AZ-204 Practice Test 29 — 15 Questions

Question 1

You are developing a web app that uses Azure Key Vault to retrieve secrets. The app must authenticate using a system-assigned managed identity. Which endpoint should you use to get an access token for Key Vault?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

http://169.254.169.254/metadata/identity/oauth2/token?resource=https://vault.azure.net&api-version=2018-02-01. It uses the Azure Instance Metadata Service (IMDS) endpoint, which is the standard way for Azure resources with a system-assigned managed identity to obtain an access token. The request includes the resource parameter set to 'https://vault.azure.net' to specify Key Vault as the target service, and the API version '2018-02-01' is required for the IMDS token endpoint. This token is then used to authenticate to Key Vault without storing any credentials in the application code.

Answer

https://login.microsoftonline.com/{tenantId}/oauth2/v2.0/token

Answer

https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups/{rg}/providers/Microsoft.KeyVault/vaults/{vaultName}

Answer

https://graph.microsoft.com/v1.0/me

Question 2

A .NET app performs point reads from Cosmos DB by id and partition key. The team wants the lowest latency and best throughput efficiency. Which API call pattern should be used?

Accepted Answer

ReadItemAsync with id and partition key. ReadItemAsync with id and partition key is the most efficient API call pattern for point reads in Cosmos DB because it directly accesses the document using the partition key and item ID, requiring only a single request to the exact partition and replica. This avoids the overhead of querying multiple partitions or scanning all items, resulting in the lowest latency and best throughput efficiency, as it consumes the minimum request units (RUs) possible for a read operation.

Answer

Stored procedure scanning all items

Answer

Change feed processor

Answer

SELECT * query without partition key

Question 3

You need to secure access to an Azure Storage account that hosts sensitive data. The requirement is to restrict access to only requests originating from a specific virtual network. Which feature should you configure?

Accepted Answer

Storage firewall and virtual network rules. D is correct because Azure Storage firewall and virtual network rules allow you to restrict access to your storage account to only requests originating from a specific virtual network. This is achieved by configuring a service endpoint or a private endpoint for the storage account, which ensures that traffic from the designated VNet is permitted while all other public internet traffic is blocked. This directly meets the requirement of restricting access to a specific virtual network.

Answer

Customer-managed keys (CMK)

Answer

Azure AD authentication

Answer

Shared access signatures (SAS)

Question 4

You are developing an application that stores sensitive user data in Azure Table Storage. You need to ensure that data is encrypted at rest and that only authorized users can access it. What should you implement?

Accepted Answer

Enable Azure Storage Service Encryption (SSE) and use Microsoft Entra ID for authentication.. Azure Storage Service Encryption (SSE) automatically encrypts data at rest for Azure Table Storage using 256-bit AES encryption. By combining SSE with Microsoft Entra ID (formerly Azure AD) for authentication, you ensure both encryption at rest and role-based access control, meeting the requirement for authorized access without managing keys or encryption logic client-side.

Answer

Apply Azure Information Protection labels to the storage account.

Answer

Implement client-side encryption using the Azure Storage SDK and manage keys via Azure Key Vault.

Answer

Use shared access signatures (SAS) with a stored access policy to limit access to the data.

Question 5

Arrange the steps to secure an Azure API Management API using OAuth 2.0 with Azure AD in the correct order.

Accepted Answer

Register an application in Azure AD, then configure API Management to use OAuth 2.0, then add the validate-jwt policy to the API, then configure the product to require OAuth 2.0, then test the setup.. First register app in Azure AD, configure API Management with OAuth, add validate-jwt policy, configure product, test.

Answer

Configure API Management to use OAuth 2.0, then register an application in Azure AD, then add the validate-jwt policy to the API, then configure the product to require OAuth 2.0, then test the setup.

Answer

Register an application in Azure AD, then add the validate-jwt policy to the API, then configure API Management to use OAuth 2.0, then configure the product to require OAuth 2.0, then test the setup.

Answer

Register an application in Azure AD, then configure API Management to use OAuth 2.0, then configure the product to require OAuth 2.0, then add the validate-jwt policy to the API, then test the setup.

Question 6

You are developing a solution that stores large media files in Azure Blob Storage. Users access these files frequently for the first 30 days, then rarely afterwards. To optimize costs, you need to automatically move blobs to a cooler tier after 30 days of creation. Which Azure feature should you use?

Accepted Answer

Lifecycle management policies. Azure Blob Storage lifecycle management policies allow you to automatically transition blobs to cooler tiers (e.g., from Hot to Cool) based on age or last modification time. By defining a rule that moves blobs to the Cool tier 30 days after creation, you optimize storage costs for frequently accessed files that become rarely used. This feature is purpose-built for automating tier transitions without manual intervention or custom code.

Answer

Blob inventory

Answer

Change feed

Answer

Immutable storage

Question 7

You have an Azure Storage account with a blob container. You need to grant a user read-only access to a specific blob for 24 hours without requiring them to authenticate with Microsoft Entra ID. What should you use?

Accepted Answer

Generate a user delegation SAS token. A user delegation SAS token is the correct choice because it provides time-limited, delegated access to a specific blob using Microsoft Entra ID credentials without requiring the user to authenticate directly. The token is signed with the user's delegated key, granting read-only access for exactly 24 hours as specified, and it does not expose the storage account access key.

Answer

Provide the storage account access key

Answer

Assign the Storage Blob Data Reader role

Answer

Configure a stored access policy

Question 8

Refer to the exhibit. You are deploying an ARM template that includes the above network security group rule. The rule is intended to block all outbound internet traffic from a virtual network. However, after deployment, virtual machines in the subnet still have outbound internet access. What is the most likely reason?

