AZ-204 Practice Test 27 — 15 Questions

Question 1

A company uses Azure Cosmos DB for a global e-commerce platform. They need to query product inventory across multiple regions with low latency. The data is partitioned by product category. Some queries filter on category and price range. What indexing policy should be configured to optimize these queries?

Accepted Answer

Create a composite index with (category, price).. A composite index on (category, price) (option B) allows efficient range queries on price within a category. Option A uses separate indexes which may require composite index for range. Option C is too broad. Option D is not a valid index type.

Answer

Use a wildcard index for all properties.

Answer

Add a hash index on category and a range index on price.

Answer

Enable spatial index on price.

Question 2

Refer to the exhibit. An Azure App Service deployment is configured using this ARM template snippet. The web app is built from a GitHub repository. However, when a pull request is merged to main, the app does not automatically deploy. What is the most likely cause?

Accepted Answer

The GitHub Actions workflow file is missing from the repository.. The GitHub Actions configuration is set but the ARM template does not include a workflow file path. The most likely issue is missing a GitHub Actions workflow file in the repo (option C). Option A: isManualIntegration is false, so it should be automated. Option B: runtime is correct. Option D: branch is main, which is typical.

Answer

The isManualIntegration property is set to false.

Answer

The runtime stack is incorrect for the application.

Answer

The branch is set to main, but the deployments only trigger on a different branch.

Question 3

You are developing a microservice that needs to publish events to multiple subscribers. Each subscriber should receive the event independently and at its own pace. The event must be retained for up to 7 days. Which Azure messaging service should you use?

Accepted Answer

Azure Event Grid. Option D is correct because Event Grid supports event publishing to multiple subscribers, each receiving the event independently, and has a retention period of up to 7 days by default (configurable up to 7 days). Option A is wrong because Service Bus queues are for point-to-point communication, not pub/sub. Option B is wrong because Event Hubs is for streaming large volumes of data, not for discrete event fan-out. Option C is wrong because Service Bus topics support pub/sub, but the default retention is up to 14 days, but the requirement is for 7 days; however, Event Grid is more appropriate for discrete events and has simpler integration.

Answer

Azure Service Bus queue

Answer

Azure Service Bus topic

Answer

Azure Event Hubs

Question 4

You are designing a solution to send email notifications from an Azure App Service web app. The app must use a third-party email service that requires an API key. You need to minimize management overhead and ensure the key is rotated automatically. What should you do?

Accepted Answer

Store the API key in Azure Key Vault and use a managed identity to retrieve it. Azure Key Vault can store the API key, and the app can use a managed identity to retrieve it. Key Vault supports automatic rotation of secrets. Option A is wrong because storing in app settings is not secure and does not rotate automatically. Option B is wrong because managed identities do not store secrets directly. Option D is wrong because the Logic App adds unnecessary overhead.

Answer

Use a system-assigned managed identity to authenticate to the email service

Answer

Store the API key in the App Service application settings

Answer

Create an Azure Logic App to send emails and call it from the web app

Question 5

Refer to the exhibit. The exhibit shows an Azure Event Grid subscription configuration. You notice that the webhook endpoint is not receiving events when a .png file is uploaded to the 'images' container. What is the most likely reason?

Accepted Answer

The subject filter excludes .png files. The filter 'subjectEndsWith' is set to '.jpg', so only .jpg files trigger events. .png files do not match. Option A is wrong because the subscription is enabled. Option B is wrong because the endpoint type is WebHook. Option D is wrong because there is no authentication configured in the exhibit, but that would affect all events, not just .png.

Answer

The subscription is disabled

Answer

The destination endpoint type is incorrect

Answer

The webhook endpoint requires authentication

Question 6

You are implementing Azure API Management (APIM) to expose a legacy SOAP service as a modern REST API. The SOAP service requires WS-Security UsernameToken authentication. How should you configure APIM to handle this?

Accepted Answer

Use a 'set-header' policy to add the WS-Security UsernameToken to the backend request.. APIM can transform SOAP to REST using policies. For WS-Security, you can use the 'set-header' policy to add the UsernameToken. Option C is correct because you need to pass credentials to the backend. Option A is not possible; Option B is not needed; Option D is for OAuth.

Answer

Use the 'convert-soap-to-rest' policy and configure OAuth2 for the backend.

Answer

Create a custom connector in Power Automate and import it to APIM.

Answer

Configure APIM with a client certificate and use the 'validate-client-certificate' policy.

Question 7

You are querying Azure Monitor metrics using Kusto Query Language (KQL). The query is supposed to return average metric values per hour per resource provider, but it returns no results. What is the most likely issue?

Accepted Answer

The table name should be 'AzureMetrics' instead of 'metrics'.. The query uses 'metrics' table, but Azure Monitor metrics are stored in the 'AzureMetrics' table. Option C is correct. Option A is incorrect because bin is valid; Option B is incorrect because GROUP BY works with bin; Option D is incorrect because ORDER BY is fine.

Answer

The ORDER BY clause should be before GROUP BY.

Answer

The 'bin' function is used incorrectly; it should be 'bin(TimeGenerated, 1h)' without the alias.

Answer

The GROUP BY clause cannot include a computed column like 'bin'.

Question 8

Your Azure App Service app uses SignalR Service to push real-time updates to clients. You notice that some clients are disconnected after 30 minutes of inactivity. What is the most likely cause and solution?

