AZ-204 Practice Test 27 — 15 Questions

Question 1

Which TWO actions can you take to improve the performance of an Azure App Service web app that makes calls to an external API? (Choose two.)

Accepted Answer

Use async/await patterns in the code to avoid blocking threads.. Options D and E are correct. Caching responses with Azure Cache for Redis reduces redundant API calls, improving performance. Using async/await patterns prevents blocking threads, allowing the web app to handle more concurrent requests efficiently. Option A (connection pooling) can help but is not as directly impactful for performance in this scenario. Option B (parallel requests) may increase load on the API without guaranteed performance gain. Option C (scaling out) increases capacity but does not improve per-request latency or reduce redundant calls.

Answer

Use a connection pool to reuse connections to the API.

Answer

Send multiple requests in parallel to the API.

Answer

Scale out the App Service to more instances.

Question 2

You are developing an application that needs to store and retrieve large binary objects (up to 5 TB) in Azure Blob Storage. The application requires the ability to access data from any URL via HTTP/HTTPS. Which Blob Storage access tier should you use?

Accepted Answer

Hot. The Hot access tier is optimized for frequent read and write access to data, supports objects up to 5 TB, and allows access via HTTP/HTTPS from any URL. It is the only tier that combines low-latency access, high throughput, and public internet accessibility without requiring rehydration or special permissions, making it suitable for general-purpose blob storage scenarios.

Answer

Archive

Answer

Cool

Answer

Premium

Question 3

A queue-processing application stores work items in Azure Queue Storage. A worker crashes after receiving a message. What determines when the message becomes available for another worker?

Accepted Answer

Visibility timeout. When a worker receives a message from Azure Queue Storage, the message becomes invisible to other workers for a period defined by the visibility timeout. If the worker crashes without deleting or updating the message, the visibility timeout expires and the message reappears in the queue, making it available for another worker to process. This mechanism ensures at-least-once processing and prevents message loss on worker failure.

Answer

Blob lease duration

Answer

Message TTL only

Answer

Poison queue threshold only

Question 4

You are developing an ASP.NET Core web API that authenticates users via Microsoft Entra ID. The application needs to authorize access to resources based on custom roles (e.g., 'Admin', 'Editor') that are not present in Microsoft Entra ID. The role mappings are dynamic and stored in an application database. How should you implement authorization?

Accepted Answer

Store the role mappings in an Azure SQL Database and use a custom authorization policy that queries the database after authentication.. The custom roles are dynamic and stored in an application database, not in Microsoft Entra ID. After authentication, a custom authorization policy can query the database to retrieve the role mappings for the authenticated user and enforce access control. This approach decouples role management from the identity provider and supports dynamic role assignments.

Answer

Define the roles as Microsoft Entra ID app roles and include them in the token claims.

Answer

Include the roles as claims in the Microsoft Entra ID token by using a custom claim mapping policy.

Answer

Store the role mappings in the web.config file and read them at runtime.

Question 5

You are investigating a slow API call in your Azure web app. Application Insights shows that the request took 10 seconds. You need to view all the dependencies (database calls, external HTTP requests) that contributed to this request. What should you use?

Accepted Answer

Transaction Search. Transaction Search (now part of the 'Search' experience in Application Insights) allows you to query individual requests and drill into their correlated dependency calls, such as SQL queries or external HTTP requests, showing the exact duration and sequence of each dependency. This is the correct tool to identify which specific dependencies contributed to the 10-second request latency.

Answer

Application Map

Answer

Live Metrics

Answer

Usage Analysis

Question 6

You are developing an API that uses managed identity to access Azure Key Vault. The API runs in an Azure App Service with system-assigned managed identity enabled. You need to retrieve a secret value. Which API endpoint should your code call?

Accepted Answer

https://myvault.vault.azure.net/secrets/{secret-name}?api-version=7.0. It uses the full Key Vault REST API endpoint with the specific vault name ('myvault'), the 'secrets' resource path, the secret name, and the required 'api-version' query parameter (7.0). The managed identity in the App Service authenticates via Azure AD, and the code must call this specific endpoint to retrieve the secret value, as the vault name is part of the DNS name and the API version is mandatory.

Answer

https://vault.azure.net/secrets/{secret-name}

Answer

https://login.microsoftonline.com/{tenant}/oauth2/token

Answer

https://management.azure.com/subscriptions/{sub}/...

Question 7

You are developing a web API hosted on Azure App Service. The API must authenticate requests using Microsoft Entra ID OAuth 2.0 bearer tokens. You want to validate the token in your ASP.NET Core API code with minimal custom validation logic. Which library should you use?

Accepted Answer

Microsoft.Identity.Web. Microsoft.Identity.Web is the correct choice because it provides a high-level, opinionated library that integrates directly with ASP.NET Core's authentication pipeline, handling token validation, scopes, and app roles with minimal custom code. It abstracts away the complexity of JWT bearer token validation against Microsoft Entra ID, including automatic OpenID Connect discovery and token signature verification.

Answer

Microsoft Authentication Library (MSAL)

Answer

Azure Identity client library

Answer

Azure Management Libraries for .NET

Question 8

An Azure web app is experiencing high memory usage. You want to collect memory dumps periodically to analyze the issue without restarting the app. Which Azure App Service diagnostic feature should you use?

