AZ-204 Practice Test 24 — 15 Questions

Question 1

Your company has several Azure subscriptions, and you need to create a custom role that allows security engineers to start and stop Azure virtual machines but not delete them or modify their network interfaces. The role must be scoped to a specific resource group. How should you define this custom role?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a custom role with allowed actions for start and stop, and explicitly deny delete actions using NotActions.. Custom roles in Azure RBAC allow you to define granular permissions using Actions and NotActions. To allow start/stop but prevent delete, you can define a broad action like 'Microsoft.Compute/virtualMachines/*' (which includes start/stop and delete) and then use 'NotActions' to explicitly exclude 'Microsoft.Compute/virtualMachines/delete'. Since network interface modifications fall under the 'Microsoft.Network' resource provider, they are not included in 'Microsoft.Compute/virtualMachines/*' and thus are implicitly denied by this role definition. Scoping the role to a specific resource group ensures the permissions apply only to that resource group, meeting the requirement.

Answer

Assign the built-in Contributor role to the resource group.

Answer

Use Azure Policy to prevent deletion of VMs in that resource group.

Answer

Add the engineers to an Microsoft Entra ID administrative unit and assign permissions for VM operations.

Question 2

You are building an Azure Logic App that must call an external API secured with OAuth 2.0 Client Credentials flow. The external API is registered in a different Microsoft Entra ID tenant. You need to obtain an access token and add it to the request headers. Which action and authentication configuration should you use?

Accepted Answer

Use the HTTP action with Active Directory OAuth authentication, providing the tenant ID, client ID, and client secret.. The HTTP action's Active Directory OAuth authentication type directly supports the OAuth 2.0 Client Credentials flow for cross-tenant scenarios. By providing the tenant ID, client ID, and client secret, the Logic App runtime can obtain an access token from the external tenant's token endpoint and automatically inject it into the Authorization header as a Bearer token. This is the only built-in authentication option in the HTTP action that handles the client credentials grant without custom code.

Answer

Use the HTTP action with Managed Identity authentication.

Answer

Use the HTTP + Swagger connector to import the API definition.

Answer

Use the Azure Key Vault - Get secret action to retrieve a token.

Question 3

You are designing a solution that uses Azure Container Instances (ACI) to run a batch job that processes images. The job is triggered by a message in Azure Queue Storage. Each image takes about 5 minutes to process. You need to ensure that the container runs only when there are messages in the queue and scales automatically. What should you use?

Accepted Answer

Use Azure Logic Apps with a Container Instances connector.. Azure Logic Apps provides a serverless workflow that can be triggered by a queue message (via the Azure Queue Storage connector) and then use the Container Instances connector to start a container group. This ensures the container runs only when messages are present and scales automatically by creating a new container instance per message, matching the requirement for event-driven, on-demand execution without idle costs.

Answer

Use Azure Functions with a custom container and queue trigger.

Answer

Use Azure Batch to process the images in a pool of VMs.

Answer

Deploy the image processing job as a pod in Azure Kubernetes Service.

Question 4

You are building an event-driven application that needs to publish messages to multiple independent subscribers. Each subscriber must be able to filter messages based on custom properties, and each subscriber must receive all messages that match its filter, even if other subscribers have different filters. The solution must guarantee message delivery. Which Azure messaging service should you use?

Accepted Answer

Azure Service Bus Topics and Subscriptions. Azure Service Bus Topics and Subscriptions are designed for publish-subscribe messaging where multiple independent subscribers each receive a copy of every message that matches their filter criteria. The topic allows publishing messages with custom properties, and each subscription can define a SQL-like filter (using the `SqlFilter` class) to select only relevant messages. This ensures that all subscribers receive all messages matching their filter, with guaranteed delivery via the broker's persistent storage and at-least-once delivery semantics.

Answer

Azure Queue Storage

Answer

Azure Service Bus Queues

Answer

Azure Event Hubs

Question 5

Your company is developing a real-time dashboard that displays live metrics from IoT devices. The backend processes device data using Azure Functions with an Event Hubs trigger. The processed data is stored in Azure Cosmos DB. You need to ensure that the system can handle a sudden increase in device data without losing messages or overloading Cosmos DB. The solution must minimize latency and cost. What should you do?

Accepted Answer

Implement a buffer using Azure Blob storage: the Event Hubs triggered function writes raw data to blobs, and a separate timer-triggered function batches and writes to Cosmos DB at a controlled rate.. It decouples the ingestion rate from the write rate to Cosmos DB. By buffering raw data in Azure Blob storage and using a timer-triggered function to batch-write at a controlled rate, the system can absorb sudden spikes in device data without overwhelming Cosmos DB or losing messages. This approach minimizes latency by keeping the Event Hubs trigger processing fast (writing to blob) and reduces cost by avoiding the need to over-provision RU/s on Cosmos DB.

Answer

Configure the Event Hubs trigger to use a checkpointing strategy with a larger batch size to reduce the number of function invocations.

