AZ-204 Practice Test 28 — 15 Questions

Question 1

Which TWO authentication mechanisms can be used to authenticate an Azure Function to Azure Storage?

Accepted Answer

Storage account connection string with account key. Options A and D are correct. Managed identity and connection strings with account key are supported. Option B is wrong because SAS tokens are for delegated access, not function identity. Option C is wrong because certificate authentication is not supported for Storage. Option E is wrong because Azure AD token is used with managed identity, not directly.

Answer

Client certificate

Answer

Shared access signature (SAS) token

Answer

Azure AD token acquired via client credentials flow

Question 2

A developer is building a function app that processes messages from an Azure Storage queue. The function must scale automatically based on queue length. Which hosting plan supports this automatic scaling?

Accepted Answer

Consumption plan. Consumption plan (option D) automatically scales based on triggers. Premium plan (A) also scales but has pre-warmed instances. App Service plan (B) does not auto-scale based on queue length. Container Instances (C) is not for functions.

Answer

Premium plan

Answer

App Service plan

Answer

Azure Container Instances

Question 3

Refer to the exhibit. An Azure OpenAI Service account is deployed with this ARM template. After deployment, a developer tries to call the OpenAI endpoint from an Azure App Service that has no public IP. The request is blocked. What change should be made to allow access?

Accepted Answer

Configure a private endpoint for the OpenAI account.. The network ACLs only allow a specific IP range. To allow an Azure service without a public IP, you should use a private endpoint (option D). Option A is correct but not listed; option B: changing defaultAction to Allow would allow all traffic, which is insecure. Option C: adding the App Service's outbound IP is not reliable due to dynamic IPs. Option D is the best practice.

Answer

Add a service tag for App Service in the ipRules.

Answer

Change the defaultAction to Allow.

Answer

Add the App Service's outbound IP address to the ipRules.

Question 4

Refer to the exhibit. You are deploying an ARM template that includes the above network security group rule. The rule is intended to block all outbound internet traffic from a virtual network. However, after deployment, virtual machines in the subnet still have outbound internet access. What is the most likely reason?

Accepted Answer

The network security group is not associated with the subnet or network interface.. Option C is correct because the rule has a priority of 100, which is a high priority number (lowest priority). By default, Azure NSGs allow outbound internet traffic with a default rule (AllowInternetOutbound) that has a priority of 65001. Since 100 is lower than 65001, the deny rule should take precedence. However, the issue is that the rule uses 'VirtualNetwork' as the source address prefix, which means it only applies to traffic from the virtual network itself, not to traffic originating from VMs. Actually, the exhibit shows sourceAddressPrefixes as 'VirtualNetwork', which is correct for traffic from the VNet. But the problem is that the rule's priority is 100, which is higher than the default allow rule (65001), so it should work. Wait, let's re-evaluate: priority numbers are lower = higher priority. A priority of 100 means it is evaluated before the default rule (65001). So the rule should block outbound internet. However, the rule might not be applied because the NSG is not associated with the subnet or NIC. But the exhibit only shows the rule definition. The most likely reason from the options is that the NSG is not associated with the subnet or NIC. Option A is wrong because priority 100 is higher than default rules. Option B is wrong because the rule does apply to VMs in the VNet. Option D is wrong because the rule does not need to specify source port ranges. So Option C is correct.

Answer

The destination port range '*' is invalid; you must specify explicit ports.

Answer

The source address prefix should be '*' instead of 'VirtualNetwork'.

Answer

The rule priority is too low; it should be lower than the default allow rule.

Question 5

You are developing a microservice that processes images. After processing, it needs to store the result in Azure Blob Storage and send a message to Azure Service Bus for further processing. Which Azure SDK client should you use to minimize overhead?

Accepted Answer

Use the Azure.Storage.Blobs and Azure.Messaging.ServiceBus NuGet packages. The Azure SDK for .NET provides client libraries for Blob Storage and Service Bus that are optimized for performance and low overhead. Option A is wrong because REST APIs require manual HTTP handling. Option B is wrong because SignalR is for real-time messaging, not queues. Option C is wrong because Functions are compute, not client libraries.

