AZ-204 Practice Test 5 — 25 Questions

Question 1

You are developing a web application that allows users to upload images. The application is deployed on Azure App Service. After upload, the images must be processed to generate thumbnails and to extract metadata. The processing should happen asynchronously and must be resilient to failures. You need to design the solution using serverless components. The solution must minimize latency for the user during upload, and the processing must be retried automatically if it fails. You also need to ensure that the processing is idempotent, so that duplicate messages do not cause duplicate thumbnails. Which approach should you use?

Option A: Use Azure Functions with a Blob Storage trigger to process each image as it is uploaded. The function generates thumbnails and stores metadata in Cosmos DB. Use the `leaseBlob` property to prevent duplicate processing.
Option B: Use Azure Functions with an Event Grid trigger to process images. The function generates thumbnails and stores metadata in Cosmos DB. Use Event Grid's built-in retry policy and idempotent logic in the function.
Option C: Use Azure Logic Apps with a Blob Storage connector to process images. The logic app generates thumbnails and stores metadata in Cosmos DB. Configure retry policy on the connector.
Option D: Use Azure Functions with a Service Bus queue trigger. The web app sends a message to the queue after upload. The function processes the message, generates thumbnails, and stores metadata. Use message deduplication to ensure idempotency.

Accepted Answer

Azure Functions with Service Bus queue trigger and duplicate detection. It uses a Service Bus queue with duplicate detection, which ensures idempotent processing by automatically discarding duplicate messages within a defined time window. The web app uploads the image and immediately sends a message to the queue, minimizing user latency. The Azure Function triggered by the queue processes the image asynchronously, and Service Bus's built-in retry policy (via dead-lettering and max delivery count) provides resilience against failures.

Answer

Azure Functions with Blob Storage trigger, using leaseBlob

Answer

Azure Logic Apps with Blob Storage connector

Answer

Azure Functions with Event Grid trigger

Question 2

Which THREE factors should you consider when choosing between Azure Container Instances (ACI) and Azure Kubernetes Service (AKS) for a containerized workload? (Choose three.)

Accepted Answer

The need for orchestration of multiple containers. AKS provides full orchestration capabilities for managing multiple containers across a cluster, including service discovery, load balancing, and scaling. ACI is designed for single-container or simple multi-container groups without native orchestration, making AKS the appropriate choice when complex orchestration is required (A).
Azure Container Instances (ACI) has specific maximum resource limits for a single container group (e.g., 16 vCPU, 112 GiB memory), making it suitable for smaller, burstable workloads. Azure Kubernetes Service (AKS) allows for much larger, distributed applications by scaling out across multiple nodes and pods, making the overall resource capacity a key differentiator (E).
The Azure Application Gateway Ingress Controller (AGIC) is an AKS-specific feature that allows Application Gateway to act as an Ingress controller for an AKS cluster. If a workload requires this specific ingress solution, AKS is the appropriate choice, whereas ACI does not offer this native integration (D).

Answer

The restart policy for containers

Answer

The need for GPU-accelerated compute

Question 3

You need to store billions of small telemetry data entries (each ~100 bytes) from IoT devices. The data is written once and rarely updated. You need to run analytical queries on the last 30 days of data daily. The queries scan large ranges of data by timestamp and require sub-second response times. You need the lowest storage cost while meeting query latency requirements. Which Azure Storage solution should you use?

Accepted Answer

Azure Blob Storage with hot access tier and Data Lake Storage Gen2.. Azure Blob Storage with the hot access tier is suitable for data that is accessed frequently (daily queries on the last 30 days), providing lower transaction costs compared to the cool tier for active data. Azure Data Lake Storage Gen2, built on Blob Storage, enables hierarchical namespace and POSIX-like access, allowing efficient analytical queries on large timestamp-ranged data with sub-second response times via partitioning and parallel processing, meeting the performance and scalability requirements at a cost-effective price point for the storage of billions of small entries.

Answer

Azure Table Storage with a timestamp partition key.

Answer

Azure Cosmos DB with SQL API and automatic indexing.

Answer

Azure Blob Storage with cool access tier and Azure Data Lake Storage Gen2.

Question 4

You are deploying an Azure App Service using an ARM template. After deployment, you find that the application settings are not applied. What is the most likely issue?

Accepted Answer

The resource is missing a dependsOn property for the parent site. When deploying application settings via an ARM template, the 'Microsoft.Web/sites/config' resource (which contains the appsettings) must have a 'dependsOn' property referencing the parent 'Microsoft.Web/sites' resource. Without this dependency, Azure Resource Manager may attempt to apply the settings before the site exists, causing the settings to be silently ignored or not applied. This is a common deployment ordering issue.

