AZ-204 Practice Test 29 — 15 Questions

Question 1

You develop a containerized application that runs on Azure Container Instances (ACI). The application needs to securely access Azure SQL Database using a connection string. You want to minimize administrative effort and avoid storing secrets in the container image. What should you do?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable managed identity for the container group and use Microsoft Entra authentication to Azure SQL.. Enabling a managed identity for the container group allows the application to authenticate to Azure SQL Database using Microsoft Entra ID (formerly Azure Active Directory) without storing any secrets. The application requests an access token from the Azure Instance Metadata Service (IMDS) endpoint at 169.254.169.254, then uses that token to connect to Azure SQL. This eliminates the need to manage connection strings or secrets, minimizing administrative effort and keeping secrets out of the container image.

Answer

Embed the connection string in the container image as a configuration file.

Answer

Store the connection string in an environment variable in the container group.

Answer

Mount a volume from Azure Key Vault using a secret volume.

Question 2

You are deploying a web app on Azure App Service that stores secrets in Azure Key Vault. The app uses managed identity to access Key Vault. During testing, you get a 403 Forbidden error when the app tries to read a secret. What is the most likely cause?

Accepted Answer

The Key Vault access policy does not grant the managed identity the 'Get' permission for secrets.. The 403 Forbidden error indicates that the request was authenticated but not authorized. Since the app uses managed identity to access Key Vault, the most likely cause is that the Key Vault access policy does not grant the managed identity the 'Get' permission for secrets. Without this specific permission, the identity can authenticate but cannot retrieve secret values, resulting in a 403 response.

Answer

The managed identity is not assigned to the app.

Answer

The Key Vault has soft-delete enabled.

Answer

The Key Vault firewall is set to allow only selected networks.

Question 3

You are monitoring an Azure Web App with Application Insights. You notice that the dependency duration for a SQL database call has significantly increased. You need to identify the specific SQL query that is causing the slowness. Which Application Insights feature should you use?

Accepted Answer

Performance blade and drill into Dependencies. The Performance blade in Application Insights allows you to drill into specific operations, including dependencies. By selecting the SQL dependency with increased duration, you can view the 'Dependencies' tab to see the exact SQL query text, duration, and other details. This directly identifies the slow query without needing to instrument code changes.

Answer

Application Map

Answer

Live Metrics Stream

Answer

Smart Detection

Question 4

Refer to the exhibit. You are deploying an Azure Key Vault using this ARM template. Your team plans to use RBAC to manage access. The vault must be accessible from Azure services (e.g., Azure VMs) without public IP addresses. After deployment, a developer reports that they cannot access secrets from a VM in the same region, even though the VM has a managed identity with the Key Vault Secrets User role. What is the most likely cause?

Accepted Answer

The vault's network ACLs block all traffic except from Azure services, but VMs are not considered Azure services.. The ARM template's network ACLs are configured with a default action of 'Deny' and an exception for 'AzureServices' only. Azure VMs without public IP addresses are not considered part of the 'AzureServices' bypass category; that category is reserved for Azure platform services like Azure Resource Manager or Azure Policy, not for compute instances. Therefore, the VM's traffic is blocked by the firewall, even though it has a managed identity with the correct RBAC role.

Answer

Soft delete is enabled, which prevents access to secrets until they are recovered.

Answer

The accessPolicies array is empty, so RBAC is not working.

Answer

The vault name is not unique and conflicts with another vault.

Question 5

You are using Application Insights to monitor a web application. The business team wants to track how many users click a specific button on the page. You need to send custom telemetry data from the client-side JavaScript. Which Application Insights JavaScript SDK method should you call?

Accepted Answer

appInsights.trackEvent. The correct method is `trackEvent` because it is specifically designed for capturing user interactions, such as button clicks, as custom events in Application Insights. Unlike other methods, `trackEvent` allows you to attach custom properties and measurements, making it ideal for business metrics like click tracking. This method sends the data as a custom event telemetry item, which can be analyzed in the Azure portal under 'Events'.

Answer

appInsights.trackTrace

Answer

appInsights.trackPageView

Answer

appInsights.trackException

Question 6

A microservices application deployed on Azure Kubernetes Service (AKS) needs to securely store and retrieve configuration settings. The configuration should be updated without redeploying containers. Which Azure service should be used?

Accepted Answer

Azure App Configuration. Azure App Configuration is purpose-built for managing configuration settings for microservices applications. It provides a centralized store for key-value pairs and feature flags, supports dynamic configuration updates without requiring container restarts or redeployments, and integrates natively with AKS via the App Configuration Kubernetes Provider or the Azure SDK. This enables live configuration changes that are automatically picked up by running containers.

Answer

Azure Cosmos DB

Answer

Azure Key Vault

Answer

Azure Blob Storage

Question 7

You are developing a web application that allows users to upload images. The application runs on Azure App Service. You need to ensure that uploaded images are stored in Azure Blob Storage and that the application remains responsive. What should you use?

Accepted Answer

Generate a SAS token for the user to upload directly to Blob Storage.. Generating a SAS token allows the user's browser to upload images directly to Azure Blob Storage without routing the data through the App Service. This keeps the web application responsive by offloading the upload workload to Azure Storage, avoiding blocking the App Service's limited HTTP request threads and reducing latency.

Answer

Upload the image to the App Service and then copy it to Blob Storage.

Answer

Use Azure Files for image storage.

Answer

Make the Blob container public for anonymous uploads.

Question 8

Your application stores sensitive data in Azure Table Storage. You need to encrypt the data at rest. What should you do?

