AZ-204 Practice Test 28 — 15 Questions

Question 1

You are building a solution that processes events from multiple Azure Event Hubs. Events must be dispatched to different downstream services based on the event type. You need a serverless solution that can handle high throughput and uses managed identity to authenticate to Event Hubs. Which Azure service should you use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Azure Functions (Event Hubs trigger) with managed identity. Azure Functions with an Event Hubs trigger supports managed identity authentication, enabling secure, passwordless connections to Event Hubs. It is a serverless, event-driven compute service that can scale to handle high throughput by processing events in parallel across multiple partitions. This makes it the ideal choice for dispatching events to downstream services based on event type.

Answer

Azure Stream Analytics

Answer

Azure Logic Apps (Event Hubs connector)

Answer

Azure Data Factory

Question 2

Your company uses Azure Key Vault to store secrets. You need to ensure that if a secret is deleted, it can be recovered within 30 days. Which Key Vault feature should you enable?

Accepted Answer

Soft-delete. Soft-delete is the correct feature because it allows you to recover a deleted secret within a configurable retention period (default 90 days, but can be set to as low as 1 day). When soft-delete is enabled, a deleted secret is marked as deleted but remains recoverable until the retention period expires. This directly meets the requirement to recover a secret within 30 days.

Answer

Purge protection

Answer

RBAC (Role-Based Access Control)

Answer

Access policies

Question 3

You are building an Azure Logic App that must send an email notification when a new file is added to a SharePoint Online document library. Which connector and trigger should you use?

Accepted Answer

Use the SharePoint connector with the 'When a file is created' trigger. The SharePoint connector's 'When a file is created' trigger is the correct choice because it directly monitors a SharePoint Online document library for new file additions and initiates the Logic App workflow automatically. This trigger uses SharePoint's webhook capabilities to receive real-time notifications, eliminating the need for polling or manual intervention.

Answer

Use the Office 365 Outlook connector with the 'When a new email arrives' trigger

Answer

Use the Azure Blob Storage connector with the 'When a blob is added or modified' trigger

Answer

Use the HTTP connector with a manual trigger and poll SharePoint's REST API

Question 4

You are deploying a microservice to Azure Container Apps. The service requires a custom domain and SSL/TLS certificate. Which resource should you configure to meet these requirements?

Accepted Answer

Azure Container Apps environment with a custom domain and certificate attached. Azure Container Apps allows you to attach a custom domain and upload an SSL/TLS certificate directly at the environment level, which is the correct approach for securing a microservice with a custom domain. This configuration ensures that the Container App responds to HTTPS requests on your domain without needing an additional front-end service.

Answer

Azure Front Door with a custom domain

Answer

Azure API Management in front of the Container App

Answer

Azure Application Gateway with SSL termination

Question 5

You need to monitor the CPU utilization of an Azure VM in real-time and set up an alert when it exceeds 90%. Which Azure Monitor feature should you use?

Accepted Answer

Metrics Explorer. Metrics Explorer is the correct Azure Monitor feature for real-time monitoring of CPU utilization on an Azure VM because it provides near real-time metric collection (typically every 1 minute) and supports alerting based on threshold conditions. It allows you to chart performance counters like Percentage CPU and configure metric alerts that trigger when the value exceeds 90%.

Answer

Log Analytics Workspace

Answer

Application Insights

Answer

Azure Monitor for VMs

Question 6

A company uses Azure Functions with a consumption plan. The function processes messages from a queue. During peak hours, the function takes longer to execute, and some messages are processed twice. What is the most likely cause?

Accepted Answer

The queue message visibility timeout is shorter than the function processing time.. In Azure Functions with a consumption plan, the queue message visibility timeout determines how long a message is invisible to other consumers after being dequeued. If the function's processing time exceeds this visibility timeout, the message becomes visible again and can be picked up by another function instance, leading to duplicate processing. This is the most likely cause of messages being processed twice during peak hours when execution times increase.

Answer

The function timeout is set too low.

Answer

The function uses blob output binding incorrectly.

Answer

The function app is using a premium plan instead of consumption.

Question 7

A company deploys a web application to Azure App Service. They want to deploy a new version of the app with zero downtime and the ability to quickly roll back if needed. Which deployment feature should they use?

Accepted Answer

Deployment slots. Deployment slots are separate, live environments within Azure App Service that allow you to stage a new version of your app, perform validation, and then swap it into production with zero downtime. The swap operation ensures all traffic is redirected instantly, and if issues arise, you can immediately swap back to the previous slot for a quick rollback.

Answer

Auto-scaling

Answer

Traffic Manager

Answer

Application Insights

Question 8

A Cosmos DB workload for telemetry events has predictable traffic during business hours and almost no traffic overnight. The team wants to reduce cost while keeping performance during peak hours. What should be configured?

