AZ-204 Practice Test 5 — 25 Questions

Question 1

You are deploying an Azure App Service using an ARM template. After deployment, you find that the application settings are not applied. What is the most likely issue?

Accepted Answer

The resource is missing a dependsOn property for the parent site. When deploying application settings via an ARM template, the 'Microsoft.Web/sites/config' resource (which contains the appsettings) must have a 'dependsOn' property referencing the parent 'Microsoft.Web/sites' resource. Without this dependency, Azure Resource Manager may attempt to apply the settings before the site exists, causing the settings to be silently ignored or not applied. This is a common deployment ordering issue.

Answer

The resource type should be 'Microsoft.Web/sites/appsettings'

Answer

The apiVersion is outdated, use '2021-02-01'

Answer

The property 'MyApp:Setting1' uses a colon, which is not allowed

Question 2

You are developing a solution that processes large files uploaded by users to Azure Blob Storage. Each file must be validated for malware using Microsoft Defender for Cloud Apps before being moved to a different container for further processing. The validation can take several minutes. What is the most cost-effective and scalable approach?

Accepted Answer

Use Azure Event Grid to trigger an Azure Function on blob creation, which validates the file and moves it after scan.. Azure Event Grid provides a serverless, event-driven architecture that triggers an Azure Function immediately when a blob is created. This eliminates the need for polling or idle compute resources, making it the most cost-effective and scalable approach for processing large files that require time-consuming malware validation.

Answer

Use the Azure SDK to poll for new blobs from within a continuously running background service.

Answer

Use an Azure VM running a scheduled task to poll for new blobs and perform validation.

Answer

Use Azure Logic Apps with a recurrence trigger to check for new blobs and call the Microsoft Defender API.

Question 3

You are developing a web app that uses Azure AD B2C for customer identity. The app must allow users to sign in with their social media accounts like Facebook and Google. Which Azure AD B2C policy type should you configure?

Accepted Answer

Sign-up and sign-in policy. The sign-up and sign-in policy (now called a user flow in the Azure portal) is the correct choice because it is the Azure AD B2C policy type specifically designed to handle both user registration and authentication in a single flow. This policy can be configured to include social identity providers like Facebook and Google, allowing users to sign in using those accounts. It orchestrates the OAuth 2.0 and OpenID Connect protocols to redirect users to the social provider's authorization endpoint and then process the returned tokens.

Answer

Profile editing policy

Answer

Password reset policy

Answer

Conditional access policy

Question 4

You are developing a microservice that needs to publish events to multiple subscribers. Each subscriber should receive the event independently and at its own pace. The event must be retained for up to 7 days. Which Azure messaging service should you use?

Accepted Answer

Azure Service Bus topic. Azure Service Bus Topic is the correct choice. It provides a publish-subscribe model where each subscriber receives events independently through its own durable subscription. Messages are retained within each subscription until they are processed or their time-to-live expires (up to 14 days by default), which perfectly meets the requirement for events to be retained for up to 7 days for subscribers to consume at their own pace. Event Grid is designed for near real-time event delivery and does not offer durable message retention for subscribers over several days; its retry policy is limited to a maximum of 24 hours.

Answer

Azure Service Bus queue

Answer

Azure Event Grid

Answer

Azure Event Hubs

Question 5

You are developing a serverless API using Azure Functions. The API should only be accessible from a specific virtual network. You need to configure network security. What should you do?

Accepted Answer

Configure a private endpoint for the Function App and disable public access.. To ensure the Azure Function API is *only* accessible from a specific virtual network, the most secure and direct approach is to configure a private endpoint for the Function App within that VNet. A private endpoint assigns a private IP address from your VNet to the Function App, making it accessible privately within the VNet. Crucially, you must then disable public access to the Function App. This combination ensures that all traffic must flow through the private endpoint from within the VNet, thereby meeting the requirement for network-level isolation and restricting access exclusively to the specified VNet. Option C's explanation is misleading as VNet integration primarily enables outbound connectivity, and an NSG on the VNet-integrated subnet does not directly block public internet access to the Function App's public endpoint.

