AZ-204 Practice Test 26 — 15 Questions

Question 1

You need to deploy a microservice that runs a long-running background job (up to 30 minutes). The job should not be affected by App Service recycling. Which Azure technology should you use?

Accepted Answer

Azure WebJobs with Always On enabled. Azure WebJobs with Always On enabled ensures the WebJob runs continuously on a dedicated App Service instance, preventing it from being unloaded during idle periods or App Service recycling. This allows the long-running background job (up to 30 minutes) to complete without interruption, as the WebJob runs in the same process as the web app and is not subject to the 5-minute timeout of the Consumption plan.

Answer

Azure Automation Runbook

Answer

Azure Functions (Consumption plan)

Answer

Azure Kubernetes Service (AKS)

Question 2

You are developing a microservices application on Azure Kubernetes Service (AKS). One of the services needs to securely access Azure SQL Database without storing connection strings in the application code. You need to use managed identities. What should you do?

Accepted Answer

Enable Azure AD Pod Identity and assign a managed identity to the pod.. Azure AD Pod Identity allows you to assign an Azure Active Directory (Azure AD) managed identity directly to a pod in AKS. The pod can then use that identity to authenticate to Azure SQL Database without storing any connection strings or secrets in the code. This is the recommended approach for pod-level managed identity access to Azure resources.

Answer

Store the connection string in Azure Key Vault and use the Key Vault FlexVolume driver.

Answer

Use the AKS cluster's managed identity to access Azure SQL.

Answer

Create a service principal and use its credentials in the pod.

Question 3

An Azure Function processes events from Event Hubs. You need to monitor the number of events that were successfully processed and those that were dropped due to processing errors. Which approach should you use?

Accepted Answer

Custom metrics in Application Insights.. Custom metrics in Application Insights allow you to track business-specific counters like successfully processed events and dropped events directly from your Azure Function code. By using the `TelemetryClient.TrackMetric()` API within the function's event processing logic, you can increment counters for success and failure scenarios, giving you precise, real-time monitoring of processing outcomes. This approach is more granular than built-in metrics because it reflects your application's custom error handling, not just infrastructure-level throughput.

Answer

Event Hubs metrics.

Answer

Stream Analytics job.

Answer

Log Analytics query on function logs.

Question 4

A company uses Azure Service Bus to receive order messages. Each order message must be processed exactly once, and duplicate messages are not tolerated due to financial transactions. However, the order processing system sometimes fails and retries, leading to potential duplicates. What Service Bus feature should be enabled on the message to support idempotent processing?

Accepted Answer

Duplicate detection. B is correct because Azure Service Bus's duplicate detection feature uses a user-defined MessageId to identify and discard duplicate messages within a specified time window (default 10 minutes, configurable up to 7 days). This ensures exactly-once processing by preventing the same order message from being processed multiple times, even if the sender retries due to failures.

Answer

Scheduled delivery

Answer

Message sessions

Answer

Auto-forwarding

Question 5

You are implementing a Durable Functions orchestration that calls an activity function which may fail transiently. You want to retry the activity up to 3 times with a 5-second delay and exponential backoff. Which code snippet should you use?

Accepted Answer

await context.CallActivityWithRetryAsync("Activity", new RetryOptions(TimeSpan.FromSeconds(5), 3), input);. The Durable Functions SDK provides the `CallActivityWithRetryAsync` method, which accepts a `RetryOptions` object to configure retry count and delay. The `RetryOptions` constructor takes `TimeSpan.FromSeconds(5)` as the first retry interval and `3` as the maximum number of attempts, including the initial call. This built-in method handles exponential backoff automatically, eliminating the need for manual retry logic.

Answer

await context.CallActivityAsync("Activity", input);

Answer

await context.CallActivityAsync("Activity", input, new RetryOptions(TimeSpan.FromSeconds(5), 3));

Answer

Use a durable timer and a loop to retry manually.

Question 6

Refer to the exhibit. You are configuring access to an Azure Storage container using Azure RBAC via a custom role definition. You want to allow a user to list blobs in a container only if the request originates from the IP range 203.0.113.0/24. However, the user reports that they can list blobs from any IP. What is the issue?

Accepted Answer

The Condition for IP address is incorrectly formatted. The current explanation is technically incorrect. Azure RBAC conditions are designed to add restrictions to role assignments and are evaluated for every request by any principal covered by that assignment, regardless of whether the assignment target is a specific user, group, or a broader scope like the tenant. Assigning a role to the tenant does not bypass conditions; the condition should still be enforced for all principals covered by that assignment. A more plausible reason for the observed behavior (user can list blobs from any IP) would be that the condition for the IP address is incorrectly formatted (Option D), causing it to always evaluate to true or be ignored, or that another role assignment without the condition exists for the user.

Answer

The Principal is set to an Azure AD tenant instead of a specific user or group

Answer

The Resource should be the storage account resource ID, not the container resource ID

Answer

The Action should be 'Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read'

Question 7

You manage an API in Azure API Management. The API response varies depending on the caller's subscription key. You need to cache responses per subscription key to reduce backend load. Which policy configuration should you use?

Accepted Answer

Set cache key to include the subscription key. Azure API Management's caching policy allows you to customize the cache key using the `@(context.Subscription.Id)` expression. By setting the cache key to include the subscription key, each caller's responses are cached separately based on their unique subscription, ensuring that variations in the API response per subscription key are preserved while reducing backend load.

Answer

Use a global cache with no variation

Answer

Disable caching and rely on the backend

Answer

Use rate limiting policy

Question 8

Your company uses Azure Logic Apps to automate a business process. The process needs to call an external REST API that requires an API key passed in the Authorization header. You need to store the API key securely and reference it in the Logic App. Which approach should you use?

