AZ-204 Practice Test 25 — 15 Questions

Question 1

You are deploying a containerized application to Azure Kubernetes Service (AKS). The application needs to access Azure SQL Database securely. Which approach should you use to avoid storing credentials in the container image?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use Azure AD Pod Identity (Workload Identity) to assign a managed identity to the pod and authenticate to SQL. Azure AD Pod Identity (now evolved into Workload Identity) allows you to assign a managed identity to a pod, which can then authenticate to Azure SQL Database without any credentials stored in the image or environment variables. This approach uses Azure AD tokens obtained via the pod's identity, eliminating the need for connection strings or secrets in the container.

Answer

Store the connection string in a Kubernetes Secret and mount it as an environment variable

Answer

Use a service principal and store its credentials in Azure Key Vault, then use the Key Vault Secrets Store CSI driver

Answer

Hardcode the credentials in the Dockerfile

Question 2

You need to monitor the performance of an Azure web app. You want to track the average response time and the number of failed requests over the last hour. Which Azure service should you use?

Accepted Answer

Application Insights. Application Insights is the correct choice because it is an extensible Application Performance Management (APM) service designed specifically for monitoring live web applications. It can track metrics like average response time and failed request counts out of the box, and it integrates directly with Azure Web Apps via the Application Insights SDK or auto-instrumentation, providing real-time telemetry without requiring custom logging code.

Answer

Azure Monitor

Answer

Log Analytics

Answer

Azure Advisor

Question 3

You are developing a web app that authenticates users via Microsoft Entra ID. The app needs to read the user's profile and send emails on their behalf. You want to minimize user consent prompts. Which OAuth 2.0 grant type should you use?

Accepted Answer

Authorization code flow with PKCE. The authorization code flow with PKCE (Proof Key for Code Exchange) is the recommended OAuth 2.0 grant type for public clients (like a web app) that need delegated user authentication and consent. It allows the app to obtain an access token to read the user's profile and a refresh token to send emails on their behalf, while minimizing consent prompts by using a single consent request for both permissions. PKCE adds a cryptographic challenge to prevent authorization code interception attacks, making it secure for web apps without a client secret.

Answer

Client credentials flow

Answer

Resource owner password credentials

Answer

Implicit flow

Question 4

You deploy a containerized application to Azure Container Instances (ACI). The application writes logs that must persist across container restarts and be accessible from a file system. The solution must minimize cost and complexity. Which configuration should you use?

Accepted Answer

Mount an Azure Files share as a volume. Mounting an Azure Files share as a volume in Azure Container Instances provides persistent, shared file storage that survives container restarts and is accessible via the container's file system. This approach minimizes cost by using standard Azure Files storage (pay only for consumed capacity) and complexity by leveraging ACI's native volume mount support without requiring additional orchestration or stateful infrastructure.

Answer

Store logs in Azure Container Registry

Answer

Use a Docker volume in the container

Answer

Pass log path via an environment variable

Question 5

A company uses Azure Service Bus to decouple microservices. They need to ensure that messages are processed in the order they are received, and that each message is handled by exactly one consumer instance even when the system scales out. Which feature should they enable?

Accepted Answer

Sessions. Sessions in Azure Service Bus enforce first-in-first-out (FIFO) ordering and guarantee that all messages with the same session ID are processed by a single consumer instance. This ensures strict message ordering and exactly-once processing per session, even when multiple consumers are scaled out. Without sessions, competing consumers would break ordering because messages could be processed by different instances concurrently.

Answer

Topics

Answer

Dead-letter queue

Answer

Duplicate detection

Question 6

You store application logs in Azure Blob Storage. The logs are accessed frequently for the first 7 days, then rarely. After 30 days, they must be deleted to minimize cost. Which approach should you use?

Accepted Answer

Configure a lifecycle management policy to tier to cool after 7 days and delete after 30 days. Azure Blob Storage lifecycle management policies allow you to automatically transition blobs to a cooler tier (cool) after a specified number of days and then delete them after another period, all without manual intervention or additional services. This directly meets the requirement of frequent access for 7 days, rare access afterward, and deletion at 30 days, minimizing cost by leveraging tiered storage and automated rules.

Answer

Manually move blobs to cool tier after 7 days and delete after 30 days using a script

Answer

Use blob snapshots and delete snapshots after 30 days

Answer

Use Azure Data Factory to copy old logs to archive storage and delete original

Question 7

You need to store millions of small JSON documents (each ~1 KB) that are frequently updated by multiple concurrent users. You require low-latency access to individual documents. Which Azure Storage solution should you use?

Accepted Answer

Azure Table Storage. Azure Table Storage is a NoSQL key-value store optimized for storing large volumes of structured, non-relational data with low-latency access by partition key and row key. It supports millions of small JSON documents (~1 KB) and handles frequent concurrent updates via optimistic concurrency control using ETags, making it ideal for this scenario.

Answer

Azure Blob Storage with Block blobs

Answer

Azure Files with SMB protocol

Answer

Azure Cosmos DB for NoSQL

Question 8

You are developing a .NET application that needs to store and retrieve large binary objects (up to 4.7 TB) in Azure Blob Storage. The application requires the lowest possible latency for reads and must support object-level tiering. Which blob type should you use?

