AZ-204 Practice Test 4 — 25 Questions

Question 1

Your company uses Microsoft Sentinel for security information and event management (SIEM). You need to detect and automatically respond to a potential credential theft attack where an anomalous number of failed logins are followed by a successful login from a different geographic location. Which Microsoft Sentinel feature should you use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

An analytics rule with an automated response. An analytics rule in Microsoft Sentinel can be configured to detect patterns like anomalous failed logins followed by a successful login from a different geography. The rule can then trigger an automated response, such as running a playbook or creating an incident, to remediate the threat in near real-time. This combines detection and automated action within a single rule, making it the correct choice for this scenario.

Answer

Microsoft Sentinel Data Connectors

Answer

Microsoft Defender for Identity

Answer

Microsoft Sentinel playbooks

Question 2

You are developing a web application that runs on Azure App Service. The application needs to store session state. Which Azure service provides the best performance and reliability for session state storage?

Accepted Answer

Azure Cache for Redis. Azure Cache for Redis provides the best performance and reliability for session state storage because it is an in-memory data store with sub-millisecond latency, designed for high-throughput, low-latency scenarios like session caching. It supports session state providers natively in ASP.NET and ASP.NET Core, ensuring fast reads and writes for each user request without the overhead of disk I/O or network latency associated with other storage options.

Answer

Azure Table Storage

Answer

Azure Blob Storage

Answer

Azure SQL Database

Question 3

You run the command above to create an Azure Container Instance. The container exits with a non-zero exit code. You need to check the logs to debug the issue. Which command should you use next?

Accepted Answer

az container logs --resource-group myRG --name mycontainer. The correct command is `az container logs` because it retrieves the stdout and stderr logs from a container that has exited, which is essential for debugging exit code failures. Since the container has already exited with a non-zero exit code, you need to inspect its logged output to understand the cause of the failure, and this command directly fetches those logs without requiring an active container.

Answer

az container attach --resource-group myRG --name mycontainer

Answer

az container exec --resource-group myRG --name mycontainer --exec-command /bin/sh

Answer

az container show --resource-group myRG --name mycontainer --query containers[0].instanceView.currentState.exitCode

Question 4

A developer accidentally deleted a secret from Azure Key Vault. Soft-delete is enabled with a retention period of 90 days. After 60 days, you attempt to recover the secret. What should you do?

Accepted Answer

Run the Azure CLI command: az keyvault secret recover. When soft-delete is enabled on Azure Key Vault, deleted secrets are retained for the specified retention period (90 days in this case). Since only 60 days have passed, the secret is still in a soft-deleted state and can be recovered using the `az keyvault secret recover` command, which restores the secret to an active state.

Answer

Enable purge protection on the Key Vault first, then recover the secret.

Answer

Recover is not possible because the retention period of 90 days has not elapsed.

Answer

Run the Azure CLI command: az keyvault secret undelete

Question 5

You are developing an Azure Functions app that processes orders. Each order triggers a function that writes to Azure Cosmos DB. You notice occasional throttling (429 errors) from Cosmos DB during peak hours. The function app uses the Consumption plan. What is the most cost-effective way to reduce throttling?

Accepted Answer

Implement retry logic with exponential backoff in the function code.. Implementing retry logic with exponential backoff is the most cost-effective way to handle transient 429 errors from Cosmos DB. The Azure Cosmos DB SDK already includes built-in retry policies, but custom retry logic in the function code can be tuned to match the workload, allowing the function to wait and retry during peak throttling without incurring additional costs from scaling or increasing throughput.

Answer

Increase the provisioned throughput (RU/s) of the Cosmos DB container.

Answer

Upgrade the function app to the Premium plan for dedicated instances.

Answer

Increase the function app's instance count by scaling out.

Question 6

A single-page app signs in users with Microsoft Entra ID and calls a protected API. The app cannot safely keep a client secret. Which OAuth flow should be used? The design must avoid adding custom operational scripts.