Accepted Answer

Use an Azure Key Vault secret and a managed identity. Azure Key Vault securely stores secrets like API keys, and using a managed identity allows the Logic App to authenticate to Key Vault without embedding credentials in code or configuration. This follows the principle of least privilege and eliminates the need to manage secrets in connection strings or parameter files.

Answer

Store the API key in the Logic App's definition as a constant

Answer

Hardcode the API key in a parameter file

Answer

Use an Azure Storage account table to store the key

Question 9

Your e-commerce application sends telemetry to Application Insights. You need to reduce ingestion costs while preserving the ability to detect trends in performance metrics. Which sampling type should you configure?

Accepted Answer

Adaptive sampling. Adaptive sampling is the correct choice because it automatically adjusts the volume of telemetry data collected based on the application's activity level, ensuring that performance trends are preserved while reducing ingestion costs. Unlike fixed-rate sampling, adaptive sampling dynamically increases or decreases the sampling rate to maintain a target volume, making it ideal for e-commerce applications with variable traffic patterns.

Answer

Fixed-rate sampling

Answer

Ingestion sampling

Answer

Head-based sampling

Question 10

Your company uses Azure App Service to host a web application. You need to allow only authenticated users from your Microsoft Entra ID tenant to access the app, without writing any authentication code. Which feature should you configure?

Accepted Answer

Azure App Service Authentication (EasyAuth) with Microsoft Entra ID as identity provider.. Azure App Service Authentication (EasyAuth) is the correct feature because it provides a built-in, code-free way to authenticate users by integrating with Microsoft Entra ID (formerly Azure AD). When configured, the App Service automatically validates tokens and redirects unauthenticated users to the identity provider, enforcing authentication at the platform level without requiring any changes to the application code.

Answer

IP restrictions in the app’s web.config.

Answer

Client certificate authentication.

Answer

Shared access signatures (SAS) for the app URL.

Question 11

You develop an IoT solution using Azure IoT Hub. Devices send telemetry data that must be processed by a custom Azure Function. You need to ensure that the Function processes messages in order per device and exactly once. Which IoT Hub feature should you use?

Accepted Answer

Use IoT Hub's built-in Event Hub-compatible endpoint with a consumer group that has one partition per device.. IoT Hub's built-in Event Hub-compatible endpoint supports partitioning, and by using a consumer group with one partition per device, you can guarantee per-device ordering and exactly-once processing. The Event Hub model ensures that messages from the same device (same partition key) are delivered in order and can be checkpointed to avoid duplicates.

Answer

Use IoT Hub message routing to send messages to a Service Bus queue, and process from the queue.

Answer

Use IoT Hub direct methods to invoke the Function per device.

Answer

Use IoT Hub device twins to store telemetry and trigger the Function on twin changes.

Question 12

A developer writes an Azure Function that uses the Azure.Storage.Blobs SDK to upload a file to Blob Storage. The function runs locally but fails when deployed to Azure with a '403 Forbidden' error. What is the most likely cause?

Accepted Answer

The function app does not have the correct RBAC role on the storage account. The 403 Forbidden error when an Azure Function runs in Azure but not locally typically indicates an authorization failure. By default, Azure Functions use managed identity to access storage accounts, and the function app's system-assigned managed identity must be granted the appropriate RBAC role (e.g., Storage Blob Data Contributor) on the storage account. Without this role, the SDK's request to Blob Storage is denied, resulting in a 403.

Answer

The Azure.Storage.Blobs SDK version is deprecated

Answer

The function runtime version is incompatible

Answer

The storage account is behind a firewall and the function app's outbound IP is not whitelisted

Question 13

A company exposes an internal REST API to external partners using Azure API Management. They need to enforce a rate limit of 100 requests per minute per subscription. Which policy should they add?

Accepted Answer

Rate limit policy. The Rate limit policy (option B) is correct because it enforces a per-subscription key rate limit of 100 requests per minute, which is exactly what the scenario requires. Azure API Management's rate-limit policy counts requests against the specified duration and blocks additional calls once the limit is exceeded, returning a 429 Too Many Requests response.

Answer

CORS policy

Answer

Throttling policy

Answer

Validate JWT policy

Question 14

You are building a solution that uses Azure Cosmos DB for NoSQL. You need to implement a change feed processor to handle real-time updates. The application runs on multiple instances to ensure high availability. Which lease container configuration ensures that each instance processes a distinct set of partitions?

Accepted Answer

Use a separate lease container with partition key /id. The change feed processor uses a lease container to track which partitions each instance is processing. By setting the partition key to /id, each lease document is uniquely identified, allowing the processor to distribute partitions across instances. This ensures that each instance processes a distinct set of partitions, enabling horizontal scaling without duplication.

Answer

Set the partition key of the monitored container to /city

Answer

Configure the change feed to start from the beginning

Answer

Set the lease container's throughput to 1000 RU/s

Question 15

You are using Application Insights to monitor a web application. You notice that a specific request is slow. You want to see the complete end-to-end transaction details, including all dependency calls and exceptions for that single request. Which feature should you use?

Accepted Answer

Transaction Search (End-to-End Transaction Details). Transaction Search (End-to-End Transaction Details) is the correct feature because it allows you to view the complete trace of a single request, including all dependency calls (e.g., SQL, HTTP, Azure services), exceptions, and logs associated with that specific operation. This is achieved by correlating telemetry using the operation_Id field, which groups all telemetry items from the same request into a single end-to-end view. Other features like Metrics Explorer or Application Map provide aggregated or topological views, not per-request drill-down.

Answer

Metrics Explorer

Answer

Application Map

Answer

Live Metrics Stream