Answer

The resource type should be 'Microsoft.Web/sites/appsettings'

Answer

The apiVersion is outdated, use '2021-02-01'

Answer

The property 'MyApp:Setting1' uses a colon, which is not allowed

Question 5

You are developing a solution that processes large files uploaded by users to Azure Blob Storage. Each file must be validated for malware using Microsoft Defender for Cloud Apps before being moved to a different container for further processing. The validation can take several minutes. What is the most cost-effective and scalable approach?

Accepted Answer

Use Azure Event Grid to trigger an Azure Function on blob creation, which validates the file and moves it after scan.. Azure Event Grid provides a serverless, event-driven architecture that triggers an Azure Function immediately when a blob is created. This eliminates the need for polling or idle compute resources, making it the most cost-effective and scalable approach for processing large files that require time-consuming malware validation.

Answer

Use the Azure SDK to poll for new blobs from within a continuously running background service.

Answer

Use an Azure VM running a scheduled task to poll for new blobs and perform validation.

Answer

Use Azure Logic Apps with a recurrence trigger to check for new blobs and call the Microsoft Defender API.

Question 6

You are developing a web app that uses Azure AD B2C for customer identity. The app must allow users to sign in with their social media accounts like Facebook and Google. Which Azure AD B2C policy type should you configure?

Accepted Answer

Sign-up and sign-in policy. The sign-up and sign-in policy (now called a user flow in the Azure portal) is the correct choice because it is the Azure AD B2C policy type specifically designed to handle both user registration and authentication in a single flow. This policy can be configured to include social identity providers like Facebook and Google, allowing users to sign in using those accounts. It orchestrates the OAuth 2.0 and OpenID Connect protocols to redirect users to the social provider's authorization endpoint and then process the returned tokens.

Answer

Profile editing policy

Answer

Password reset policy

Answer

Conditional access policy

Question 7

You are developing a microservice that needs to publish events to multiple subscribers. Each subscriber should receive the event independently and at its own pace. The event must be retained for up to 7 days. Which Azure messaging service should you use?

Accepted Answer

Azure Service Bus topic. Azure Service Bus Topic is the correct choice. It provides a publish-subscribe model where each subscriber receives events independently through its own durable subscription. Messages are retained within each subscription until they are processed or their time-to-live expires (up to 14 days by default), which perfectly meets the requirement for events to be retained for up to 7 days for subscribers to consume at their own pace. Event Grid is designed for near real-time event delivery and does not offer durable message retention for subscribers over several days; its retry policy is limited to a maximum of 24 hours.

Answer

Azure Service Bus queue

Answer

Azure Event Grid

Answer

Azure Event Hubs

Question 8

You are developing a serverless API using Azure Functions. The API should only be accessible from a specific virtual network. You need to configure network security. What should you do?

Accepted Answer

Configure a private endpoint for the Function App and disable public access.. To ensure the Azure Function API is *only* accessible from a specific virtual network, the most secure and direct approach is to configure a private endpoint for the Function App within that VNet. A private endpoint assigns a private IP address from your VNet to the Function App, making it accessible privately within the VNet. Crucially, you must then disable public access to the Function App. This combination ensures that all traffic must flow through the private endpoint from within the VNet, thereby meeting the requirement for network-level isolation and restricting access exclusively to the specified VNet. Option C's explanation is misleading as VNet integration primarily enables outbound connectivity, and an NSG on the VNet-integrated subnet does not directly block public internet access to the Function App's public endpoint.

Answer

Place the Functions in Azure API Management and configure IP restrictions.

Answer

Configure IP address restrictions on the Function App to allow only the VNet's public IP range.

Answer

Deploy the Function App in a Premium plan and configure VNet integration, then use a Network Security Group to restrict traffic.

Question 9

You deploy a containerized application to Azure Container Instances (ACI). The application needs to store configuration settings that might change at runtime. You need to update the configuration without redeploying the container. What should you do?

Accepted Answer

Mount an Azure Files share and update the configuration file. To update configuration settings at runtime without redeploying the container in Azure Container Instances (ACI), you should mount an Azure Files share. The application can read its configuration from a file stored on this share. When configuration changes are needed, you can update the file directly on the Azure Files share. The container itself does not need to be redeployed or restarted, provided the application is designed to periodically re-read the configuration file or react to file changes. This approach allows for dynamic configuration updates independent of the container lifecycle.