Accepted Answer

Authorization code flow with PKCE. The authorization code flow with PKCE (Proof Key for Code Exchange) is the recommended OAuth 2.0 flow for single-page applications (SPAs) that cannot securely store a client secret. PKCE uses a dynamically generated cryptographic code verifier and challenge, ensuring that even if the authorization code is intercepted, it cannot be exchanged for tokens without the original verifier. This flow is designed for public clients (like SPAs) and avoids the need for custom operational scripts.

Answer

Implicit flow

Answer

Client credentials flow

Answer

Resource owner password credentials flow

Question 7

Your company runs a critical web application on Azure App Service (Windows) that experiences intermittent high CPU usage. The application uses the Standard tier with auto-scaling based on CPU percentage. During auto-scale events, there is a delay of several minutes before new instances become available, causing temporary performance degradation. You need to reduce the latency of scaling out. What should you do?

Accepted Answer

Enable the 'Always On' setting in the App Service application settings.. The 'Always On' setting prevents the App Service from being unloaded after periods of inactivity, which reduces the cold-start latency when new instances are added during auto-scale events. Without 'Always On', idle instances may be recycled, causing delays of several minutes as the application re-initializes on new VMs.

Answer

Configure auto-scaling to use HTTP queue length as the metric.

Answer

Upgrade the App Service plan to the Premium tier.

Answer

Change the auto-scale metric to memory percentage instead of CPU.

Question 8

You need to process large volumes of streaming data from IoT devices in near real-time. The processed data must be stored in Azure Cosmos DB for further analysis. Which Azure service should you use for stream processing?

Accepted Answer

Azure Stream Analytics. Azure Stream Analytics is purpose-built for real-time stream processing, capable of ingesting large volumes of data from sources like Azure Event Hubs or IoT Hub, applying SQL-based queries, and outputting results directly to Azure Cosmos DB. This aligns perfectly with the requirement for near real-time processing and storage in Cosmos DB.

Answer

Azure Batch

Answer

Azure Databricks

Answer

Azure Data Lake Storage

Question 9

Refer to the exhibit. You deploy the ARM template to create an Azure Key Vault. After deployment, you attempt to add an access policy to grant a user 'Get' secret permissions using the Azure portal, but the option is grayed out. What is the most likely reason?

Accepted Answer

RBAC authorization is enabled, so access policies are not used. When Azure Key Vault is configured to use Azure RBAC (Role-Based Access Control) for authorization, the traditional access policy UI is disabled. The ARM template in the exhibit sets 'enableRbacAuthorization' to true, which switches the vault's authorization model from vault-level access policies to Azure RBAC roles. In this mode, you must assign roles (e.g., Key Vault Secrets User) via Azure RBAC instead of adding access policies.

Answer

The vault is disabled due to 'enableSoftDelete'

Answer

The property 'enabledForDeployment' is set to false

Answer

Soft delete is enabled, which prevents access policy changes

Question 10

You are building a solution that needs to process large CSV files uploaded to Azure Blob Storage. Each file can be up to 1 GB. You want to minimize processing time and cost. Which approach should you recommend?

Accepted Answer

Use Azure Data Factory to copy the data from Blob Storage to Azure SQL Database and perform transformations.. Azure Data Factory (ADF) is the correct choice because it is a fully managed, serverless data integration service designed for high-scale data movement and transformation. ADF can directly read large CSV files from Blob Storage using Copy Activity with built-in parallelization and chunking, then transform the data using Mapping Data Flows or stored procedures in Azure SQL Database, all without provisioning VMs or managing infrastructure. This minimizes both processing time (via scale-out) and cost (pay-per-use, no idle compute).

Answer

Use Azure Logic Apps to trigger a function that parses the CSV and inserts into Cosmos DB.

Answer

Download the file to an Azure VM and use a custom script to parse and insert into a database.