Accepted Answer

No action needed; Azure Storage Service Encryption (SSE) is enabled by default.. Azure Storage Service Encryption (SSE) automatically encrypts all data at rest in Azure Table Storage using 256-bit AES encryption, and it is enabled by default for all new and existing storage accounts. Since the question asks about encrypting data at rest and does not specify a need for customer-managed keys or client-side control, the default SSE meets the requirement without any additional configuration.

Answer

Implement client-side encryption using Azure Key Vault.

Answer

Enable server-side encryption with customer-managed keys in Azure Key Vault.

Answer

Enable Azure Disk Encryption on the virtual machines accessing the storage.

Question 9

You need to restrict access to an Azure web app so that only traffic from a specific virtual network (VNet) can reach it. The web app is already deployed. What should you configure on the web app?

Accepted Answer

Access restrictions. Access restrictions (also known as IP restrictions) allow you to define allow/deny rules based on source IP addresses or Virtual Network (VNet) service endpoints. By configuring a service endpoint-based rule that permits traffic only from your specific VNet, you can block all other inbound traffic to the web app. This is the correct mechanism for restricting access at the web app level without modifying the underlying infrastructure.

Answer

VNet integration

Answer

Network Security Group (NSG) on the subnet

Answer

Point-to-Site VPN

Question 10

An application uses Azure Redis Cache to improve performance. The team notices that cache misses are high and the cache is not effectively reducing database load. What should they do to improve cache hit ratio?

Accepted Answer

Increase the time-to-live (TTL) for cached items. High cache misses often indicate that cached data is expiring too quickly, forcing the application to fetch data from the database. Increasing the time-to-live (TTL) for cached items keeps frequently accessed data in the cache longer, directly improving the cache hit ratio. This is the most straightforward fix when the cache is underutilized due to premature eviction, not because of capacity or policy issues.

Answer

Increase the cache size

Answer

Implement cache-aside pattern with manual invalidation

Answer

Change the eviction policy to allkeys-lfu

Question 11

You are developing an application that reads data from Azure Table Storage. The application must retrieve all entities for a specific partition key. Which query approach is the most efficient?

Accepted Answer

Query with a filter on PartitionKey only.. In Azure Table Storage, the PartitionKey is the primary index for partitioning data. Querying with a filter on PartitionKey only allows the service to perform a partition scan, which is the most efficient way to retrieve all entities within a single partition because it avoids cross-partition queries and leverages the partition-level index directly.

Answer

Query with a filter on RowKey only.

Answer

Query with a filter on both PartitionKey and RowKey.

Answer

Query all entities and filter in application code.

Question 12

Your company stores customer payment data in an Azure SQL Database. You need to ensure that only the application's managed identity can access the database, and no SQL logins or passwords are used. Which authentication method should you configure?

Accepted Answer

Use Microsoft Entra ID authentication with the managed identity configured as a contained database user. Configuring the managed identity as a contained database user in Azure SQL Database using Microsoft Entra ID authentication allows the application to authenticate without any SQL logins or passwords. The managed identity provides an automatically managed service principal in Entra ID, which can be mapped to a contained database user (CREATE USER [<identity-name>] FROM EXTERNAL PROVIDER). This enables token-based authentication using OAuth 2.0, ensuring that only the application's identity can access the database.

Answer

SQL Server authentication with a strong password stored in Key Vault

Answer

Enable Transparent Data Encryption (TDE) and use the database's certificate

Answer

Configure the Azure SQL firewall to allow only the application's outbound IP

Question 13

A company uses Azure Logic Apps to integrate with a third-party CRM system. The CRM API requires OAuth 2.0 authentication. The developer needs to securely store the client secret and refresh token. Which Azure service should the developer use?

Accepted Answer

Azure Key Vault. Azure Key Vault is the correct service because it provides a secure, centralized store for secrets such as client secrets and refresh tokens. By storing these sensitive values in Key Vault, the developer can reference them in the Logic App workflow using the Key Vault connector, ensuring that secrets are never exposed in code or configuration. This aligns with the OAuth 2.0 requirement to protect long-lived credentials like refresh tokens.

Answer

Azure App Configuration

Answer

Azure Managed Identity

Answer

Azure SQL Database

Question 14

Your Azure App Service app uses SignalR Service to push real-time updates to clients. You notice that some clients are disconnected after 30 minutes of inactivity. What is the most likely cause and solution?

Accepted Answer

The Azure SignalR Service has a default client timeout of 30 minutes; configure the ClientTimeout setting in the SignalR service. The Azure SignalR Service has a default idle client timeout of 30 minutes. When a client connection remains idle (no data frames sent or received) for this duration, the service proactively closes the connection to conserve resources. To prevent this, you must configure the `ClientTimeout` setting in the SignalR service to a higher value or implement keep-alive mechanisms such as ping frames from the client.

Answer

The app service plan is scaled down, causing idle connections to drop

Answer

The app service plan has an idle timeout of 30 minutes

Answer

The SignalR service is in serverless mode, which disconnects idle clients

Question 15

A serverless app must react whenever audit documents are inserted or updated in Cosmos DB. Which trigger should the Azure Function use?

Accepted Answer

Cosmos DB trigger. The Azure Cosmos DB trigger listens to the change feed of a Cosmos DB container, which captures inserts and updates to documents. This makes it the ideal choice for reacting to audit document changes in a serverless app, as it automatically invokes the function when new or modified documents appear in the feed.

Answer

Queue trigger

Answer

Timer trigger

Answer

HTTP trigger