Answer

Use environment variables in the container group

Answer

Use Application Settings in the container

Answer

Modify the container image to include new configuration

Question 10

You are building a serverless application using Azure Functions. The function processes large CSV files uploaded to Azure Blob Storage. Each file can be up to 100 MB. The function must parse the file and insert each row into a SQL database. You need to minimize cold start latency and ensure the function can handle the processing within the default timeout. What should you do?

Accepted Answer

Use a dedicated App Service plan with Always On enabled.. A Dedicated App Service plan with Always On enabled eliminates cold starts by keeping the function host loaded continuously, and it provides a default timeout of 30 minutes (configurable up to 230 minutes), which is sufficient for processing 100 MB CSV files. The Consumption plan has a default timeout of 5 minutes (max 10 minutes), which may not be enough for large file processing, and it suffers from cold starts. The Premium plan reduces cold starts with pre-warmed instances but is not necessary when a Dedicated plan with Always On is more cost-effective and meets the requirements.

Answer

Use the Premium plan with pre-warmed instances.

Answer

Use Durable Functions to split processing into smaller chunks.

Answer

Use the Consumption plan and increase the function timeout to 10 minutes.

Question 11

You are using Application Insights to monitor an ASP.NET Core web API. Users report that a specific endpoint is slow, but you cannot reproduce the issue in development. You need to identify which line of code is causing the delay in production. Which Application Insights feature should you use?

Accepted Answer

Enable Application Insights Profiler.. Application Insights Profiler is designed specifically to trace code-level performance issues in production without requiring code changes or reproducing the problem. It captures detailed call stacks and timing for each request, allowing you to identify exactly which line of code is causing the delay. This makes it the correct choice for diagnosing a slow endpoint that cannot be reproduced in development.

Answer

Use the Application Insights Map to visualize dependencies.

Answer

Use the Snapshot Debugger to capture debug snapshots on exceptions.

Answer

Create a custom telemetry event in the slow endpoint to log timing data.

Question 12

A company stores sensitive customer data in Azure Blob Storage. They require that all access to the storage account be logged and that any access from outside the corporate network be denied. They also need to allow read access from a specific Azure web app without exposing the storage account publicly. Which three actions should be taken? (Choose three.)

Accepted Answer

Enable diagnostic settings for the storage account and send logs to a Log Analytics workspace. Enabling diagnostic settings for the storage account and sending logs to a Log Analytics workspace captures all access logs (including read, write, and delete operations) as required by the scenario. This satisfies the logging requirement. Assigning the 'Storage Blob Data Reader' role to the web app's managed identity provides secure, credential-less read access for the web app to the storage account, aligning with the principle of least privilege and avoiding public exposure. Configuring the storage account firewall to allow access only from the virtual network/subnet of the web app ensures that access from outside the corporate network is denied and that the storage account is not exposed publicly, as the web app would access it via a private link or service endpoint within the allowed VNet.

Answer

Enable Azure Defender for Storage

Answer

Generate a SAS token and store it in the web app's configuration

Question 13

A developer is building a function app that processes messages from an Azure Storage queue. The function must scale automatically based on queue length. Which hosting plan supports this automatic scaling?

Accepted Answer

Consumption plan. The Consumption plan is correct because it is a primary Azure Functions hosting plan that provides true automatic scaling based on event-driven triggers, such as queue length. In this plan, the Azure Functions host dynamically adds or removes instances, scaling from zero when idle, up to a maximum of 200 (default) based on the number of messages in the Storage queue. It uses a target-based scaling strategy that monitors queue depth and backlog, making it the default and most cost-effective option for workloads that need to scale to zero and burst to handle large message volumes. While the Premium plan also supports automatic scaling based on event triggers, it maintains at least one warm instance and does not scale to zero.

Answer

Premium plan

Answer

App Service plan

Answer

Azure Container Instances

Question 14

You are developing an Azure Functions app that processes large files from Azure Blob Storage. When a file is uploaded, the function triggers and reads the entire file into memory, causing high memory usage. You need to optimize the function to handle large files efficiently. Which approach should you recommend?

Accepted Answer

Stream the blob content directly to the processing logic. Streaming the blob content directly to the processing logic avoids loading the entire file into memory at once. The Azure Blob Storage SDK supports reading blob content as a stream (e.g., using `BlobClient.OpenReadAsync()`), which allows the function to process data in chunks, significantly reducing memory pressure for large files.

Answer

Use a byte array to read the blob in chunks

Answer

Read the blob content into a temporary file on disk

Answer

Increase the memory allocation of the function app

Question 15

You need to design a solution to securely store and access secrets (e.g., API keys, connection strings) for a set of Azure Functions. The solution must minimize administrative overhead and avoid storing secrets in code or configuration files. Which THREE should you include? (Choose three.)