Answer

Use Azure Stream Analytics to read the CSV from Blob Storage and output to a data warehouse.

Question 11

A company uses Azure SQL Database and needs to encrypt sensitive columns (e.g., credit card numbers) at rest and in transit, with the ability to allow specific applications to decrypt. They want to manage encryption keys centrally in Azure Key Vault and avoid managing certificates. Which technology should they use?

Accepted Answer

Always Encrypted with column master key in Azure Key Vault.. Always Encrypted with a column master key stored in Azure Key Vault is the correct choice because it encrypts sensitive columns (like credit card numbers) at rest and in transit, ensuring data remains encrypted throughout the entire pipeline, including during query processing. The column master key in Azure Key Vault allows centralized key management without handling certificates, and only applications with access to the corresponding column encryption key can decrypt the data, meeting the requirement for application-specific decryption.

Answer

Transparent Data Encryption (TDE) with Azure Key Vault.

Answer

Dynamic Data Masking (DDM) with Azure Key Vault.

Answer

Row-Level Security (RLS) with Azure Key Vault.

Question 12

You are reviewing an Azure Policy definition that applies to storage accounts. The policy has an effect of 'deny' and specifies network ACLs. What is the intended behavior of this policy?

Accepted Answer

Deny creation of storage accounts that do not have a virtual network rule allowing vnet1 and default action set to Deny. The Azure Policy definition with effect 'deny' and network ACL conditions will block the creation of any storage account that does not include a virtual network rule allowing 'vnet1' and does not have the default action set to 'Deny'. This ensures that only storage accounts with the specified network restrictions are permitted, enforcing a security baseline that denies all traffic except from the allowed virtual network.

Answer

Allow all storage accounts to be created regardless of network rules

Answer

Deny all traffic to storage accounts

Answer

Allow only traffic from the specified virtual network

Question 13

A Blob Storage workflow for product images must prevent accidental overwrite and support recovery of prior versions. Which two features should be enabled?

Accepted Answer

Blob soft delete. Blob soft delete (B) protects against accidental deletion or overwrite by retaining deleted blobs for a configurable retention period, allowing recovery. Blob versioning (D) automatically maintains prior versions of a blob, enabling restoration of any previous state. Together, they provide comprehensive protection against overwrites and support version recovery.

Answer

SFTP support

Answer

Static website hosting

Question 14

A company is building a microservices application on Azure Container Instances. Each microservice needs to authenticate to Azure Key Vault to retrieve secrets. They want to avoid storing any credentials in the container images or environment variables. What should they do?

Accepted Answer

Enable managed identity for the container group and grant it access to Key Vault.. Azure Container Instances supports managed identities, allowing the container group to authenticate to Azure Key Vault without any credentials stored in the image or environment variables. By enabling a system-assigned or user-assigned managed identity on the container group and granting that identity the appropriate Key Vault access policy (e.g., 'Get' secret permission), the application can acquire an Azure AD token from the Instance Metadata Service (IMDS) endpoint and use it to retrieve secrets securely.

Answer

Use Docker secrets mounted as volumes.

Answer

Use a shared access signature (SAS) token to access Key Vault.

Answer

Store the Key Vault URI and a client secret in environment variables.

Question 15

Your company runs a web application on Azure App Service that uses a custom domain. The application must be accessible only via HTTPS. You have already uploaded an SSL certificate for the custom domain. However, users can still access the site via HTTP. You need to enforce HTTPS redirection. What should you do?

Accepted Answer

Enable the 'HTTPS Only' setting in the App Service's TLS/SSL settings blade.. The 'HTTPS Only' setting in the App Service's TLS/SSL settings blade enforces that all incoming requests are redirected from HTTP to HTTPS at the platform level, before any application code runs. Since you have already uploaded an SSL certificate, enabling this setting ensures that users cannot access the site via HTTP, meeting the requirement without modifying application code.