Accepted Answer

Autoscale throughput with an appropriate maximum RU/s. Autoscale throughput (option B) is correct because it dynamically scales the provisioned RU/s between 10% of the configured maximum and the maximum itself based on actual demand. For a workload with predictable peak traffic during business hours and near-zero traffic overnight, autoscale eliminates the cost of provisioning for peak capacity 24/7 while ensuring performance is not throttled during high-demand periods. This directly addresses the cost-reduction goal without sacrificing peak-hour performance.

Answer

Analytical store only

Answer

Manual throughput set permanently to peak RU/s

Answer

Disable indexing entirely

Question 9

You have an Azure Storage account that hosts blobs for a public website. You need to grant a partner application read-only access to a specific container for 24 hours without using a storage account key. What should you create?

Accepted Answer

A shared access signature (SAS) URI with read permission and expiry set to 24 hours. A shared access signature (SAS) URI with read permission and a 24-hour expiry provides time-limited, delegated access to a specific container without exposing the storage account key. This meets the requirement for read-only access for exactly 24 hours, as the SAS token can be scoped to a single container and its permissions set to read.

Answer

An access policy for the container with read permission

Answer

A storage account key

Answer

A managed identity for the partner application

Question 10

You manage a set of APIs using Azure API Management (APIM). One backend API requires an API key passed in the 'X-API-Key' header. The API key is stored securely in a named value in APIM. You need to configure APIM to add this header to all requests to that backend without exposing the key to API consumers. Which policy should you add to the inbound processing for that API?

Accepted Answer

set-header. The 'set-header' policy in Azure API Management allows you to add, modify, or remove HTTP headers on requests or responses. By placing this policy in the inbound processing section, you can inject the 'X-API-Key' header with the value retrieved from a named value (using the '{{NamedValue}}' syntax) without exposing the key to API consumers, as the policy executes on the gateway side.

Answer

set-backend-service

Answer

authentication-basic

Answer

validate-jwt

Question 11

You are developing a microservices application that needs to send messages between services asynchronously. Which Azure service should you use to decouple the components and ensure reliable message delivery?

Accepted Answer

Azure Service Bus. Azure Service Bus is a fully managed enterprise message broker that provides advanced features crucial for robust microservices architectures, such as message sessions for guaranteed ordering (FIFO), dead-lettering for error handling, duplicate detection, and transactional processing. These features enhance reliability and manageability beyond the basic at-least-once delivery offered by Azure Queue Storage, making it a more comprehensive solution for decoupling components and ensuring reliable message delivery in complex microservices applications.

Answer

Azure Cosmos DB

Answer

Azure Queue Storage

Answer

Azure Event Hubs

Question 12

You are developing an Azure Functions app that processes orders. The function must scale out automatically during peak hours but should not incur costs when idle. Which hosting plan should you use?

Accepted Answer

Consumption plan. The Consumption plan is correct because it automatically scales your function app based on demand, including scaling out to handle peak loads, and you only pay for execution time and resources consumed when your functions are running. When idle, there are no costs because the plan does not reserve any instances; it relies on a dynamic, event-driven scale model that can scale down to zero.

Answer

Premium plan

Answer

Container Instances

Answer

App Service plan

Question 13

You are developing a serverless function app that processes credit card payments. The function app must securely store the payment gateway API key. Which Azure service should you use to store the key?

Accepted Answer

Store the key in Azure Key Vault and retrieve it using a managed identity.. Azure Key Vault is the designated service for securely storing and managing secrets, keys, and certificates. By using a managed identity, the function app can authenticate to Key Vault without embedding any credentials in code or configuration, ensuring the API key is never exposed in plaintext.

Answer

Store the key in an Azure Storage queue and read it at runtime.

Answer

Store the key in Azure Cosmos DB with client-side encryption.

Answer

Store the key in the function app's application settings.

Question 14

Your application uses Azure Blob Storage to store images. You need to automatically move blobs older than 30 days to the Cool tier and delete blobs older than 365 days. What should you implement?

Accepted Answer

Azure Blob Storage lifecycle management policy. Azure Blob Storage lifecycle management policies allow you to define rules that automatically transition blobs to cooler tiers (e.g., Cool) after a specified number of days and delete them after a different number of days. This is the native, cost-effective, and fully managed solution for automating tier transitions and deletions based on blob age, without requiring external compute or orchestration services.

Answer

Azure Automation runbook on a schedule

Answer

Azure Logic Apps with recurrence trigger

Answer

Azure Event Grid subscription with blob created event

Question 15

A retail system uses Azure Service Bus to process orders. Each order has multiple messages (e.g., payment, shipping, confirmation) that must be processed in sequence. You need to guarantee that all messages belonging to the same order are handled by the same consumer in order. Which Service Bus feature should you use?

Accepted Answer

Sessions. Sessions in Azure Service Bus enable ordered, first-in-first-out (FIFO) processing of related messages. By setting the SessionId property to the order ID, all messages for that order are grouped into a session, ensuring a single consumer processes them sequentially. This guarantees that payment, shipping, and confirmation messages for the same order are handled in order and by the same consumer.

Answer

Scheduled messages

Answer

Dead-letter queue

Answer

Auto-forwarding