Answer

Use Azure Stream Analytics to process the Event Hubs data and write directly to Cosmos DB.

Answer

Increase the provisioned throughput (RU/s) on the Cosmos DB container to handle peak loads.

Question 6

You are using Application Insights to monitor a web application. You need to create an alert that triggers when the server response time exceeds 5 seconds for more than 10% of requests in a 5-minute window. Which type of Azure Monitor alert should you create?

Accepted Answer

Log alert. A log alert is correct because the condition involves querying Application Insights trace data to calculate the percentage of requests with a server response time exceeding 5 seconds within a 5-minute window. Log alerts run a Kusto query against the `requests` table, allowing aggregation and threshold evaluation (e.g., >10% of requests), which is not possible with simple metric thresholds.

Answer

Metric alert

Answer

Activity log alert

Answer

Application Insights smart detection alert

Question 7

You are designing a solution that uses Azure Container Instances (ACI) to run a batch processing job. The job is expected to run for up to 2 hours. You need to minimize costs. Which ACI configuration should you use?

Accepted Answer

Use a container group with a restart policy of 'OnFailure' or 'Never'.. Setting the restart policy to 'OnFailure' or 'Never' ensures that the container does not restart after the batch job completes, avoiding unnecessary compute charges. ACI bills per second of container runtime, so any idle or restarted container time directly increases cost. For a finite batch job, a restart policy that prevents automatic restarts is the most cost-effective choice.

Answer

Use GPU-enabled containers for faster processing.

Answer

Deploy the container group in a virtual network.

Answer

Use a container group with a restart policy of 'Always'.

Question 8

You develop a C# application that stores sensitive documents in Azure Blob Storage. You need to generate a time-limited shared access signature (SAS) that allows a client to only read and list blobs in a specific container. The SAS must be valid for exactly 1 hour from the current time. Which code snippet correctly creates the SAS? (Assume BlobServiceClient and BlobContainerClient are properly initialized.)

Accepted Answer

var sasBuilder = new BlobSasBuilder { BlobContainerName = containerName, Resource = "c", StartsOn = DateTimeOffset.UtcNow, ExpiresOn = DateTimeOffset.UtcNow.AddHours(1), Permissions = BlobContainerSasPermissions.Read | BlobContainerSasPermissions.List }; Uri sasUri = containerClient.GenerateSasUri(sasBuilder);. It sets the `Resource` property to "c" for container-level SAS, uses `StartsOn` as the current UTC time, `ExpiresOn` exactly 1 hour later, and specifies only `Read` and `List` permissions via the `BlobContainerSasPermissions` enum. This combination generates a time-limited SAS URI that allows a client to read and list blobs within the specified container for exactly one hour.

Answer

var sasBuilder = new BlobSasBuilder { BlobContainerName = containerName, Resource = "b", StartsOn = DateTimeOffset.UtcNow, ExpiresOn = DateTimeOffset.UtcNow.AddHours(1), Permissions = BlobContainerSasPermissions.Read | BlobContainerSasPermissions.List }; Uri sasUri = containerClient.GenerateSasUri(sasBuilder);

Answer

var sasBuilder = new BlobSasBuilder { BlobContainerName = containerName, Resource = "c", StartsOn = DateTimeOffset.UtcNow, ExpiresOn = DateTimeOffset.UtcNow.AddHours(1), Permissions = BlobContainerSasPermissions.All }; Uri sasUri = containerClient.GenerateSasUri(sasBuilder);

Answer

var sasBuilder = new BlobSasBuilder { BlobContainerName = containerName, Resource = "c", StartsOn = DateTimeOffset.UtcNow.AddDays(-1), ExpiresOn = DateTimeOffset.UtcNow.AddHours(1), Permissions = BlobContainerSasPermissions.Read | BlobContainerSasPermissions.List }; Uri sasUri = containerClient.GenerateSasUri(sasBuilder);

Question 9

You are building a mobile app backend using Azure Functions. The function must send push notifications to devices using the Notification Hubs service. You need to authenticate the function to Notification Hubs using the principle of least privilege. What should you use?

Accepted Answer

Use a managed identity assigned to the Function App to access Notification Hubs.. Using a managed identity assigned to the Function App allows it to authenticate to Azure Notification Hubs without storing any credentials in code or configuration. This follows the principle of least privilege by granting only the necessary permissions (e.g., via Azure RBAC role assignments like 'Notification Hubs Data Sender') and eliminates the risk of connection string leakage. Managed identities are the recommended approach for Azure services to securely access other Azure resources.

Answer

Store the Notification Hubs connection string in Application Settings.

Answer

Create a shared access signature (SAS) token for the Notification Hub.

Answer

Use Microsoft Entra ID OAuth 2.0 client credentials flow.

Question 10

You are developing a .NET Core application that stores session state data. The data is infrequently updated but must be read quickly for every user request. You need a serverless, globally distributed storage solution with low latency reads. Which Azure storage solution should you use?