Answer

Place the Functions in Azure API Management and configure IP restrictions.

Answer

Configure IP address restrictions on the Function App to allow only the VNet's public IP range.

Answer

Deploy the Function App in a Premium plan and configure VNet integration, then use a Network Security Group to restrict traffic.

Question 6

You deploy a containerized application to Azure Container Instances (ACI). The application needs to store configuration settings that might change at runtime. You need to update the configuration without redeploying the container. What should you do?

Accepted Answer

Mount an Azure Files share and update the configuration file. To update configuration settings at runtime without redeploying the container in Azure Container Instances (ACI), you should mount an Azure Files share. The application can read its configuration from a file stored on this share. When configuration changes are needed, you can update the file directly on the Azure Files share. The container itself does not need to be redeployed or restarted, provided the application is designed to periodically re-read the configuration file or react to file changes. This approach allows for dynamic configuration updates independent of the container lifecycle.

Answer

Use environment variables in the container group

Answer

Use Application Settings in the container

Answer

Modify the container image to include new configuration

Question 7

You are building a serverless application using Azure Functions. The function processes large CSV files uploaded to Azure Blob Storage. Each file can be up to 100 MB. The function must parse the file and insert each row into a SQL database. You need to minimize cold start latency and ensure the function can handle the processing within the default timeout. What should you do?

Accepted Answer

Use a dedicated App Service plan with Always On enabled.. A Dedicated App Service plan with Always On enabled eliminates cold starts by keeping the function host loaded continuously, and it provides a default timeout of 30 minutes (configurable up to 230 minutes), which is sufficient for processing 100 MB CSV files. The Consumption plan has a default timeout of 5 minutes (max 10 minutes), which may not be enough for large file processing, and it suffers from cold starts. The Premium plan reduces cold starts with pre-warmed instances but is not necessary when a Dedicated plan with Always On is more cost-effective and meets the requirements.

Answer

Use the Premium plan with pre-warmed instances.

Answer

Use Durable Functions to split processing into smaller chunks.

Answer

Use the Consumption plan and increase the function timeout to 10 minutes.

Question 8

You are using Application Insights to monitor an ASP.NET Core web API. Users report that a specific endpoint is slow, but you cannot reproduce the issue in development. You need to identify which line of code is causing the delay in production. Which Application Insights feature should you use?

Accepted Answer

Enable Application Insights Profiler.. Application Insights Profiler is designed specifically to trace code-level performance issues in production without requiring code changes or reproducing the problem. It captures detailed call stacks and timing for each request, allowing you to identify exactly which line of code is causing the delay. This makes it the correct choice for diagnosing a slow endpoint that cannot be reproduced in development.

Answer

Use the Application Insights Map to visualize dependencies.

Answer

Use the Snapshot Debugger to capture debug snapshots on exceptions.

Answer

Create a custom telemetry event in the slow endpoint to log timing data.

Question 9

A company stores sensitive customer data in Azure Blob Storage. They require that all access to the storage account be logged and that any access from outside the corporate network be denied. They also need to allow read access from a specific Azure web app without exposing the storage account publicly. Which three actions should be taken? (Choose three.)

Accepted Answer

Enable diagnostic settings for the storage account and send logs to a Log Analytics workspace. Enabling diagnostic settings for the storage account and sending logs to a Log Analytics workspace captures all access logs (including read, write, and delete operations) as required by the scenario. This satisfies the logging requirement. Assigning the 'Storage Blob Data Reader' role to the web app's managed identity provides secure, credential-less read access for the web app to the storage account, aligning with the principle of least privilege and avoiding public exposure. Configuring the storage account firewall to allow access only from the virtual network/subnet of the web app ensures that access from outside the corporate network is denied and that the storage account is not exposed publicly, as the web app would access it via a private link or service endpoint within the allowed VNet.

Answer

Enable Azure Defender for Storage

Answer

Generate a SAS token and store it in the web app's configuration

Question 10

A developer is building a function app that processes messages from an Azure Storage queue. The function must scale automatically based on queue length. Which hosting plan supports this automatic scaling?

