AZ-204 Practice Test 30 — 15 Questions

Question 1

A background service must call Microsoft Graph without a signed-in user. Which Microsoft identity platform permission model is required?

Accepted Answer

Application permissions with client credentials flow. When a background service or daemon calls Microsoft Graph without a signed-in user, it must authenticate as itself using application permissions (app roles) rather than delegated permissions. The client credentials flow (OAuth 2.0 grant type) allows the service to obtain an access token using its own credentials (client ID and client secret or certificate), without any user interaction. This flow is designed for server-to-server scenarios where the application acts on its own behalf.

Answer

Password hash synchronization

Answer

Delegated permissions only

Answer

Device code flow

Question 2

You are a developer at Contoso Ltd. The company has an existing .NET Core web application hosted on Azure App Service that allows users to upload images. The application currently stores images directly to Azure Blob Storage using connection strings stored in the Web.config file. The security team has mandated that all secrets must be stored in Azure Key Vault and rotated automatically. Additionally, the application must be able to access the Key Vault without storing any credentials in the application code or configuration files. The application uses Microsoft Entra ID for user authentication. You need to modify the application to meet these requirements with minimal changes to the application code. You have the following resources: an Azure Key Vault instance with the secrets (storage account connection string) already stored; a managed identity enabled for the App Service. You want to use the Key Vault references feature of Azure App Configuration or direct Key Vault access. Which approach should you take?

Accepted Answer

In the Azure portal, update the App Service application settings to reference the Key Vault secrets using the Key Vault references feature. Enable the system-assigned managed identity for the App Service and grant it Get and List permissions on the Key Vault.. It uses the Key Vault references feature in Azure App Service, which allows you to reference secrets stored in Key Vault directly from application settings without any code changes. By enabling the system-assigned managed identity and granting it Get and List permissions on the Key Vault, the App Service can authenticate to Key Vault without storing any credentials in code or configuration files. This approach meets the security team's mandate for automatic secret rotation (Key Vault references are resolved at runtime, so rotated secrets are automatically picked up) and requires minimal changes to the application code.

Answer

Set the connection string as an environment variable in the App Service using the Azure CLI and rely on the Key Vault backup.

Answer

Create an Azure App Configuration store, import the secrets from Key Vault, and change the application to use the App Configuration provider.

Answer

Modify the application code to use the Azure Identity SDK to authenticate to Key Vault via managed identity and retrieve the connection string.

Question 3

Your application uses Azure Functions and needs to authenticate to a downstream API using OAuth 2.0. The function app uses a system-assigned managed identity. Which token endpoint should the function app call to get a token for the downstream API?

Accepted Answer

http://169.254.169.254/metadata/identity/oauth2/token. The Azure Instance Metadata Service (IMDS) endpoint at http://169.254.169.254/metadata/identity/oauth2/token is the standard way for an Azure resource (like a Function App) with a system-assigned managed identity to obtain an OAuth 2.0 access token for a downstream API. This endpoint is used internally by the Azure SDK and is the only endpoint that directly leverages the managed identity without requiring any client secret or certificate.

Answer

https://{function-app}.azurewebsites.net/.auth/login

Answer

https://{downstream-api}.azurewebsites.net/.auth/me

Answer

https://login.microsoftonline.com/{tenant}/oauth2/v2.0/token

Question 4

You are building an API that needs to validate JWT tokens issued by Microsoft Entra ID. The API is registered as an application in Entra ID. Which endpoint should the API use to obtain the signing keys?

Accepted Answer

https://login.microsoftonline.com/{tenant}/discovery/v2.0/keys. The endpoint `https://login.microsoftonline.com/{tenant}/discovery/v2.0/keys` is the Microsoft Entra ID (formerly Azure AD) v2.0 JWKS (JSON Web Key Set) URI, which returns the public signing keys used to validate the signature of JWT tokens. The API must fetch these keys to verify the token's integrity and authenticity, as the keys are rotated periodically.

