AZ-204 Practice Test 23 — 15 Questions

Question 1

Users of a web application hosted on App Service are randomly signed out when the app is scaled out to three instances. Investigation shows that session data stored in in-process memory is not available when subsequent requests hit a different instance. What is the recommended solution?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Store session data in Azure Cache for Redis and configure all App Service instances to connect to the same Redis endpoint. When an App Service scales out to multiple instances, in-process session state is stored locally on each instance and is not shared. Azure Cache for Redis provides a centralized, in-memory data store that all instances can access, ensuring session data is available regardless of which instance handles a request. This is the recommended pattern for distributed session state in Azure.

Answer

Enable ARR affinity (sticky sessions) on the App Service to route each user's requests to the same instance

Answer

Write session data to Azure Blob Storage as a JSON file keyed by session ID on every request

Answer

Store session state in a Cosmos DB container with a TTL equal to the session timeout

Question 2

You are developing a solution that needs to perform a multi-step workflow. The workflow involves calling several third-party APIs, and some steps may require waiting for a human approval via email. The workflow may run for hours. You want to use Azure Functions to implement this orchestration. Which Azure Functions feature should you use?

Accepted Answer

Durable Functions. Durable Functions is the correct choice because it is an extension of Azure Functions that enables stateful, long-running orchestration workflows. It supports waiting for external events (like human approval via email), managing multi-step API calls, and handling execution that may run for hours, all while preserving state through checkpoints and replay.

Answer

Timer trigger functions

Answer

Service Bus queue trigger functions

Answer

Blob storage trigger functions

Question 3

You are building a web application that allows users to upload profile pictures. The images are up to 5 MB in size and must be stored durably. The images are accessed infrequently after upload (a few times per month). You want to minimize storage costs while ensuring the data is available within seconds when requested. Which Azure Blob Storage access tier should you use for the blob container?

Accepted Answer

Cool. The Cool tier is the optimal choice because the images are accessed infrequently (a few times per month) and are up to 5 MB in size. Cool tier offers lower storage cost than Hot tier while still providing sub-second latency for data retrieval, meeting the requirement of availability within seconds. Archive tier would have the lowest storage cost but incurs a multi-hour rehydration delay, violating the seconds-level availability requirement.

Answer

Hot

Answer

Archive

Answer

Premium

Question 4

A Windows desktop application uses standard .NET file system calls such as File.ReadAllText and Directory.GetFiles. The team wants to move the file storage to Azure. The application code must not be rewritten. Which Azure storage service supports this requirement?

Accepted Answer

Azure Files with an SMB share mounted as a drive letter on the Windows machine. Azure Files with an SMB share mounted as a drive letter on the Windows machine allows the existing .NET application to use standard file system calls like File.ReadAllText and Directory.GetFiles without any code changes. This is because the mounted SMB share presents itself as a local drive, and the .NET runtime interacts with it through the standard Windows file system API, which internally uses the SMB protocol (CIFS) to communicate with Azure Files. No SDK or API rewrite is required.

Answer

Azure Blob Storage with the Azure Storage SDK replacing all file system calls

Answer

Azure Queue Storage for staging files between producer and consumer processes

Answer

Azure Table Storage with the file content stored as base64-encoded entity properties

Question 5

Your application stores user profile images in Azure Blob Storage. You need to serve these images to users with low latency from a domain name that you own. What should you use?

Accepted Answer

Create an Azure CDN endpoint with a custom domain and point it to the blob container.. Azure CDN is the best choice for serving static images from Blob Storage with low latency using a custom domain. While Azure Front Door can also serve content with low latency, it is primarily a global load balancer and application acceleration service, and for simple image serving from blob storage, CDN is more cost-effective and directly designed for caching static content. Option A (static website hosting) does not provide edge caching for low latency. Option C (Azure DNS) only resolves the domain; it doesn't provide caching.

Answer

Enable static website hosting and configure a custom domain directly on the storage account.

Answer

Configure a custom domain in Azure DNS and point it to the storage account endpoint.

Answer

Use Azure Front Door with a custom domain.