Accepted Answer

Consumption plan. The Consumption plan is correct because it is a primary Azure Functions hosting plan that provides true automatic scaling based on event-driven triggers, such as queue length. In this plan, the Azure Functions host dynamically adds or removes instances, scaling from zero when idle, up to a maximum of 200 (default) based on the number of messages in the Storage queue. It uses a target-based scaling strategy that monitors queue depth and backlog, making it the default and most cost-effective option for workloads that need to scale to zero and burst to handle large message volumes. While the Premium plan also supports automatic scaling based on event triggers, it maintains at least one warm instance and does not scale to zero.

Answer

Premium plan

Answer

App Service plan

Answer

Azure Container Instances

Question 11

You are developing an Azure Functions app that processes large files from Azure Blob Storage. When a file is uploaded, the function triggers and reads the entire file into memory, causing high memory usage. You need to optimize the function to handle large files efficiently. Which approach should you recommend?

Accepted Answer

Stream the blob content directly to the processing logic. Streaming the blob content directly to the processing logic avoids loading the entire file into memory at once. The Azure Blob Storage SDK supports reading blob content as a stream (e.g., using `BlobClient.OpenReadAsync()`), which allows the function to process data in chunks, significantly reducing memory pressure for large files.

Answer

Use a byte array to read the blob in chunks

Answer

Read the blob content into a temporary file on disk

Answer

Increase the memory allocation of the function app

Question 12

You need to design a solution to securely store and access secrets (e.g., API keys, connection strings) for a set of Azure Functions. The solution must minimize administrative overhead and avoid storing secrets in code or configuration files. Which THREE should you include? (Choose three.)

Accepted Answer

Store secrets in Azure Key Vault. Azure Key Vault is the correct service for securely storing secrets like API keys and connection strings because it provides centralized, hardware-backed secret management with access policies and auditing. By referencing Key Vault secrets from Azure Functions via a managed identity, you avoid storing secrets in code or configuration files, which aligns with the requirement to minimize administrative overhead and eliminate plaintext secrets. Enabling Key Vault soft-delete and purge protection is a critical security best practice to prevent accidental or malicious permanent deletion of secrets, ensuring data resilience and compliance, which is essential for a robust 'secure solution'.

Answer

Store secrets in application settings as plain text

Answer

Use Azure App Configuration for feature flags

Question 13

You are developing a mobile app that uses Azure Cognitive Services to analyze images. The app must authenticate to the Computer Vision API using a key that is rotated monthly. What is the best practice for handling the key?

Accepted Answer

Store the key in Azure App Configuration with Key Vault references and retrieve it at runtime. Azure App Configuration with Key Vault references provides a secure, centralized way to store and rotate secrets like API keys without embedding them in code or requiring redeployment. A secure backend service (e.g., an Azure Function or App Service) that the mobile app interacts with would retrieve the key at runtime via a managed identity, ensuring the key is never stored locally on the mobile device and can be rotated monthly by updating Key Vault, with App Configuration automatically fetching the latest version. The mobile app would then call this backend service, which in turn authenticates to Cognitive Services.

Answer

Use a system-assigned managed identity and acquire a token for Cognitive Services

Answer

Prompt the user to enter the key on first launch

Answer

Store the key in the mobile app's local secure storage after initial retrieval

Question 14

An API receives JWT access tokens from Microsoft Entra ID. Which two token properties should the API validate before accepting a request?

Accepted Answer

Issuer and signature are valid for the trusted tenant. The API must validate the token's issuer (iss) claim to ensure it matches the trusted Microsoft Entra ID tenant's issuer URL, confirming the token's origin. It must also verify the token's cryptographic signature to ensure it hasn't been tampered with. Additionally, the API must validate the token's audience (aud) claim, ensuring it matches the API's own Application ID URI or client ID, which confirms the token was intended for this specific API.

Answer

The user's display name is present

Answer

The token was sent in a query string

Question 15

Match each Azure monitoring tool to its purpose.

Accepted Answer

Azure Monitor: Collects, analyzes, and acts on telemetry data from Azure and on-premises environments.. Azure Monitor is the main service for telemetry collection and analysis. Application Insights focuses on application performance. Log Analytics is the query workspace for logs. Azure Advisor provides optimization recommendations. The distractors swap these definitions.