Answer

https://login.microsoftonline.com/{tenant}/oauth2/v2.0/token

Answer

https://login.microsoftonline.com/{tenant}/oauth2/v2.0/authorize

Answer

https://login.microsoftonline.com/{tenant}/v2.0/.well-known/openid-configuration

Question 5

You are deploying a containerized application to Azure Container Instances. The application must restart automatically if it crashes. You set the restart policy to 'Always'. However, the container keeps restarting continuously even when there is no crash. What is the most likely cause?

Accepted Answer

The application inside the container exits with a non-zero exit code on startup.. The 'Always' restart policy in Azure Container Instances restarts the container whenever it stops, regardless of the exit code. If the application exits with a non-zero exit code on startup (e.g., due to a configuration error or missing dependency), the container will stop immediately, triggering an infinite restart loop. This is the most likely cause because the container is not crashing due to external factors but rather failing during its initialization phase.

Answer

The container is configured with an Azure Files volume that is not accessible.

Answer

The container is trying to bind to a port that is already in use on the host.

Answer

The container is exceeding the allocated CPU or memory limits.

Question 6

Your team is using Azure DevOps to deploy an Azure Kubernetes Service (AKS) cluster. You want to automatically roll back a deployment if the new version causes a high error rate. Which Azure service should you use to implement this?

Accepted Answer

Azure Monitor. Azure Monitor, specifically Application Insights, can be configured with alert rules that trigger on metrics like server error rate. When the error rate exceeds a threshold, an Azure Monitor alert can invoke an Azure Automation runbook or a webhook to initiate a Kubernetes rollback via `kubectl rollout undo` or a Helm rollback. This provides automated, event-driven rollback without manual intervention.

Answer

Azure Service Health

Answer

Azure Traffic Manager

Answer

Azure Policy

Question 7

You are designing a solution that uses Azure Functions to process events from Azure Event Hubs. The function must process events in order and exactly once per partition. What should you do?

Accepted Answer

Use the Event Hubs trigger for Azure Functions with default configuration.. The Event Hubs trigger for Azure Functions, by default, processes events in order and exactly once per partition. It uses checkpointing to track the offset of the last successfully processed event, ensuring that each event is processed only once and in sequence within a partition. This default behavior aligns with the requirement without needing additional configuration.

Answer

Enable session state in the function app.

Answer

Use a Service Bus queue trigger with a singleton lock.

Answer

Disable checkpointing to ensure no duplicates.

Question 8

A containerized checkout API deployed to Azure Container Apps must scale to zero when idle and scale out based on queue length. What should the developer configure?

Accepted Answer

A KEDA-based scale rule for the queue trigger. Azure Container Apps supports KEDA (Kubernetes Event-Driven Autoscaling) for scaling based on external metrics. A KEDA-based scale rule configured with an Azure Queue Storage trigger allows the containerized checkout API to scale to zero when no messages are in the queue and scale out dynamically as queue length increases, meeting the requirement precisely.

Answer

A manual replica count only

Answer

An Availability Set

Answer

An Azure Front Door health probe

Question 9

You are troubleshooting an Azure App Service that runs a Node.js application. The application returns HTTP 500 errors intermittently. Application Insights is configured. Which telemetry item should you examine first to find the root cause?

Accepted Answer

Exceptions. HTTP 500 errors indicate server-side failures, and Application Insights captures these as Exception telemetry when an unhandled exception occurs in the Node.js runtime. Examining the Exception telemetry first allows you to see the stack trace, error message, and call details, which directly point to the root cause of the intermittent failures.

Answer

Traces

Answer

Dependencies

Answer

Requests

Question 10

Your company develops a microservices application deployed to Azure Kubernetes Service (AKS). You need to enable secure communication between services using managed identities. Which Azure service should you use to manage the identities and access control for the pods?

Accepted Answer

Microsoft Entra Workload ID. Microsoft Entra Workload ID (formerly Azure AD Workload Identity) is the correct choice because it integrates with Kubernetes to automatically project an Microsoft Entra ID-managed identity into each pod. This allows pods to authenticate to Azure resources (e.g., Key Vault, Storage) without managing secrets, using federated identity credentials that map a Kubernetes service account to an Microsoft Entra ID application or user-assigned managed identity.

