 'Microsoft.Compute/virtualMachines/delete'. Since network interface modifications fall under the 'Microsoft.Network' resource provider, they are not included in 'Microsoft.Compute/virtualMachines/*' and thus are implicitly denied by this role definition. Scoping the role to a specific resource group ensures the permissions apply only to that resource group, meeting the requirement.

Answer

Assign the built-in Contributor role to the resource group.

Answer

Use Azure Policy to prevent deletion of VMs in that resource group.

Answer

Add the engineers to an Microsoft Entra ID administrative unit and assign permissions for VM operations.

Question 13

You are building an Azure Logic App that must call an external API secured with OAuth 2.0 Client Credentials flow. The external API is registered in a different Microsoft Entra ID tenant. You need to obtain an access token and add it to the request headers. Which action and authentication configuration should you use?

Accepted Answer

Use the HTTP action with Active Directory OAuth authentication, providing the tenant ID, client ID, and client secret.. The HTTP action's Active Directory OAuth authentication type directly supports the OAuth 2.0 Client Credentials flow for cross-tenant scenarios. By providing the tenant ID, client ID, and client secret, the Logic App runtime can obtain an access token from the external tenant's token endpoint and automatically inject it into the Authorization header as a Bearer token. This is the only built-in authentication option in the HTTP action that handles the client credentials grant without custom code.

Answer

Use the HTTP action with Managed Identity authentication.

Answer

Use the HTTP + Swagger connector to import the API definition.

Answer

Use the Azure Key Vault - Get secret action to retrieve a token.

Question 14

You are designing a solution that uses Azure Container Instances (ACI) to run a batch job that processes images. The job is triggered by a message in Azure Queue Storage. Each image takes about 5 minutes to process. You need to ensure that the container runs only when there are messages in the queue and scales automatically. What should you use?

Accepted Answer

Use Azure Logic Apps with a Container Instances connector.. Azure Logic Apps provides a serverless workflow that can be triggered by a queue message (via the Azure Queue Storage connector) and then use the Container Instances connector to start a container group. This ensures the container runs only when messages are present and scales automatically by creating a new container instance per message, matching the requirement for event-driven, on-demand execution without idle costs.

Answer

Use Azure Functions with a custom container and queue trigger.

Answer

Use Azure Batch to process the images in a pool of VMs.

Answer

Deploy the image processing job as a pod in Azure Kubernetes Service.

Question 15

You are building an event-driven application that needs to publish messages to multiple independent subscribers. Each subscriber must be able to filter messages based on custom properties, and each subscriber must receive all messages that match its filter, even if other subscribers have different filters. The solution must guarantee message delivery. Which Azure messaging service should you use?

Accepted Answer

Azure Service Bus Topics and Subscriptions. Azure Service Bus Topics and Subscriptions are designed for publish-subscribe messaging where multiple independent subscribers each receive a copy of every message that matches their filter criteria. The topic allows publishing messages with custom properties, and each subscription can define a SQL-like filter (using the `SqlFilter` class) to select only relevant messages. This ensures that all subscribers receive all messages matching their filter, with guaranteed delivery via the broker's persistent storage and at-least-once delivery semantics.

Answer

Azure Queue Storage

Answer

Azure Service Bus Queues

Answer

Azure Event Hubs