AZ-204 Practice Test 2 — 25 Questions

Question 1

You need to store large binary files (up to 2 GB) that are frequently overwritten in place (entire file replaced). You want to minimize storage cost and write latency. Which Azure Blob Storage type should you use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Block Blob. Block blobs are optimized for storing large binary files (up to ~4.75 TB) and support high-throughput uploads via PutBlock and PutBlockList operations. They allow overwriting an entire blob by uploading a new set of blocks, which minimizes write latency compared to page blobs that require sector-aligned writes. Block blobs also offer lower storage cost than page blobs, making them the best choice for frequently overwritten large files.

Answer

Page Blob

Answer

Append Blob

Answer

Archive Blob

Question 2

You develop a serverless application using Azure Functions. The function must process images uploaded to a blob container. You need to ensure the function runs only when a new blob is created, and that it scales out automatically for high upload volumes. Which trigger and hosting plan combination should you use?

Accepted Answer

Blob trigger + Consumption plan. A Blob trigger is designed to run a function when a blob is created or updated in Azure Blob Storage, which directly matches the requirement to process images only when a new blob is uploaded. The Consumption plan provides automatic scaling based on demand, handling high upload volumes by dynamically allocating resources without manual intervention. This combination ensures event-driven execution and cost-effective scaling.

Answer

HTTP trigger + Consumption plan

Answer

Queue trigger + Consumption plan

Answer

Timer trigger + Consumption plan

Question 3

You are developing a .NET Core web application that needs to send an email notification when a user registers. You decide to use Azure Communication Services Email. Which authentication method should you use to securely connect from your application to Azure Communication Services?

Accepted Answer

Use an endpoint and an access key from Azure Communication Services.. Azure Communication Services Email requires authentication via an endpoint URL and an access key, which are provisioned in the ACS resource. This is the primary method for programmatic access, as the access key is used to sign HTTP requests (via HMAC-SHA256) to the ACS Email API. Option B correctly identifies this combination as the secure authentication mechanism.

Answer

Use an Azure AD service principal with client secret.

Answer

Use a connection string from the Azure portal.

Answer

Use a managed identity for Azure resources.

Question 4

You manage a web application hosted on Azure App Service. You need to monitor the application's availability from multiple geographic locations. The test should check that the homepage loads successfully and returns HTTP 200 within 5 seconds. You want to receive an alert if the test fails from any location. Which type of Application Insights test should you create?

Accepted Answer

URL ping test. The URL ping test is the correct choice because it is a simple, single-URL availability test that checks whether a specific endpoint (the homepage) returns HTTP 200 within a specified timeout (5 seconds). It can be configured to run from multiple geographic locations and trigger an alert on failure, meeting all requirements without the complexity of multi-step or custom code.

Answer

Multi-step web test

Answer

Custom availability test using TrackAvailability

Answer

Continuous export test

Question 5

Refer to the exhibit. You have an Azure Policy definition as shown. Your team creates a storage account with network rules set to 'Deny' by default, and then adds an IP rule to allow traffic from a specific IP range. What compliance state will this storage account be reported as?

Accepted Answer

Compliant. The Azure Policy definition in the exhibit uses the 'DenyAction' effect, which only denies or audits specific actions (such as 'Microsoft.Storage/storageAccounts/write'). It does not evaluate the configuration of network rules on the storage account. Therefore, the storage account's network rule settings (defaultAction 'Deny' and IP rule) have no bearing on compliance with this policy. The resource is compliant because the policy's condition does not apply to network rules, and the write action was not blocked since the account was created successfully.

Answer

Error

Answer

Exempt

Answer

Non-compliant

Question 6

You are building an Azure Logic App that must consume messages from an Azure Service Bus queue. The queue messages are JSON payloads containing order information. The Logic App must process each message exactly once and in the order they are received. You need to configure the trigger in the Logic App. Which trigger type and property should you choose?

