AZ-204 Practice Test 3 — 10 Questions

Question 1

You are using Azure API Management (APIM) to expose a REST API. The backend API requires mutual TLS (client certificate) for authentication. The client certificate is stored in Azure Key Vault. You need to configure APIM to use this certificate when calling the backend, without exposing the certificate contents in the policy files. Which APIM feature and policy should you use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use the authentication-certificate policy with a named value that references the Key Vault certificate.. The `authentication-certificate` policy in Azure API Management can reference a client certificate stored in Azure Key Vault via a named value. Named values securely store secrets and can point to Key Vault certificates without exposing the certificate contents in policy files. This allows APIM to present the certificate during mutual TLS authentication to the backend API.

Answer

Use the authentication-managed-identity policy to authenticate to the backend.

Answer

Upload the client certificate directly to APIM's Certificate store and reference it in the policy.

Answer

Use a JavaScript policy to fetch the certificate from Key Vault and attach it.

Question 2

A storage account for thumbnail metadata must allow an application to read only blobs under one container for two hours. The application should not receive the account key. What should be issued? The design must avoid adding custom operational scripts.

Accepted Answer

A service SAS scoped to the container with read permission and expiry. A service SAS (Shared Access Signature) scoped to a specific container with read permission and an expiry time of two hours meets the requirement: it grants time-limited read access to blobs under that container without exposing the account key. The SAS token is issued to the application, which can then use it to authenticate requests directly to Azure Blob Storage, avoiding the need for custom scripts.

Answer

A public access level on the container

Answer

A management group assignment

Answer

The storage account access key

Question 3

You are building a data pipeline that writes billions of small log records (each ~200 bytes) to Azure Blob Storage. The logs are always written in chronological order and are read sequentially in order. You must minimize storage cost and achieve maximum write throughput. Which blob type should you use?

Accepted Answer

Append blobs in the Hot tier. Append blobs are optimized for append operations, making them ideal for writing billions of small log records in chronological order. They support high-throughput sequential writes without the overhead of managing block IDs, and the Hot tier provides low-latency access for immediate reading, minimizing storage cost while maximizing write throughput.

Answer

Block blobs in the Cool tier

Answer

Page blobs in the Premium tier

Answer

Block blobs in the Archive tier

Question 4

You are building a real-time dashboard that displays data from Azure Event Hubs. You need to aggregate events over a one-minute window and update the dashboard every minute. Which Azure service should you use?

Accepted Answer

Azure Stream Analytics. Azure Stream Analytics is the correct choice because it is designed for real-time stream processing, allowing you to aggregate events from Azure Event Hubs over a one-minute tumbling window and output results to a dashboard or sink. It natively supports windowing functions (e.g., TumblingWindow, HoppingWindow) and can handle high-throughput, low-latency data streams, making it ideal for updating a dashboard every minute.

Answer

Azure Data Factory

Answer

Azure Analysis Services

Answer

Azure Logic Apps

Question 5

You have an Azure Function app that processes orders. The function uses a queue trigger from Azure Storage. Recent load tests show that the function is not scaling out fast enough under high load. What should you do to improve scaling?

Accepted Answer

Switch from Consumption plan to Premium plan. Switching to the Premium plan provides faster scale-out capabilities, including pre-warmed instances and more scalable infrastructure, which helps the function scale out more quickly under high load compared to the Consumption plan.

Answer

In the function code, increase the number of retries on failure

Answer

In host.json, increase the batchSize and increase the newBatchThreshold

Answer

In host.json, increase the batchSize and decrease the newBatchThreshold

Question 6

You need to store large binary files (up to 2 GB) that are frequently overwritten in place (entire file replaced). You want to minimize storage cost and write latency. Which Azure Blob Storage type should you use?

Accepted Answer

Block Blob. Block blobs are optimized for storing large binary files (up to ~4.75 TB) and support high-throughput uploads via PutBlock and PutBlockList operations. They allow overwriting an entire blob by uploading a new set of blocks, which minimizes write latency compared to page blobs that require sector-aligned writes. Block blobs also offer lower storage cost than page blobs, making them the best choice for frequently overwritten large files.

Answer

Page Blob

Answer

Append Blob

Answer

Archive Blob

Question 7

You develop a serverless application using Azure Functions. The function must process images uploaded to a blob container. You need to ensure the function runs only when a new blob is created, and that it scales out automatically for high upload volumes. Which trigger and hosting plan combination should you use?

Accepted Answer

Blob trigger + Consumption plan. A Blob trigger is designed to run a function when a blob is created or updated in Azure Blob Storage, which directly matches the requirement to process images only when a new blob is uploaded. The Consumption plan provides automatic scaling based on demand, handling high upload volumes by dynamically allocating resources without manual intervention. This combination ensures event-driven execution and cost-effective scaling.

Answer

HTTP trigger + Consumption plan

Answer

Queue trigger + Consumption plan

Answer

Timer trigger + Consumption plan

Question 8

You are developing a .NET Core web application that needs to send an email notification when a user registers. You decide to use Azure Communication Services Email. Which authentication method should you use to securely connect from your application to Azure Communication Services?

Accepted Answer

Use an endpoint and an access key from Azure Communication Services.. Azure Communication Services Email requires authentication via an endpoint URL and an access key, which are provisioned in the ACS resource. This is the primary method for programmatic access, as the access key is used to sign HTTP requests (via HMAC-SHA256) to the ACS Email API. Option B correctly identifies this combination as the secure authentication mechanism.

Answer

Use an Azure AD service principal with client secret.

Answer

Use a connection string from the Azure portal.

Answer

Use a managed identity for Azure resources.

Question 9

You manage a web application hosted on Azure App Service. You need to monitor the application's availability from multiple geographic locations. The test should check that the homepage loads successfully and returns HTTP 200 within 5 seconds. You want to receive an alert if the test fails from any location. Which type of Application Insights test should you create?

Accepted Answer

URL ping test. The URL ping test is the correct choice because it is a simple, single-URL availability test that checks whether a specific endpoint (the homepage) returns HTTP 200 within a specified timeout (5 seconds). It can be configured to run from multiple geographic locations and trigger an alert on failure, meeting all requirements without the complexity of multi-step or custom code.

Answer

Multi-step web test

Answer

Custom availability test using TrackAvailability

Answer

Continuous export test

Question 10

Refer to the exhibit. You have an Azure Policy definition as shown. Your team creates a storage account with network rules set to 'Deny' by default, and then adds an IP rule to allow traffic from a specific IP range. What compliance state will this storage account be reported as?

Accepted Answer

Compliant. The Azure Policy definition in the exhibit uses the 'DenyAction' effect, which only denies or audits specific actions (such as 'Microsoft.Storage/storageAccounts/write'). It does not evaluate the configuration of network rules on the storage account. Therefore, the storage account's network rule settings (defaultAction 'Deny' and IP rule) have no bearing on compliance with this policy. The resource is compliant because the policy's condition does not apply to network rules, and the write action was not blocked since the account was created successfully.

Answer

Error

Answer

Exempt

Answer

Non-compliant