Accepted Answer

Application Snapshot Debugger. The Application Snapshot Debugger captures memory dumps (snapshots) of a production web app when an exception occurs or when configured to trigger on specific conditions, such as high memory usage, without restarting the app. It is specifically designed for debugging memory leaks and high CPU/memory issues in Azure App Service by providing detailed snapshots of the process state, including the heap, at the point of interest. While not strictly time-based periodic, if the high memory condition occurs repeatedly, the debugger can be configured to capture multiple snapshots over time for analysis.

Answer

Application Insights Profiler

Answer

Diagnostic Settings

Answer

Auto-healing

Question 9

You are designing a solution that uses Azure Functions to process messages from an Azure Service Bus queue. Which TWO configurations can improve the throughput of the function?

Accepted Answer

Set maxMessagesPerBatch to a higher value. Increasing maxMessagesPerBatch allows the function to retrieve and process more messages in a single batch, reducing the overhead of multiple fetch operations. Decreasing newBatchThreshold makes the trigger fetch a new batch sooner when fewer messages remain, keeping the function busy and reducing idle time, which improves throughput.

Answer

Set maxDeliveryCount to a higher value

Answer

Set maxMessagesPerBatch to a lower value

Answer

Set maxEventBatchSize to a higher value

Question 10

You need to deploy a container that runs a simple web server on Azure Container Instances. The container should be accessible via a public IP address. Which property should you set in the container group configuration?

Accepted Answer

ipAddress.type = "Public". To make a container group accessible from the internet via a public IP address, you must set the `ipAddress.type` property to `"Public"`. This instructs Azure Container Instances to assign a public IP and optionally a fully qualified domain name (FQDN) to the container group, allowing inbound traffic from the internet to reach the container's exposed ports.

Answer

osType = "Linux"

Answer

restartPolicy = "Always"

Answer

volumes.mountPath = "/mnt"

Question 11

A developer deleted a secret from Azure Key Vault with soft-delete and purge protection enabled (retention 90 days). After 50 days, the secret is needed again. What is the correct recovery method?

Accepted Answer

Recover the secret using Azure CLI 'az keyvault secret recover'. Azure Key Vault with soft-delete and purge protection enabled retains deleted secrets for the specified retention period (90 days in this case). Since only 50 days have passed, the secret is still in a soft-deleted state and can be recovered using the 'az keyvault secret recover' command, which restores the secret to its original state without data loss.

Answer

Purge the secret and then restore from a backup

Answer

Recreate the secret with the same name

Answer

Use an Azure Resource Manager template to undelete the secret

Question 12

A developer needs to store a large number of binary files (images) that are accessed frequently from a web app. Which Azure storage solution is most cost-effective?

Accepted Answer

Azure Blob Storage. Azure Blob Storage is the most cost-effective solution for storing large numbers of binary files like images because it is optimized for massive scale, high-throughput, and low-cost object storage. It supports hot, cool, and archive access tiers to balance cost and access frequency, and it integrates directly with web apps via HTTP/HTTPS REST APIs or SDKs, making it ideal for frequently accessed static content.

Answer

Azure Queue Storage

Answer

Azure Files

Answer

Azure Cosmos DB

Question 13

You are developing an application that writes logs to Azure Blob Storage. Each log entry is small (less than 1 KB) and you need to store millions of entries per day. You want to minimize storage costs and maximize write throughput. Which blob type should you use?

Accepted Answer

Append blobs.. Append blobs are optimized for append operations, making them ideal for logging scenarios where each log entry is appended to the blob. They provide high throughput for write-heavy, sequential append workloads and are cost-effective because they use the same block blob pricing but avoid the overhead of managing individual blocks for each small entry.

Answer

Block blobs with a high block size.

Answer

Page blobs.

Answer

Block blobs with a low block size.

Question 14

You manage an API in Azure API Management. You need to enforce a rate limit of 200 requests per minute for each subscription key. Which policy should you include in the inbound policy section?

Accepted Answer

policy. The policy in Azure API Management is specifically designed to enforce a per-subscription key rate limit, such as 200 requests per minute. It operates on a sliding window counter to smooth traffic and is applied in the inbound section to evaluate each request before it reaches the backend. This matches the requirement exactly.

Answer

<quota> policy

Answer

<limit-concurrency> policy

Answer

<throttle> policy

Question 15

Your company has a multi-tier application running on Azure Virtual Machines. The application experiences high CPU usage during peak hours. You need to implement autoscaling for the virtual machine scale set based on CPU usage. The scaling should be aggressive when CPU exceeds 80% and conservative when CPU drops below 30%. Which scaling rule configuration should you use?

Accepted Answer

Scale out when CPU > 80%, scale in when CPU < 30%. The question explicitly requires aggressive scaling when CPU exceeds 80% and conservative scaling when CPU drops below 30%. The scale-out threshold of 80% triggers rapid addition of instances to handle high load, while the scale-in threshold of 30% ensures instances are removed only when utilization is consistently low, preventing premature scale-in and thrashing. This matches the exact thresholds specified in the requirement.

Answer

Scale out when CPU > 50%, scale in when CPU < 20%

Answer

Scale out when CPU > 90%, scale in when CPU < 10%

Answer

Scale out when CPU > 70%, scale in when CPU < 70%