Question 6

Your company uses Azure API Management (APIM) to expose several APIs. One of the backend APIs requires an API key that is stored in Azure Key Vault. You need to configure APIM to retrieve the API key from Key Vault and pass it to the backend in a header without exposing the key in policy definitions. Which APIM feature should you use?

Accepted Answer

Use a named value that references the Key Vault secret, and reference that named value in a set-header policy.. Named values in Azure API Management can be configured to reference secrets stored in Azure Key Vault. When a named value is linked to a Key Vault secret, APIM automatically retrieves the secret value at runtime and can inject it into policies (e.g., a set-header policy) without the secret ever appearing in plaintext in the policy definition. This approach ensures the API key is securely managed and not exposed in source control or policy code.

Answer

Use a policy expression with the context.Variables to store the key.

Answer

Store the API key directly in the backend settings of the API.

Answer

Use the authentication-managed-identity policy to authenticate to Key Vault and retrieve the secret.

Question 7

You are designing a solution to ingest billions of small IoT sensor messages (each ~500 bytes). Messages arrive at high velocity and must be retained for 90 days. You need to query the data efficiently by device ID and timestamp. You want to minimize storage cost and write latency. Which Azure Storage solution should you use?

Accepted Answer

Azure Table Storage. Azure Table Storage is ideal for this scenario because it provides a cost-effective, schema-less NoSQL store that supports high-volume ingestion of billions of small messages with low write latency. Its partition key (device ID) and row key (timestamp) design enables efficient point queries by device and time range, while the 90-day retention aligns with Table Storage's lifecycle management capabilities.

Answer

Azure Blob Storage with JSON logs

Answer

Azure Queue Storage

Answer

Azure File Storage

Question 8

Your company stores API keys and connection strings in Azure Key Vault. You need to grant an Azure Function read access to these secrets using the principle of least privilege. Which identity type should you assign to the Function App?

Accepted Answer

System-assigned managed identity. A system-assigned managed identity is the correct choice because it is directly tied to the lifecycle of the Azure Function, automatically managed by Azure, and requires no manual credential rotation. It provides the most restrictive scope (only that specific Function App) and adheres to the principle of least privilege by granting access only to the identity that needs it, without the overhead of managing a separate identity or service principal.

Answer

User-assigned managed identity

Answer

Service principal

Answer

Access policy on the Key Vault

Question 9

You have implemented a long-running order processing workflow using Azure Durable Functions. The orchestration may run for hours and involves multiple activity functions. You need to monitor the status of all running orchestrations and receive alerts when an orchestration fails. Which approach provides the most comprehensive and real-time monitoring?

Accepted Answer

Enable Application Insights for the Functions app and use its telemetry to monitor orchestration execution and set alerts.. Application Insights provides comprehensive, real-time monitoring for Durable Functions by automatically capturing orchestration lifecycle events, including failures, retries, and durations. It enables proactive alerting on failure metrics (e.g., 'orchestration-failed') without polling, and offers rich diagnostic tools like distributed tracing and custom querying. This is the most integrated and feature-rich approach for monitoring long-running orchestrations.

Answer

Use the Durable Functions HTTP API to poll the status of each orchestration.

Answer

Use Azure Monitor to create alerts on custom metrics published by the Durable Functions.

Answer

Use Azure Logic Apps to periodically check the orchestration status and send alerts.

Question 10

You have an Azure App Service web app that uses a system-assigned managed identity. The app needs to read a secret stored in Azure Key Vault. You need to grant the app the minimum required permissions to access the secret. Which RBAC role should you assign to the managed identity at the Key Vault scope?

Accepted Answer

Key Vault Secrets User. The Key Vault Secrets User role grants the minimum required permission to read secrets from Azure Key Vault. This role provides the 'Microsoft.KeyVault/vaults/secrets/getSecret/action' permission, which is exactly what the app needs to retrieve the secret value. It does not grant any write or management capabilities, adhering to the principle of least privilege.