Accepted Answer

Block blob. Block blobs are designed for storing large binary objects up to approximately 4.74 TB and support object-level tiering (Hot, Cool, Cold, Archive). They offer the lowest read latency among Azure blob types because they can be accessed directly via HTTP/HTTPS and are optimized for streaming and random read access. Object-level tiering allows you to change the access tier of individual blobs without moving the storage account, which meets the requirement for granular cost optimization.

Answer

Archive storage account

Answer

Page blob

Answer

Append blob

Question 9

You need to store temperature readings from IoT devices in Azure Table Storage. Each reading includes a device ID (string), timestamp (datetime), temperature value, and location. You must optimize for the query: "Retrieve all temperature readings for a specific device ID within a given one-hour time range." Which PartitionKey and RowKey combination should you use?

Accepted Answer

PartitionKey = DeviceId, RowKey = Timestamp. Azure Table Storage queries are most efficient when the PartitionKey and RowKey are chosen to match the query pattern. By using DeviceId as the PartitionKey, all readings for a specific device are stored in the same partition, enabling fast partition-level scans. Using Timestamp as the RowKey allows efficient range queries within a one-hour window using RowKey comparisons, which is the optimal design for time-range queries on a single device.

Answer

PartitionKey = Location, RowKey = DeviceId

Answer

PartitionKey = Temperature, RowKey = Timestamp

Answer

PartitionKey = DeviceId + Timestamp, RowKey = empty

Question 10

A Durable Functions workflow for a booking backend must call five independent activity functions and continue only after all results are available. Which pattern is appropriate?

Accepted Answer

Fan-out/fan-in. The fan-out/fan-in pattern is designed for scenarios where multiple independent tasks must execute in parallel, and the workflow must wait for all results before proceeding. In Durable Functions, this is implemented using `Task.WhenAll()` to fan out activity function calls and then aggregate their results, which matches the requirement of calling five independent activities and continuing only after all results are available.

Answer

Monitor pattern

Answer

Human interaction

Answer

Function chaining

Question 11

You are designing a solution to store user-uploaded images. The images are accessed infrequently (a few times per month) and must be available for download within seconds when requested. You need to minimize storage costs while meeting the access requirements. Which Azure Blob Storage access tier should you choose for the container?

Accepted Answer

Cool tier. The Cool tier is optimal because the images are accessed infrequently (a few times per month) but require immediate download within seconds. Cool tier offers lower storage costs than Hot tier while maintaining low-latency access (milliseconds), meeting the access requirement without incurring the higher storage cost of Hot tier.

Answer

Hot tier

Answer

Cold tier

Answer

Archive tier

Question 12

You are monitoring an Azure web app using Application Insights. You need to create a query that returns the average duration of requests for each HTTP method (GET, POST, etc.) over the last hour, sorted by duration. Which Kusto query should you use?

Accepted Answer

requests | where timestamp > ago(1h) | summarize avg(duration) by method | order by avg_duration desc. It first filters requests to only those from the last hour using `where timestamp > ago(1h)`, then calculates the average duration grouped by HTTP method with `summarize avg(duration) by method`, and finally orders the results by the computed average duration in descending order using `order by avg_duration desc`. This matches the requirement exactly: last hour, average duration per method, sorted by duration.

Answer

requests | summarize avg(duration) by method | order by avg_duration desc

Answer

requests | summarize avg(duration) by method | sort by method asc

Answer

requests | where timestamp > ago(1h) | summarize avg(duration) by method | sort by method

Question 13

You are building a serverless workflow using Azure Logic Apps. The workflow must start when a new blob is uploaded to a specific container in Azure Blob Storage. Which trigger should you configure?

Accepted Answer

When a blob is created or modified (blob trigger). The 'When a blob is created or modified (blob trigger)' is the native Azure Logic Apps trigger designed to start a workflow automatically when a new blob is uploaded or an existing blob is modified in a specified Azure Blob Storage container. This trigger uses the Azure Blob Storage event subscription to detect changes and is the appropriate choice for event-driven serverless workflows that respond to blob storage events.

Answer

HTTP request trigger

Answer

Recurrence trigger

Answer

Service Bus trigger

Question 14

You need to store millions of small log entries (each <1 KB) per day from an IoT device. The logs are rarely read. Which storage solution is most cost-effective?

Accepted Answer

Azure Blob Storage Block Blob. Azure Blob Storage Block Blob is the most cost-effective solution for storing millions of small log entries (<1 KB) that are rarely read because it offers extremely low storage costs per GB, supports high-throughput ingestion, and is optimized for large-scale, append-oriented workloads. Block blobs can be stored in the 'Cool' or 'Archive' access tier to further reduce costs, and they can be efficiently batched into larger blocks (up to 100 MB per block) to minimize transaction costs.

Answer

Azure SQL Database

Answer

Azure Table Storage

Answer

Azure Files

Question 15

You are building an Azure Logic App that must call a third-party REST API. The API requires an API key passed as a query parameter. You need to store the API key securely and automatically add it to each request. Which approach should you use?

Accepted Answer

Use Azure Key Vault and the Key Vault connector to retrieve the secret dynamically.. Azure Key Vault provides a secure, centralized service for storing secrets like API keys, and the Key Vault connector in Logic Apps allows you to dynamically retrieve the secret at runtime without exposing it in the workflow definition. This approach ensures the API key is never hardcoded or stored in plaintext, meeting security best practices for accessing third-party APIs.

Answer

Hardcode the API key in the Logic App definition.

Answer

Store the API key in an Azure Storage Table and reference it from the Logic App.

Answer

Use an environment variable in the Logic App.