Accepted Answer

Use a Service Bus trigger with the 'PeekLock' mode and set the 'IsSessionsEnabled' property to true. Service Bus sessions provide first-in-first-out (FIFO) ordering and exactly-once processing. By enabling sessions (IsSessionsEnabled = true) and using PeekLock mode, the Logic App can lock a message while processing, ensuring it is not delivered to other consumers, and sessions guarantee that messages with the same session ID are processed in order. This meets the requirement of processing each message exactly once and in the order received.

Answer

Use a Service Bus trigger with the 'PeekLock' mode and set the 'IsSessionsEnabled' property to false

Answer

Use a Service Bus trigger with the 'ReceiveAndDelete' mode

Answer

Use an Event Grid trigger for Service Bus

Question 7

You are using Azure File Storage to share configuration files across multiple virtual machines running a legacy application. The application requires SMB 3.0 protocol with encryption. You need to ensure the file share is accessible from all VMs without exposing it to the internet. Which configuration should you use?

Accepted Answer

Create a storage account with a private endpoint and mount the file share using the private IP. A private endpoint assigns the storage account a private IP address from your virtual network, allowing VMs to access the file share over SMB 3.0 with encryption without exposing the storage account to the public internet. This meets the requirement for secure, private connectivity while supporting the legacy application's SMB 3.0 protocol needs.

Answer

Create a storage account with a shared access signature (SAS) token and mount using the SAS URL

Answer

Create a storage account with a public endpoint and use a VPN gateway to connect the VMs

Answer

Create a storage account with a public endpoint and configure the firewall to allow only the VNet

Question 8

Refer to the exhibit. You run the Azure CLI command to list blobs in a container that are larger than 1 MB. The command returns no results even though you know there are blobs larger than 1 MB. What is the most likely cause?

Accepted Answer

The storage account has hierarchical namespace enabled (Azure Data Lake Storage Gen2). The Azure CLI command uses the `az storage blob list` command with a JMESPath query to filter blobs larger than 1 MB. However, when a storage account has hierarchical namespace enabled (Azure Data Lake Storage Gen2), the blob listing API returns directory entries and file entries in a flat list, but the `az storage blob list` command does not support the hierarchical namespace by default. The command may return no results because the underlying REST API (Blob Service REST API) does not properly enumerate blobs in a Data Lake Storage Gen2 account without using the `--use-hierarchical-namespace` flag or the `az storage fs file list` command instead. This is a known limitation where the standard blob list operation fails to list files in a hierarchical namespace-enabled account.

Answer

The JMESPath query uses backticks incorrectly

Answer

The --container-name parameter is case-sensitive

Answer

The --account-name parameter is incorrect

Question 9

You are designing an Azure Table Storage table to store temperature readings from IoT devices. Each reading includes a device ID (string), timestamp (datetime), temperature value, and location. You need to optimize the table design for this query: "Retrieve all temperature readings for a specific device ID within a given one-hour time range." The query must be efficient and minimize partition scans. Which PartitionKey and RowKey combination should you use?

Accepted Answer

PartitionKey = device ID, RowKey = timestamp (formatted as inverted ticks). Using device ID as the PartitionKey ensures all readings for a specific device are in the same partition, allowing efficient point queries. Using timestamp formatted as inverted ticks (e.g., DateTime.MaxValue.Ticks - DateTime.UtcNow.Ticks) as the RowKey enables range queries within a one-hour window by leveraging the lexicographic ordering of RowKey values, minimizing partition scans.

Answer

PartitionKey = timestamp (rolled up to day), RowKey = device ID

Answer

PartitionKey = location, RowKey = device ID

Answer

PartitionKey = device ID + timestamp (composite), RowKey = empty

Question 10

You are building an Azure Logic App that must call an external API that uses the OAuth 2.0 authorization code grant. The API requires the user to sign in interactively to grant consent. You want to minimize development effort and securely manage the token lifecycle. Which built-in action and authentication method should you use?

Accepted Answer

Use the 'HTTP' action with 'OAuth 2.0' authentication and configure the authorization endpoint, client ID, and client secret.. The 'HTTP' action with 'OAuth 2.0' authentication type in Azure Logic Apps is specifically designed to handle the authorization code grant flow, including interactive user consent. It manages the token lifecycle (acquisition, refresh, and storage) automatically, minimizing development effort. You only need to configure the authorization endpoint, client ID, and client secret, and the runtime handles the redirect and token exchange.