Answer

Deploy the microservice as an Azure Function

Answer

Call the Azure REST APIs directly using HttpClient

Answer

Use Azure SignalR Service for messaging

Question 6

An application uses Azure Functions with a Durable Functions extension to orchestrate a workflow. The workflow calls multiple external APIs. The developer needs to handle transient failures when calling these APIs. Which pattern should the developer implement?

Accepted Answer

Implement retry logic with exponential backoff. Option A is correct because automatic retry with exponential backoff is a best practice for transient faults. Option B is incorrect because circuit breaker is for preventing repeated calls to a failing service, but it doesn't handle retries. Option C is incorrect because the request-reply pattern is for messaging, not for handling failures. Option D is incorrect because the saga pattern is for distributed transactions, not for retries.

Answer

Use a saga pattern

Answer

Use a request-reply pattern

Answer

Use a circuit breaker pattern

Question 7

You are designing a microservices architecture where each service needs to publish events to multiple subscribers. You choose Azure Event Grid. However, one of the subscribers is a third-party service that requires HTTPS endpoint and custom headers in the event delivery. How should you configure Event Grid?

Accepted Answer

Set custom headers in the event subscription's 'Delivery Properties' configuration.. Event Grid supports custom headers in event subscriptions via the 'includedEventTypes' and 'subjectBeginsWith' filters, but for custom headers, you need to use the 'Advanced Filter' or 'Delivery Properties'. Option C is correct because you can set custom headers in the event subscription. Option A is not supported; Option B is for dead-lettering; Option D is for filtering.

Answer

Use Event Grid's 'Advanced Filters' to add custom headers to events.

Answer

Use Event Grid domains to route events to the third-party service.

Answer

Configure a dead-letter destination to handle delivery failures.

Question 8

A web app running on Azure App Service must integrate with Microsoft Graph API to read user profiles. The app is registered in Microsoft Entra ID and uses the OAuth 2.0 authorization code flow. However, after deployment, the app fails to acquire tokens. What is the most likely cause?

Accepted Answer

The redirect URI is not configured in the app registration. Option C is correct because redirect URIs must be registered in the app registration to match the application's reply URL. Option A is wrong because the client secret is correct. Option B is wrong because API permissions are granted. Option D is wrong because the app uses authorization code flow, not client credentials.

Answer

The API permission for User.Read is not granted

Answer

The app is using the client credentials flow instead of authorization code flow

Answer

The client secret is expired

Question 9

Which TWO are best practices for securing an Azure API Management instance?

Accepted Answer

Require subscription keys for all APIs. Options A and D are correct. Using subscription keys and OAuth 2.0 are best practices. Option B is wrong because sharing keys is insecure. Option C is wrong because public endpoints are not recommended. Option E is wrong because rate limiting is for throttling, not security.

Answer

Expose the management endpoint publicly for easy configuration

Answer

Set rate limits to prevent brute force attacks

Answer

Share API keys with partners via email

Question 10

A company integrates an Azure Logic App with Microsoft Teams to send notifications when a new file is added to an Azure Blob storage container. The Logic App currently polls the blob container every minute. They want to reduce latency and avoid polling. What should they do?

Accepted Answer

Add an Event Grid subscription to the blob storage.. Using an Event Grid subscription (option B) triggers the Logic App on blob creation events, eliminating polling. Option A increases frequency but still polls. Option C uses Service Bus which adds overhead. Option D is for data factory, not Logic Apps.

Answer

Increase the polling frequency to every 10 seconds.

Answer

Use Azure Data Factory to monitor the storage.

Answer

Use Azure Service Bus topics for file notifications.

Question 11

You are configuring an Azure Event Grid subscription to trigger an Azure Function when a blob is created in a storage account. However, the function is not being triggered. You have verified that the function endpoint is reachable and the storage account is in the same region. What is the most likely cause?

