AZ-204 Practice Test 26 — 15 Questions

Question 1

A company uses Azure API Management (APIM) to expose a set of REST APIs. A new requirement mandates that all API calls must be throttled per user based on usage tiers (Free, Basic, Premium). User identity is provided via a JWT token. Which policy should the developer configure in APIM to enforce this throttling?

Accepted Answer

rate-limit-by-key policy. Option B is correct because the rate-limit-by-key policy can throttle calls based on a key extracted from the JWT claim (e.g., subscription tier). Option A is incorrect because rate-limit policy applies globally, not per user. Option C is incorrect because quota-by-key limits total calls over a period, not rate. Option D is incorrect because IP-based throttling does not consider user identity.

Answer

rate-limit policy

Answer

quota-by-key policy

Answer

IP-based throttling

Question 2

A developer is building an app that uses Azure Cognitive Services Text Analytics. The app needs to detect the language of text input. Which Azure SDK method should be called?

Accepted Answer

DetectLanguage. Option A is correct because the Text Analytics client's DetectLanguage method is used to detect language. Option B (AnalyzeSentiment) is for sentiment; Option C (ExtractKeyPhrases) is for key phrases; Option D (RecognizeEntities) is for entities.

Answer

ExtractKeyPhrases

Answer

AnalyzeSentiment

Answer

RecognizeEntities

Question 3

Your Azure Function app needs to call a third-party REST API that requires OAuth 2.0 client credentials flow. The API expects a JWT token signed with a client certificate. You want to store the certificate securely and rotate it automatically. Which Azure service and feature should you use?

Accepted Answer

Store the certificate in Azure Key Vault with automatic rotation enabled, and use Managed Identity to access it from the Function app.. Azure Key Vault can store the certificate, and the Managed Identity of the Function app can authenticate to Key Vault. Automatic rotation requires Key Vault's certificate auto-rotation feature. Option A is the best combination.

Answer

Store the certificate in Azure Cosmos DB as a document, and retrieve it using the Cosmos DB SDK.

Answer

Store the certificate in Azure App Service as a TLS/SSL binding, and use the WEBSITE_LOAD_CERTIFICATES app setting.

Answer

Store the certificate in Azure Storage as a blob, and reference it from the Function app using a SAS token.

Question 4

Which TWO are correct ways to securely store and access secrets for Azure Functions? (Choose two.)

Accepted Answer

Use a Key Vault reference in the Function App settings.. Azure Key Vault references and App Settings with access restrictions are both secure. Option A (Key Vault reference) is correct; Option C (App Settings) is correct. Option B exposes secrets; Option D is not secure; Option E is for local development only.

Answer

Use Environment.ExpandEnvironmentVariables in the code.

Answer

Store secrets in the Function App code as constants.

Answer

Store secrets in a local.settings.json file and deploy it.

Question 5

Your company uses Azure API Management to expose APIs to external partners. You need to enforce throttling limits per subscription key. Which policy should you add?

Accepted Answer

rate-limit by key policy with @(context.Subscription.Id) as counter key. Option B is correct because the rate-limit policy by key throttles requests per subscription key. Option A is wrong because it limits per key but not by key. Option C is wrong because IP-based throttling is not per key. Option D is wrong because it's for authentication, not throttling.

Answer

rate-limit policy with IP address filtering

Answer

rate-limit by key policy with no counter key

Answer

validate-jwt policy with claims check

Question 6

A web app needs to access Azure Key Vault secrets for database credentials. The app runs as a managed identity in Azure App Service. Which authentication method should be used to retrieve secrets without storing credentials in the app code?

Accepted Answer

Managed identity. Managed identity (option A) allows the app to authenticate to Azure services without storing credentials. Access keys (B) are not recommended. Client certificate (C) requires certificate management. SAS tokens (D) are for storage, not Key Vault.

Answer

Access key

Answer

Client certificate

Answer

Shared access signature (SAS) token

Question 7

Which TWO Azure services can be used to trigger an Azure Function in response to a new blob being added to an Azure Storage account? (Choose two.)

Accepted Answer

Azure Blob Storage trigger. Azure Blob Storage trigger (A) and Azure Event Grid subscription (D) can trigger functions on blob creation. Timer trigger (B) is time-based. HTTP trigger (C) is for HTTP requests. Queue trigger (E) is for queue messages.

Answer

HTTP trigger

Answer

Queue trigger

Answer

Timer trigger

Question 8

You need to process large volumes of streaming data from IoT devices in near real-time. The processed data must be stored in Azure Cosmos DB for further analysis. Which Azure service should you use for stream processing?

Accepted Answer

Azure Stream Analytics. Option C is correct because Azure Stream Analytics is designed for real-time stream processing and can output directly to Azure Cosmos DB. Option A is wrong because Azure Data Lake Storage is a storage service, not a stream processing service. Option B is wrong because Azure Databricks is a big data analytics platform, but it is not the most straightforward for simple stream processing to Cosmos DB; it requires more configuration. Option D is wrong because Azure Batch is for batch processing, not streaming.