Accepted Answer

The network security group is not associated with the subnet or network interface.. A network security group (NSG) rule only takes effect when the NSG is explicitly associated with a subnet or a network interface. Without this association, the rule is not applied to traffic flowing through the subnet, so virtual machines retain default outbound internet access. The ARM template may have defined the NSG and its rules, but if the association step (e.g., via Microsoft.Network/virtualNetworks/subnets with the networkSecurityGroup property) is missing or misconfigured, the rule is effectively ignored.

Answer

The destination port range '*' is invalid; you must specify explicit ports.

Answer

The source address prefix should be '*' instead of 'VirtualNetwork'.

Answer

The rule priority is too low; it should be lower than the default allow rule.

Question 9

You are troubleshooting a containerized application running on Azure Kubernetes Service (AKS). The application logs indicate that it cannot connect to an Azure SQL Database using a managed identity. The pod is configured with a user-assigned managed identity. Which step is most likely missing?

Accepted Answer

The AKS cluster does not have the Azure AD Pod Identity add-on enabled. The AKS cluster requires the Azure AD Pod Identity add-on (or the newer Workload Identity) to enable pods to authenticate to Azure resources using managed identities. Without this add-on, the pod's user-assigned managed identity cannot be used to obtain tokens for connecting to Azure SQL Database, even if the identity is correctly assigned to the pod.

Answer

The Azure SQL Database firewall is blocking the pod IP

Answer

The pod's service account is not linked to the managed identity

Answer

The managed identity is not in the same Microsoft Entra ID tenant as the AKS cluster

Question 10

You are developing a web app that authenticates users via Microsoft Entra ID. The app needs to call a downstream API on behalf of the signed-in user. Which OAuth 2.0 flow should you implement?

Accepted Answer

Authorization code flow with PKCE. The authorization code flow with PKCE is the correct choice because the app needs to authenticate a signed-in user and then call a downstream API on their behalf. This flow securely exchanges an authorization code for an access token, and PKCE (Proof Key for Code Exchange) prevents authorization code interception attacks, which is essential for public clients like web apps. It is the recommended OAuth 2.0 flow for single-page apps and native apps, but also applicable to web apps that require high security.

Answer

Client credentials flow

Answer

Implicit flow

Answer

Device code flow

Question 11

Refer to the exhibit. A developer runs this Azure CLI command to set an app setting for a web app. What is the impact on the web app?

Accepted Answer

The web app restarts to apply the new setting.. When you use the Azure CLI command `az webapp config appsettings set` to modify an app setting for a web app, Azure App Service automatically triggers a restart of the web app to apply the new setting. This is because app settings are injected into the application's environment at startup, and changes require a fresh process to pick them up. Option C correctly identifies this behavior.

Answer

The command fails because the password is provided in plaintext.

Answer

The setting is available immediately without restart.

Answer

The setting is stored in a local configuration file.

Question 12

You are developing an Azure Function that runs on a Consumption plan. The function needs to process a large file uploaded to Azure Blob Storage. The processing is CPU-intensive and may take up to 30 minutes. What should you use to implement the function?

Accepted Answer

Configure the function app to use a Premium plan to allow longer execution times.. Azure Functions on a Consumption plan have a maximum execution timeout of 10 minutes (or 5 minutes by default). For CPU-intensive processing that may take up to 30 minutes, you must use a Premium plan, which supports unlimited execution duration (subject to the functionTimeout setting, which can be set up to 60 minutes by default and up to unlimited if configured). The Premium plan also provides dedicated instances and pre-warmed workers, which are suitable for long-running, resource-intensive workloads.

Answer

Use a blob trigger and set the batchSize to 1 to avoid timeouts.

Answer

Set the functionTimeout in host.json to 30 minutes on the Consumption plan.

Answer

Create an orchestrator function using Durable Functions to manage the processing.

Question 13

A report export service in Azure App Service must safely access Key Vault secrets without connection strings in configuration. Which two steps are required?

Accepted Answer

Grant the identity permission to read the required secrets. Granting the managed identity permission to read secrets in Key Vault via Azure RBAC or access policies ensures that the App Service can authenticate without storing any secrets in configuration. This follows the principle of least privilege and eliminates the risk of credential leakage from app settings or connection strings.

Answer

Enable anonymous access on the vault

Answer

Store the Key Vault access key in app settings

Question 14

You are designing a solution that uses Azure Container Instances (ACI) to run a batch job. The job must run only once a day and should not incur costs when idle. Which configuration should you use?

Accepted Answer

Use a scheduled job that creates a container group with restart policy Never and delete after completion. Azure Container Instances (ACI) supports a restart policy of 'Never' for one-off batch jobs, and you can orchestrate the creation and deletion of the container group using a scheduled job (e.g., Azure Logic Apps, Azure Functions, or a cron-based trigger). This ensures the container runs exactly once per day and incurs no cost when idle, as the container group is deleted after completion.

Answer

Use Azure Kubernetes Service with a node pool that scales to zero

Answer

Deploy a container group with a restart policy of Always

Answer

Use Azure Container Apps with scale-to-zero minimum replicas

Question 15

A serverless app must react whenever audit documents are inserted or updated in Cosmos DB. Which trigger should the Azure Function use? The design must avoid adding custom operational scripts.

Accepted Answer

Cosmos DB trigger. The Azure Cosmos DB trigger is the correct choice because it natively listens to the Cosmos DB change feed, which captures inserts and updates to documents. This allows the Azure Function to react automatically without any custom scripts or polling logic, aligning with the serverless and operational simplicity requirements.

Answer

Queue trigger

Answer

Timer trigger

Answer

HTTP trigger