Answer

Azure Service Bus

Answer

Azure Key Vault

Answer

Azure Policy

Question 11

You are designing a solution that stores large media files (up to 5 GB each) in Azure Blob Storage. The application must support concurrent uploads with the ability to pause and resume. You need to ensure efficient use of network bandwidth and provide progress reporting. Which approach should you use?

Accepted Answer

Use the Azure Storage SDK to upload blobs in blocks, and implement pause/resume logic using block IDs.. Azure Blob Storage supports block blobs, which allow you to upload large files in independent blocks. By using the Azure Storage SDK, you can assign unique block IDs to each block, enabling pause/resume by tracking which block IDs have been committed. This approach also provides fine-grained progress reporting per block and efficient network bandwidth usage through parallel uploads.

Answer

Use AzCopy with the --resume parameter.

Answer

Use Page blobs with 512-byte pages.

Answer

Use Append blobs and append data in chunks.

Question 12

You are deploying a sensitive application on Azure Kubernetes Service (AKS). You need to ensure that secrets, such as database connection strings, are encrypted at rest and in transit, and that the cluster has no static credentials. Which feature should you enable?

Accepted Answer

Use Azure Key Vault Provider for Secrets Store CSI Driver. The Azure Key Vault Provider for Secrets Store CSI Driver integrates with AKS to securely fetch secrets from Azure Key Vault, encrypting them at rest (Key Vault uses AES-256) and in transit (TLS 1.2+). It eliminates static credentials by using a managed identity or service principal to authenticate to Key Vault, ensuring no secrets are stored on disk or in etcd.

Answer

Enable etcd encryption at rest

Answer

Enable Azure Disk Encryption on the node pools

Answer

Assign a managed identity to the AKS cluster

Question 13

You have an Azure CDN profile that caches content from a storage account. Users in Europe report that images load slowly. You need to improve performance for European users. What should you do?

Accepted Answer

Add an additional CDN endpoint with a European origin. Adding an additional CDN endpoint with a European origin (e.g., an Azure Storage account in a European region) reduces latency by serving content from a geographically closer point of presence (PoP). Azure CDN uses a global network of edge servers, but if the origin server is far from the users, the first-hop latency from the edge to the origin can still be high. By placing an origin in Europe, the CDN can fetch content from a nearby origin, minimizing the distance data must travel and improving load times for European users.

Answer

Enable compression on the CDN

Answer

Enable prefetching on the CDN

Answer

Configure caching rules to cache longer

Question 14

You are designing a solution for a multi-tenant SaaS application where each tenant's data is stored in separate Azure SQL databases. You need to ensure that no tenant can access another tenant's database, even if the application is compromised. What should you implement?

Accepted Answer

Assign each tenant a managed identity with a dedicated SQL login and database-level permissions. Assigning each tenant a managed identity with a dedicated SQL login and database-level permissions ensures that even if the application is compromised, the attacker cannot access another tenant's database. Managed identities provide an Microsoft Entra ID-backed identity for the application, and by mapping each tenant to a separate SQL login with permissions scoped to their specific database, you enforce tenant isolation at the database authentication and authorization layer. This prevents cross-tenant access because the application can only authenticate to the database corresponding to the tenant's managed identity.

Answer

Configure a server-level firewall rule for each tenant's IP range

Answer

Implement connection pooling with a single identity

Answer

Use a single database-level login and row-level security (RLS) to filter data

Question 15

You need to deploy a web application to Azure App Service. The application requires a custom domain name and SSL/TLS certificate. You want to automate the deployment using Azure CLI. Which command should you use to upload the SSL certificate to the App Service?

Accepted Answer

az webapp config ssl upload. The `az webapp config ssl upload` command is the Azure CLI command used to upload an SSL/TLS certificate (in .pfx format) to an existing Azure App Service web app. This command binds the certificate to the app, enabling HTTPS for custom domains.

Answer

az appservice web config ssl upload

Answer

az appservice certificate import

Answer

az webapp certificate upload