Answer

Azure Batch

Answer

Azure Databricks

Answer

Azure Data Lake Storage

Question 9

Your company has an Azure Logic App that processes orders by calling a third-party REST API using an HTTP trigger. Recently, the API provider changed their authentication to require OAuth 2.0 with client credentials. The Logic App currently uses a basic authentication header. What should you do to update the Logic App?

Accepted Answer

Configure the Logic App to use a managed identity and update the HTTP action authentication to 'Active Directory OAuth'. Azure Logic Apps can use managed identities to authenticate to services that support Microsoft Entra ID. For third-party APIs, you can configure the authentication type to 'Active Directory OAuth' and use the managed identity. Option A is wrong because the API key is not OAuth 2.0. Option B is wrong because API Management can be used but adds unnecessary complexity. Option D is wrong because connection strings are not relevant.

Answer

Use Azure API Management to proxy the API and add OAuth support

Answer

Add the client ID and client secret as query parameters

Answer

Replace the HTTP trigger with a Service Bus queue

Question 10

Which TWO Azure services can be used to implement a publish-subscribe messaging pattern?

Accepted Answer

Azure Event Grid. Azure Service Bus Topics and Azure Event Grid both support publish-subscribe. Event Hubs is for event streaming, not pub-sub. Queue Storage is for point-to-point messaging. Notification Hubs is for push notifications.

Answer

Azure Queue Storage

Answer

Azure Notification Hubs

Answer

Azure Event Hubs

Question 11

A developer is building an application that needs to store and retrieve large binary files (e.g., images, videos). The application runs on Azure Virtual Machines. Which Azure service provides the most cost-effective storage for these files?

Accepted Answer

Azure Blob Storage. Option B is correct because Azure Blob Storage is specifically designed for storing large amounts of unstructured data like binary files at low cost. Option A is incorrect because Azure SQL Database is for relational data, not blob storage. Option C is incorrect because Azure Files is for shared file systems, not optimal for large binary files. Option D is incorrect because Azure Cosmos DB is for NoSQL data and is more expensive for blob storage.

Answer

Azure SQL Database

Answer

Azure Cosmos DB

Answer

Azure Files

Question 12

An app uses Azure Event Grid to publish events. The events must be delivered to an Azure Function that processes them. Which Event Grid event delivery model should be used?

Accepted Answer

Push delivery. Option C is correct because Event Grid supports push delivery to event handlers like Azure Functions. Option A (pull) is for Event Hubs; Option B (poll) is not a typical model; Option D (batch) is a delivery mode, but the push model is the standard for Event Grid.

Answer

Pull delivery

Answer

Batch delivery

Answer

Poll delivery

Question 13

You are building a solution that processes orders and needs to send order confirmation emails reliably. You choose Azure Logic Apps with a Gmail connector. However, you are concerned about hitting Gmail's sending limits. What should you do to handle this?

Accepted Answer

Configure a retry policy in the Logic App action to retry on failure with exponential backoff.. Gmail has sending limits; to avoid hitting them, use a retry policy with exponential backoff in Logic Apps. Option A is the correct approach. Option B is not available; Option C is unnecessary if retries are configured; Option D is not a standard feature.

Answer

Use Azure Queue Storage to buffer messages and process them asynchronously.

Answer

Use a webhook instead of a connector to send emails directly via Gmail API.

Answer

Increase the Gmail API quota by contacting Google support.

Question 14

You are reviewing an ARM template that deploys an Azure App Service. The template sets an app setting 'MyApiKey' that references a Key Vault secret. However, the deployment fails with an error that the app service cannot access the secret. What is the most likely cause?

Accepted Answer

The App Service does not have a managed identity enabled and the Key Vault access policy is missing.. The Key Vault reference syntax is correct, but the App Service must have a managed identity and Key Vault access policy to read the secret. Option B is correct. Option A is incorrect because the syntax is valid; Option C is incorrect because ARM templates support Key Vault references; Option D is incorrect because the syntax is correct.

Answer

The Key Vault reference syntax '@Microsoft.KeyVault(SecretUri=...)' is incorrect.

Answer

The ARM template cannot use Key Vault references in app settings.

Answer

The secret name in the URI does not match the actual secret name.

Question 15

You are developing a serverless application using Azure Functions that processes orders. Each order must be validated by calling a third-party API. If the third-party API is unavailable, the function should retry with exponential backoff. How should you implement this?

Accepted Answer

Implement retry logic with exponential backoff and circuit breaker using Polly within the function. Option A is correct because Azure Functions can retry on transient faults with exponential backoff and circuit breaker pattern. Option B is wrong because it does not handle failures. Option C is wrong because it does not handle the external call. Option D is wrong because it's not a built-in feature.

Answer

Enable automatic retries on the function's trigger binding

Answer

Configure the function to have a long timeout and hope the API responds

Answer

Use Azure Durable Functions to orchestrate the retry