Answer

Use the 'HTTP + Swagger' action with 'Identity Provider' authentication.

Answer

Use the 'API Connection' action with a custom connector that uses OAuth 2.0.

Answer

Use the 'HTTP' action with 'Managed identity' authentication.

Question 11

You have multiple Azure virtual machines that need to access the same Azure Key Vault to retrieve certificates. You want to minimize administrative overhead while ensuring each VM can authenticate without managing credentials. Which identity type should you use?

Accepted Answer

User-assigned managed identity assigned to each VM. A user-assigned managed identity can be created once and then assigned to multiple Azure VMs, allowing all of them to authenticate to the same Key Vault without storing any credentials. This minimizes administrative overhead compared to managing separate system-assigned identities or service principals, as the identity is independent of any single VM's lifecycle and can be reused across resources.

Answer

System-assigned managed identity on each VM

Answer

Service principal with client secret stored in each VM

Answer

Storage account key

Question 12

A developer exposes several backend APIs through Azure API Management. Clients must be throttled by subscription to protect the backend. What should be configured?

Accepted Answer

API Management rate-limit or quota policy. Azure API Management provides built-in rate-limit and quota policies that allow you to throttle client requests based on subscription keys. These policies enforce limits per subscription scope, protecting backend services from excessive traffic by rejecting requests that exceed the defined rate (e.g., requests per second) or quota (e.g., total calls per month). This directly addresses the requirement to throttle clients by subscription.

Answer

Blob soft delete

Answer

Application Insights sampling

Answer

Private DNS zone only

Question 13

You are monitoring an Azure App Service using Application Insights. You notice that HTTP 500 errors are increasing, but the standard server response time metric remains normal. You suspect that the errors are occurring in an external API call made by the application. How can you identify the dependency that is failing?

Accepted Answer

Configure Application Insights dependency tracking and view the Dependency Metrics blade.. Application Insights dependency tracking automatically monitors HTTP calls, SQL queries, and other external dependencies made by your application. By viewing the Dependency Metrics blade, you can see failure rates, durations, and dependency names, allowing you to identify which external API call is failing without modifying code.

Answer

Enable snapshot debugging for the application.

Answer

Use Application Insights Profiler to capture code-level traces.

Answer

Set up a custom event telemetry for each external call.

Question 14

You are deploying an application to Azure App Service that requires a custom startup script to initialize the environment. Where should you place the startup script in the application code?

Accepted Answer

As a startup command in the App Service configuration. Azure App Service allows you to specify a custom startup command or script in the App Service configuration (under 'General settings' or via the Azure CLI with `--startup-file`). This startup command runs before the application starts, enabling you to initialize the environment, run pre-deployment tasks, or set up dependencies. Placing the startup script in the configuration ensures it is executed by the App Service platform, which handles the runtime environment (Windows or Linux) and integrates with the application lifecycle.

Answer

In the 'web.config' file

Answer

In a 'docker-compose.yml' file

Answer

In the root of the application code as 'startup.sh'

Question 15

A company uses Azure App Service to host a web application. They need to ensure that only authenticated users from their Microsoft Entra ID tenant can access the app. They also want to prevent unauthenticated requests from reaching the app code. Which configuration should they implement?

Accepted Answer

Enable App Service Authentication with Microsoft Entra ID as the identity provider and set 'Action to take when request is not authenticated' to 'Log in with Microsoft Entra ID'.. Enabling App Service Authentication (EasyAuth) with Microsoft Entra ID as the identity provider and setting 'Action to take when request is not authenticated' to 'Log in with Microsoft Entra ID' ensures that all unauthenticated requests are redirected to Microsoft Entra ID for authentication before they reach the application code. This configuration blocks unauthenticated requests at the platform layer, preventing any unauthenticated traffic from hitting the app's runtime, which meets the requirement of keeping unauthenticated requests away from the app code.

Answer

Configure IP restrictions in the web.config to allow only the company's office IP range.