Accepted Answer

The Azure SignalR Service has a default client timeout of 30 minutes; configure the ClientTimeout setting in the SignalR service. Option B is correct because Azure SignalR Service has a default client timeout of 30 minutes; it can be increased. Option A is wrong because the default is 30 minutes. Option C is wrong because serverless mode does not affect timeout. Option D is wrong because app service plan does not limit SignalR connections directly.

Answer

The app service plan is scaled down, causing idle connections to drop

Answer

The app service plan has an idle timeout of 30 minutes

Answer

The SignalR service is in serverless mode, which disconnects idle clients

Question 9

A company runs a microservices application on Azure Kubernetes Service (AKS). One service needs to securely access an Azure SQL Database. The solution should avoid storing connection strings in code or configuration. What should they use?

Accepted Answer

Azure AD Pod Identity (aad-pod-identity). Azure AD Pod Identity (option D) assigns an Azure AD identity to pods, allowing them to authenticate to Azure SQL without secrets. Option A uses secrets which are stored in Kubernetes. Option B uses managed identities at the VM level, not pod level. Option C uses Azure Key Vault but still requires initial secret retrieval.

Answer

Azure Key Vault with a secret store CSI driver

Answer

Virtual machine managed identity

Answer

Kubernetes secrets

Question 10

Refer to the exhibit. You are deploying an API in Azure API Management using an ARM template. The API is configured to use OAuth 2.0 authentication. The deployment fails with a validation error. What is the most likely cause?

Accepted Answer

The authorization server 'auth-server-1' is not defined in the template.. The dependsOn references an authorization server, but the authorization server resource might not be defined in the template (option C). Option A: protocols is correct. Option B: serviceUrl is valid. Option D: dependsOn syntax is correct.

Answer

The serviceUrl is not a valid URL.

Answer

The dependsOn array uses resourceId incorrectly.

Answer

The protocols array does not include http.

Question 11

You are using Azure Cognitive Search to index documents stored in Azure Blob Storage. The indexer is failing with the error 'Data source credentials are invalid.' You have verified that the connection string for the storage account is correct. What is the most likely cause?

Accepted Answer

The storage account is behind a firewall and the Cognitive Search service IP is not allowed.. Option A is correct because if the storage account is behind a firewall, the Cognitive Search service must be granted access via firewall rules or by using a managed identity with appropriate permissions. The suggested resolution is to add the Cognitive Search service's IP address to the storage account firewall rules. Option B is wrong because the indexer does not require the search service to be in the same region. Option C is wrong because the indexer uses the storage account connection string, not a search service key, to access the data source. Option D is wrong because the indexer configuration does not need to specify the storage account key separately if using a connection string.

Answer

The Cognitive Search service is in a different region than the storage account.

Answer

The Cognitive Search service's admin key is missing.

Answer

The indexer configuration is missing the storage account key.

Question 12

A company uses Azure Functions to process messages from Azure Service Bus. The function needs to scale out during high load. Which consumption plan should you choose to enable automatic scaling?

Accepted Answer

Consumption plan. The Consumption plan automatically scales based on the number of incoming messages. Option A is wrong because App Service plan requires manual scaling. Option B is wrong because Premium plan also scales but has additional features; however, the question asks for automatic scaling, which both achieve, but Consumption is the simplest. Option D is wrong because Logic Apps is a different service.

Answer

Logic Apps plan

Answer

Premium plan

Answer

App Service plan

Question 13

Refer to the exhibit. You executed the Azure CLI command to create a storage account. Later, you attempt to connect from an application that uses TLS 1.1. The connection fails. What is the most likely reason?

Accepted Answer

The minimum TLS version is set to 1.2, blocking TLS 1.1. The '--min-tls-version 1.2' parameter sets the minimum TLS version to 1.2, so TLS 1.1 is rejected. Option A is wrong because Standard_GRS is geo-redundant storage, which is available. Option B is wrong because the kind StorageV2 supports blobs. Option D is wrong because the location eastus is valid.

Answer

The storage account uses Standard_GRS replication which is not accessible from all clients

Answer

The storage account is in a different location than the client

Answer

The storage account kind is StorageV2 which does not support blobs

Question 14

You develop an IoT solution using Azure IoT Hub. Devices send telemetry data that must be processed by a custom Azure Function. You need to ensure that the Function processes messages in order per device and exactly once. Which IoT Hub feature should you use?

Accepted Answer

Use IoT Hub's built-in Event Hub-compatible endpoint with a consumer group that has one partition per device.. IoT Hub's Event Hub-compatible endpoint supports consumer groups, but for ordered processing per device, you need to partition by device ID. Option D is correct because using the built-in endpoint with a consumer group per partition ensures ordering. Option A does not guarantee exactly once; Option B is for device management; Option C is for cloud-to-device.

Answer

Use IoT Hub message routing to send messages to a Service Bus queue, and process from the queue.

Answer

Use IoT Hub direct methods to invoke the Function per device.

Answer

Use IoT Hub device twins to store telemetry and trigger the Function on twin changes.

Question 15

You run the above PowerShell script to upload a blob to Azure Storage. The script fails with an error. Which part of the script is causing the failure?

Accepted Answer

The -File parameter should be a file path, not a string.. The Set-AzStorageBlobContent -File parameter expects a file path, not a string. Option B is correct. Option A is fine; Option C is fine; Option D is fine.

Answer

The storage account name 'mystorageaccount' is invalid.

Answer

The connection string format is incorrect.

Answer

The container name 'mycontainer' does not exist.