Accepted Answer

The Event Grid subscription does not have the required RBAC role on the function.. Option C is correct because Event Grid requires explicit permission to invoke the function endpoint. If the Event Grid subscription's managed identity or service principal does not have the 'EventGrid Data Sender' role on the function, the invocation will fail silently. Option A is wrong because Event Grid can trigger functions even with public network access disabled as long as private endpoints are configured. Option B is wrong because the AzureWebJobsStorage connection string is for function runtime storage, not for Event Grid triggers. Option D is wrong because blob versioning is not required for Event Grid triggers.

Answer

The storage account has public network access disabled.

Answer

The AzureWebJobsStorage connection string is missing from the function app settings.

Answer

Blob versioning is not enabled on the storage account.

Question 12

Refer to the exhibit. You are configuring Azure Monitor autoscale for a virtual machine scale set using the above JSON metric configuration. The autoscale rule is supposed to scale out when average memory usage exceeds 80%. However, autoscale is not triggering even when memory usage is consistently above 90%. What is the most likely cause?

Accepted Answer

The autoscale rule condition is not configured to use this metric.. Option B is correct because the exhibit shows that the aggregation interval is set to 00:05:00 (5 minutes) and the aggregation type is Average. Autoscale rules use the aggregated metric over the specified duration. If the duration is not configured correctly, the rule may not trigger. However, a common issue is that the memory metric is not available or not collected. But from the exhibit, it seems the metric is defined. Another possibility is that the autoscale rule's threshold is defined in a separate configuration. The exhibit only shows the metric definition, not the actual autoscale rule condition. The most likely cause from the options is that the autoscale rule is not associated with the scale set or the metric is not being emitted. Option A is wrong because the aggregation interval is 5 minutes, which is valid. Option C is wrong because the aggregation type is Average, which is appropriate. Option D is wrong because the metric name is 'MemoryPercent', which is a valid metric for VMs (if collected). However, the exhibit does not show the autoscale rule condition; it only shows the metric configuration for a custom metric. The actual autoscale rule might be missing or misconfigured. Based on the options, Option B is the most plausible: the autoscale rule might not be configured to use this metric, or the metric source is not set.

Answer

The aggregation interval is too long; it should be set to 1 minute.

Answer

The metric name is incorrect; it should be 'Percentage Memory'.

Answer

The aggregation type should be 'Maximum' instead of 'Average'.

Question 13

You are building a solution that needs to send millions of events per second to Azure for processing. Which Azure service should you use to ingest the events?

Accepted Answer

Azure Event Hubs. Azure Event Hubs is designed for high-throughput data ingestion, capable of handling millions of events per second. Option A is wrong because Service Bus is for enterprise messaging with lower throughput. Option B is wrong because IoT Hub is for IoT device connectivity. Option D is wrong because Notification Hubs is for push notifications.

Answer

Azure Service Bus

Answer

Azure IoT Hub

Answer

Azure Notification Hubs

Question 14

A company uses Azure Logic Apps to integrate with a third-party CRM system. The CRM API requires OAuth 2.0 authentication. The developer needs to securely store the client secret and refresh token. Which Azure service should the developer use?

Accepted Answer

Azure Key Vault. Option A is correct because Azure Key Vault securely stores secrets and credentials, and Logic Apps can reference them. Option B is incorrect because Azure App Configuration is for configuration settings, not secrets. Option C is incorrect because Azure SQL Database is not a secret store. Option D is incorrect because Azure Managed Identity is for Azure AD authentication, not for third-party OAuth secrets.

Answer

Azure App Configuration

Answer

Azure Managed Identity

Answer

Azure SQL Database

Question 15

Your team is migrating a legacy application to Azure. The application uses a proprietary database that is not supported by Azure SQL or Cosmos DB. You need to provide a managed database service with minimal rearchitecture. Which Azure service should you use?

Accepted Answer

Azure Virtual Machines with the database software installed. Azure Database Migration Service helps migrate databases to Azure, but for unsupported databases, you can use Azure Virtual Machines to host the database. Option B is correct. Option A is for SQL servers; Option C is for PostgreSQL/MySQL; Option D is a migration tool, not a hosting service.

Answer

Azure Database for MySQL

Answer

Azure Database Migration Service

Answer

Azure SQL Database