Answer

Implement a custom middleware in the app to validate tokens from Microsoft Entra ID.

Answer

Assign users to Microsoft Entra ID App Roles and check roles in the app.

Question 16

You are monitoring an Azure web application with Application Insights. You want to create a custom dashboard that shows the number of requests over time and the average server response time. Which Application Insights feature should you use to create this dashboard?

Accepted Answer

Metrics Explorer. Metrics Explorer in Application Insights is designed for visualizing pre-aggregated metrics like request count and server response time over time. It allows you to create custom charts and pin them to an Azure dashboard, making it the correct choice for this monitoring requirement.

Answer

Log Analytics

Answer

Application Map

Answer

Smart Detection

Question 17

You are deploying a containerized application on Azure Container Instances (ACI) that needs to run as a background job every hour. The job processes data from an Azure SQL Database and sends a report via email. You need to minimize costs while ensuring the job runs reliably on schedule. The job takes about 10 minutes to complete. What should you do?

Accepted Answer

Create an Azure Logic App with a recurrence trigger that starts the container group using the 'Start Container Group' action, and stop it after completion.. It uses Azure Logic Apps with a recurrence trigger to start the container group only when needed, and stops it after the job completes. This minimizes costs by avoiding continuous running charges for the container, while the Logic App itself incurs minimal execution cost. The job's 10-minute duration fits well within the 1-hour recurrence window, ensuring reliable scheduling without idle compute time.

Answer

Use Azure Batch with a job schedule to run the container as a task.

Answer

Deploy the container on a single Azure virtual machine and schedule it using Windows Task Scheduler.

Answer

Use an Azure Function with a timer trigger that uses the Azure Container Instances SDK to start the container group.

Question 18

An e-commerce application emits a high volume of telemetry data to Azure Application Insights. You need to reduce the cost of data ingestion while preserving statistical accuracy for performance metrics. Which sampling technique should you use?

Accepted Answer

Adaptive sampling. Adaptive sampling is the correct choice because it automatically adjusts the sampling rate based on the volume of telemetry data, ensuring that during low-traffic periods all data is retained for statistical accuracy, while during high-traffic periods it reduces the rate to control costs. This technique is specifically designed for high-volume scenarios like e-commerce telemetry, where preserving statistical accuracy for performance metrics (e.g., request durations, failure rates) is critical, and it avoids the manual tuning required by fixed-rate sampling.

Answer

Fixed-rate sampling with a 1% rate

Answer

Ingestion sampling

Answer

Head-based sampling

Question 19

Your company has an on-premises Windows service that exposes a custom TCP endpoint. You are building an Azure Logic App that needs to send data to this endpoint. Due to network security policies, you cannot open inbound ports in the firewall. You need to establish a secure bidirectional connection without configuring a VPN. Which Azure service should you use?

Accepted Answer

Azure Relay Hybrid Connections. Azure Relay Hybrid Connections enable secure bidirectional communication between on-premises services and cloud applications without opening inbound firewall ports. The on-premises service initiates an outbound connection to the Azure Relay over port 443 (HTTPS), and the Logic App sends data through the relay, which forwards it over the already-established outbound tunnel. This satisfies the requirement for a secure, bidirectional connection without VPN or inbound port exposure.

Answer

Azure API Management with on-premises gateway

Answer

Azure Application Gateway with private link

Answer

Azure ExpressRoute

Question 20

You are designing a solution to send email notifications from an Azure App Service web app. The app must use a third-party email service that requires an API key. You need to minimize management overhead and ensure the key is rotated automatically. What should you do?

Accepted Answer

Store the API key in Azure Key Vault and use a managed identity to retrieve it. It uses Azure Key Vault to securely store the third-party API key, and a system-assigned managed identity to authenticate the App Service to Key Vault without managing credentials. This minimizes management overhead by eliminating manual key rotation (Key Vault can rotate secrets automatically) and removes the need to store secrets in code or configuration.

Answer

Use a system-assigned managed identity to authenticate to the email service

Answer

Store the API key in the App Service application settings

Answer

Create an Azure Logic App to send emails and call it from the web app