Answer

Set the 'Minimum TLS Version' to 1.2.

Answer

Add a rewrite rule in the web.config file to redirect HTTP to HTTPS.

Answer

Configure the App Service to require client certificates.

Question 16

You host a web application on Azure App Service using multiple deployment slots (production and staging). After swapping staging into production, users report errors. You need to ensure that the staging slot is warmed up before swapping and that any errors during swap cause an automatic rollback. What should you configure?

Accepted Answer

Enable auto swap and configure a custom warm-up path.. Enabling auto swap with a custom warm-up path ensures the staging slot is fully warmed up before the swap occurs, and if the warm-up fails or the application returns errors during the swap, Azure App Service automatically rolls back to the previous slot. This directly addresses the requirement for both pre-swap warm-up and automatic rollback on errors.

Answer

Configure deployment slot settings to be sticky.

Answer

Use swap with preview and complete the swap after verification.

Answer

Configure manual swap and run a warm-up script before swapping.

Question 17

Refer to the exhibit. A developer is creating an Azure Data Factory pipeline to copy data from Azure Blob Storage to Azure SQL Database. The pipeline fails with a timeout error when copying large files. Which action should the developer take to resolve the issue?

Accepted Answer

Increase the timeout value in the copy activity settings. The copy activity in Azure Data Factory has a default timeout of 7 days, but when copying large files, the activity may fail due to the default timeout for the underlying HTTP request to Blob Storage (which is 7 minutes for a single block). Increasing the timeout value in the copy activity settings allows more time for the entire file transfer to complete, especially for large files that require multiple retries or slower network conditions.

Answer

Change the source type to DelimitedTextSource

Answer

Enable Data Integration Units (DIU) to increase throughput

Answer

Use a staging copy with Azure Data Lake Storage Gen2

Question 18

Your application stores user-generated content in Azure Blob Storage. You need to implement a shared access signature (SAS) that allows users to upload files to a specific container but not read or delete. The SAS must be valid for one hour. Which type of SAS should you use?

Accepted Answer

Service SAS. A Service SAS is the correct choice because it allows you to delegate access to a specific Azure Blob Storage resource (in this case, a container) with granular permissions. You can generate a Service SAS scoped to the container with only the 'Create' and 'Write' permissions (no 'Read' or 'Delete'), and set its expiry to one hour. This meets the requirement of allowing uploads while preventing reads or deletes.

Answer

Account SAS

Answer

Stored access policy

Answer

User delegation SAS

Question 19

Which THREE components are required to implement Azure AD B2C custom policies for sign-up and sign-in? (Choose three.)

Accepted Answer

A user journey definition. A user journey definition is a core component of an Azure AD B2C custom policy. It orchestrates the sequence of technical profiles and orchestration steps that define the sign-up and sign-in experience, including self-asserted pages, multifactor authentication, and validation. Without a user journey, the policy cannot specify the flow of claims exchanges and user interactions.

Answer

An Azure AD (Microsoft Entra ID) tenant for employee identities

Answer

An Azure subscription

Question 20

A developer is building a microservices application on Azure Kubernetes Service (AKS). One service needs to consume messages from an Azure Service Bus queue. The solution must minimize cost and automatically scale based on the number of messages. Which approach should the developer choose?

Accepted Answer

Use KEDA to scale the pods based on the Service Bus queue length. KEDA (Kubernetes Event-Driven Autoscaling) is the correct choice because it natively integrates with Azure Service Bus to monitor queue length and automatically scale the number of pods in AKS based on that metric. This minimizes cost by scaling to zero when there are no messages and scaling up only as needed, without requiring manual intervention or additional infrastructure.

Answer

Use Azure Event Grid to route messages to the microservice

Answer

Use Azure Functions with a Service Bus trigger on a dedicated App Service plan

Answer

Use the Azure Service Bus SDK in the pod code and manually scale pods