Accepted Answer

Store secrets in Azure Key Vault. Azure Key Vault is the correct service for securely storing secrets like API keys and connection strings because it provides centralized, hardware-backed secret management with access policies and auditing. By referencing Key Vault secrets from Azure Functions via a managed identity, you avoid storing secrets in code or configuration files, which aligns with the requirement to minimize administrative overhead and eliminate plaintext secrets. Enabling Key Vault soft-delete and purge protection is a critical security best practice to prevent accidental or malicious permanent deletion of secrets, ensuring data resilience and compliance, which is essential for a robust 'secure solution'.

Answer

Store secrets in application settings as plain text

Answer

Use Azure App Configuration for feature flags

Question 16

You are developing a mobile app that uses Azure Cognitive Services to analyze images. The app must authenticate to the Computer Vision API using a key that is rotated monthly. What is the best practice for handling the key?

Accepted Answer

Store the key in Azure App Configuration with Key Vault references and retrieve it at runtime. Azure App Configuration with Key Vault references provides a secure, centralized way to store and rotate secrets like API keys without embedding them in code or requiring redeployment. A secure backend service (e.g., an Azure Function or App Service) that the mobile app interacts with would retrieve the key at runtime via a managed identity, ensuring the key is never stored locally on the mobile device and can be rotated monthly by updating Key Vault, with App Configuration automatically fetching the latest version. The mobile app would then call this backend service, which in turn authenticates to Cognitive Services.

Answer

Use a system-assigned managed identity and acquire a token for Cognitive Services

Answer

Prompt the user to enter the key on first launch

Answer

Store the key in the mobile app's local secure storage after initial retrieval

Question 17

An API receives JWT access tokens from Microsoft Entra ID. Which two token properties should the API validate before accepting a request?

Accepted Answer

Issuer and signature are valid for the trusted tenant. The API must validate the token's issuer (iss) claim to ensure it matches the trusted Microsoft Entra ID tenant's issuer URL, confirming the token's origin. It must also verify the token's cryptographic signature to ensure it hasn't been tampered with. Additionally, the API must validate the token's audience (aud) claim, ensuring it matches the API's own Application ID URI or client ID, which confirms the token was intended for this specific API.

Answer

The user's display name is present

Answer

The token was sent in a query string

Question 18

Match each Azure monitoring tool to its purpose.

Accepted Answer

Azure Monitor: Collects, analyzes, and acts on telemetry data from Azure and on-premises environments.. Azure Monitor is the main service for telemetry collection and analysis. Application Insights focuses on application performance. Log Analytics is the query workspace for logs. Azure Advisor provides optimization recommendations. The distractors swap these definitions.

Answer

Application Insights: Workspace for querying and analyzing log data from various sources.

Answer

Azure Monitor: Provides personalized recommendations to optimize Azure resources for cost, security, reliability, and performance.

Question 19

You are developing a web application that allows users to upload profile pictures to Azure Blob Storage. The application generates thumbnails using an Azure Function that is triggered by blob creation. You need to ensure that the function only processes image files and ignores other file types. What should you do?

Accepted Answer

Set the trigger's 'source' parameter to 'EventGrid' and filter events by the 'content-type' property.. Both options A and C are valid methods to ensure the Azure Function only processes image files. Option A uses an Event Grid trigger with filtering on the 'content-type' property, which allows the function to only run for blobs with image content types. Option C checks the content type inside the function and ignores non-image blobs, which also works but runs the function for all blobs. Option B is incorrect because blob triggers do not have a 'filter' property for extensions. Option D is incorrect because the blob trigger's path pattern does not filter by extension; the function triggers for any blob in the container regardless of the file extension.

Answer

Set the trigger's 'filter' property to '*.jpg,*.png'.

Answer

Use the blob trigger with a path pattern like 'images/{name}.jpg' and 'images/{name}.png' and use the extension binding to filter.

Question 20

You are monitoring an Azure Web App with Application Insights. You notice that certain requests have high server response times. You need to identify which specific database queries are causing the delays. Which Application Insights feature should you use?

Accepted Answer

Application Insights Profiler. Application Insights Profiler is the correct feature because it provides detailed, code-level diagnostics for requests with high server response times, including per-operation breakdowns of database query durations. It captures execution traces that show exactly which SQL queries or external calls are contributing to latency, enabling you to pinpoint the specific database queries causing delays.

Answer

Live Metrics Stream

Answer

Performance blade

Answer

Application Map