Accepted Answer

Azure Cosmos DB with SQL API. Azure Cosmos DB with SQL API is the correct choice because it provides a globally distributed, serverless database service with single-digit millisecond read latency at any scale, making it ideal for infrequently updated session state that must be read quickly for every user request. Its multi-region replication ensures low-latency reads from any location, and the SQL API offers a familiar query interface for .NET Core applications.

Answer

Azure Table Storage

Answer

Azure Redis Cache

Answer

Azure Blob Storage

Question 11

You are a developer for a fintech company. Your application consists of multiple Azure Functions that process sensitive financial transactions. The functions need to access an Azure SQL Database and an Azure Storage account. Security requirements are: (1) No secrets or connection strings should be stored in application settings or code. (2) Access must be restricted to the specific resources each function needs. (3) All access must be audited. (4) The solution must support local development debugging. You have already enabled system-assigned managed identity for each function app. Which course of action should you take to meet the requirements?

Accepted Answer

Grant each function app's system-assigned managed identity access to Azure SQL Database using Microsoft Entra authentication (create contained user) and to Azure Storage using RBAC (Storage Blob Data Contributor role). Enable auditing on SQL and Storage. For local development, use Azure CLI to sign in with your developer account and assign it the same RBAC roles.. It uses the system-assigned managed identity to directly authenticate to Azure SQL Database via Microsoft Entra authentication (creating a contained database user mapped to the identity) and to Azure Storage via RBAC (assigning the Storage Blob Data Contributor role). This meets the requirement of no secrets or connection strings in code or settings, restricts access to only the needed resources, enables auditing on both SQL and Storage, and supports local development by using Azure CLI to sign in with a developer account assigned the same RBAC roles.

Answer

Assign a user-assigned managed identity to each function app. Grant the identity access to Azure SQL via Microsoft Entra authentication and to Storage via RBAC. Use service principal for local development.

Answer

Use the system-assigned managed identity to access Key Vault, where you store the SQL connection string and storage account key. Use the Key Vault SDK in the function code to retrieve them. Enable Key Vault audit logging.

Answer

Store the SQL connection string and storage account key in Azure Key Vault. Use Key Vault references in function app settings to retrieve them at runtime. Enable Key Vault audit logging.

Question 12

You are monitoring an Azure web application with Application Insights. You notice a sudden increase in the number of failed requests. You want to be notified automatically when such anomalies occur, without manually setting static thresholds. Which Application Insights feature should you use?

Accepted Answer

Enable Smart Detection for failure anomalies.. Smart Detection for failure anomalies in Application Insights uses machine learning to automatically detect unusual patterns in failed request rates without requiring manual threshold configuration. This feature is specifically designed to notify you of anomalies based on historical behavior, making it the correct choice for the scenario described.

Answer

Create a metric alert on the 'failed requests' metric with a static threshold.

Answer

Use Log Analytics to run a query every 5 minutes and trigger an action.

Answer

Create an availability test that periodically pings the application.

Question 13

A company uses Azure Functions to process messages from Azure Service Bus. The function needs to scale out during high load. Which consumption plan should you choose to enable automatic scaling?

Accepted Answer

Consumption plan. The Consumption plan is the correct choice because it automatically scales out based on the number of incoming messages from Azure Service Bus, adding function instances up to a maximum of 200 instances per function app. This plan is event-driven and provides true serverless scaling with no reserved capacity, making it ideal for handling variable workloads like Service Bus message processing.

Answer

Logic Apps plan

Answer

Premium plan

Answer

App Service plan

Question 14

An application stores large media files (up to 5 GB) that are frequently appended to but rarely read sequentially. Which Azure Blob Storage type should be used to optimize writes and cost?

Accepted Answer

Append blob. Append blobs are optimized for append operations, making them ideal for scenarios like logging or storing media files that are frequently appended to. They support high-throughput writes without the overhead of managing block lists, and they are cost-effective for sequential append workloads compared to block blobs, which require explicit block management and are better suited for random read/write patterns.

Answer

Block blob

Answer

Page blob

Answer

Archive blob

Question 15

You have a web application monitored by Application Insights. You want to receive an alert when the average server response time exceeds 2 seconds for a rolling 5-minute period. Which alert rule type should you create?

Accepted Answer

Application Insights metric alert on 'Server response time' with condition 'Greater than 2' and evaluation frequency 5 minutes. A metric alert on 'Server response time' is the correct choice because it continuously evaluates the average server response time over a rolling 5-minute window and triggers when the value exceeds 2 seconds. Metric alerts are designed for near-real-time monitoring of performance counters like response time, with a fixed evaluation frequency that matches the aggregation window, making them ideal for this scenario.

Answer

Log alert based on a Kusto query that measures average response time in 5-minute windows

Answer

Smart Detection alert on response time degradation

Answer

Availability test alert for HTTP response time