Answer

Key Vault Reader

Answer

Key Vault Secrets Officer

Answer

Contributor

Question 11

You are deploying a containerized application to Azure Container Instances (ACI). The application requires a connection string to an Azure SQL Database. The connection string contains a password that is stored as a secret in Azure Key Vault. The container image expects to read the connection string from an environment variable named SQL_CONNECTION_STRING. You want to pass the secret securely without embedding it in the YAML deployment file and without modifying the container image. The ACI container group will use a system-assigned managed identity that has access to the Key Vault secret. Which approach should you use?

Accepted Answer

Use a secure environment variable with a Key Vault reference syntax (e.g., secret://myvault/secretname). Azure Container Instances supports Key Vault references in environment variables using the `secret://` syntax, which allows you to securely inject secrets into containers at runtime without exposing them in the deployment YAML. The system-assigned managed identity is automatically used by the ACI infrastructure to authenticate to Key Vault and retrieve the secret, so no code changes to the container image are required.

Answer

Mount a volume from Azure Files containing the connection string

Answer

Use the managed identity inside the container to call the Key Vault SDK and retrieve the secret

Answer

Store the connection string as an environment variable in ACI configuration but mark it as secure

Question 12

You are building a serverless image-processing solution using Azure Functions. The function must automatically run whenever a new image is uploaded to a blob container and must scale out to handle high upload volumes. Which trigger and hosting plan should you use?

Accepted Answer

Blob trigger with Consumption plan. The Blob trigger is designed to automatically execute a function when a blob is created or updated in Azure Blob Storage, making it the correct choice for an image-processing solution that must run on new uploads. The Consumption plan provides automatic scaling to handle high upload volumes by allocating resources on demand, which aligns with the serverless, event-driven requirement.

Answer

Timer trigger with Consumption plan

Answer

HTTP trigger with Premium plan

Answer

Queue trigger with App Service plan

Question 13

You are deploying a new version of an ASP.NET Core web application to Azure App Service. You want to test the new version with a subset of users before making it available to everyone. You also need to be able to switch back instantly if issues are found. Which App Service feature should you use?

Accepted Answer

Use deployment slots with swapping.. Deployment slots in Azure App Service allow you to deploy a new version of your application to a staging slot, then gradually route a subset of user traffic to it using slot-specific routing rules (e.g., cookie-based affinity). If issues arise, you can instantly revert by swapping the slots back, which requires no redeployment and preserves the previous version's warm instances.

Answer

Create a separate App Service plan and deploy the new version there.

Answer

Use Azure DevOps deployment pipelines with deployment gates.

Answer

Use Azure Traffic Manager to route traffic between the old and new versions.

Question 14

You are deploying a Docker container to Azure Container Instances (ACI). The container must use GPU resources for machine learning inference. You need to select the appropriate option to provision GPU-enabled containers. What should you do?

Accepted Answer

Deploy the container to a container group with a GPU-enabled SKU (e.g., NV series).. Azure Container Instances supports GPU resources only when you deploy a container group using a GPU-optimized SKU, such as the NV-series (e.g., Standard_NC6s_v3). These SKUs provide NVIDIA Tesla GPUs (e.g., K80, P100, V100) that are directly exposed to the container, enabling hardware-accelerated machine learning inference. You must specify the GPU SKU in the container group's resource requests during deployment, and the container image must include the appropriate NVIDIA CUDA drivers or runtime.

Answer

Mount a GPU volume from the host.

Answer

Use Azure Batch with GPU-enabled pools.

Answer

Enable container GPU support in the Dockerfile.

Question 15

You deploy a web application in Azure App Service. You need to authenticate users via Microsoft Entra ID (Microsoft Entra ID) with minimal custom code. Which App Service feature should you configure?

Accepted Answer

App Service Authentication (Easy Auth). App Service Authentication (also known as Easy Auth) is the correct choice because it provides a turnkey authentication layer that integrates directly with Microsoft Entra ID. It requires minimal custom code by handling the OAuth 2.0 authorization code flow, token validation, and session management at the App Service platform level, allowing you to simply configure the identity provider in the Azure portal.

Answer

Microsoft Entra ID B2C

Answer

Application Gateway with WAF

Answer

App Service Managed Identity