Answer

Application Insights: Workspace for querying and analyzing log data from various sources.

Answer

Azure Monitor: Provides personalized recommendations to optimize Azure resources for cost, security, reliability, and performance.

Question 16

You are monitoring an Azure Web App with Application Insights. You notice that certain requests have high server response times. You need to identify which specific database queries are causing the delays. Which Application Insights feature should you use?

Accepted Answer

Application Insights Profiler. Application Insights Profiler is the correct feature because it provides detailed, code-level diagnostics for requests with high server response times, including per-operation breakdowns of database query durations. It captures execution traces that show exactly which SQL queries or external calls are contributing to latency, enabling you to pinpoint the specific database queries causing delays.

Answer

Live Metrics Stream

Answer

Performance blade

Answer

Application Map

Question 17

Your web app hosted on Azure App Service needs to consume an external SaaS API that requires an API key. The key must be stored securely and rotated without redeploying the app. What is the best approach?

Accepted Answer

Store the API key in Azure Key Vault and use a managed identity to retrieve it.. Azure Key Vault is specifically designed for securely storing and managing secrets, keys, and certificates. Using a Managed Identity for the App Service allows it to authenticate to Key Vault without needing any secrets (like connection strings or client IDs/secrets) stored within the App Service itself, adhering to the principle of least privilege. Secrets in Key Vault can be rotated independently, and the application can be designed to retrieve the latest version without redeployment, satisfying all requirements. This approach provides the highest level of security, auditability, and adherence to Azure best practices for secret management.

Answer

Store the API key in Azure SQL Database and query it at startup.

Answer

Store the API key in a configuration file in the application code.

Answer

Store the API key in an App Service application setting.

Question 18

A company has an Azure App Service web app that occasionally returns 500 errors. You need to diagnose the root cause without impacting production traffic. Which feature should you use?

Accepted Answer

Application Insights. Application Insights is a powerful diagnostic tool that provides detailed telemetry and performance monitoring for your web app. It can automatically detect and analyze 500 errors, showing stack traces, request details, and dependencies. This allows you to identify the root cause without impacting production traffic, as it works passively by collecting data.

Answer

Kudu console

Answer

Deployment slots

Answer

Autoscaling rules

Question 19

A company uses Azure Logic Apps to integrate with a third-party REST API. The API has a rate limit of 100 requests per minute. You need to ensure that the Logic App respects this limit. Which connector feature should you configure?

Accepted Answer

Concurrency control.. Concurrency control in Azure Logic Apps allows you to limit the number of concurrent workflow instances (when applied to the trigger) or parallel iterations (when applied to a 'For each' loop). By configuring this setting, you can proactively manage the rate at which requests are sent to an external API, helping to prevent exceeding rate limits. For example, if each Logic App run makes one API call, setting the concurrency limit on the trigger to a value that aligns with the rate limit (e.g., 100, if runs are short and the trigger fires frequently) can help throttle the overall request volume by queuing additional runs. This proactively manages the request volume, unlike a retry policy which reacts to failures.

Answer

Retry policy.

Answer

Swagger connector.

Answer

API Management.

Question 20

Your Azure Functions app uses a consumption plan and processes messages from an Azure Service Bus queue. You notice that message processing takes up to 10 minutes, and some messages are being processed multiple times. What is the most likely cause?

Accepted Answer

The lock duration on the Service Bus queue is shorter than the processing time.. The default lock duration for a Service Bus queue is 30 seconds, which is far shorter than the 10-minute processing time. When the lock expires, the message becomes visible to other consumers, causing duplicate processing. While Azure Functions attempts to automatically renew the message lock during processing, this auto-renewal has a maximum duration (default 5 minutes). Since the processing time (10 minutes) exceeds this duration, the lock will eventually expire, leading to the message becoming available for re-delivery.

Answer

The max delivery count for the queue is set too low.

Answer

The function host is configured with a low maximum instance count.

Answer

The function does not handle poison messages correctly.