AZ-204 Practice Test 30 — 15 Questions

Question 1

You are developing a web app that authenticates users via Microsoft Entra ID. The app needs to access the Microsoft Graph API to read user profiles. Which type of permission should you request in the app registration to ensure the app can read profiles without user interaction?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Application permissions. Application permissions are required for daemon or service-type applications that need to access Microsoft Graph API without a signed-in user. Unlike delegated permissions, which operate on behalf of a user, application permissions allow the app to authenticate as itself using the client credentials OAuth 2.0 flow, enabling read of user profiles without any user interaction.

Answer

Delegated permissions

Answer

Resource-based permissions

Answer

Consent permissions

Question 2

Your application uses Azure Key Vault to store cryptographic keys. You need to ensure that keys are automatically rotated every 90 days without any manual intervention. Which Key Vault feature should you configure?

Accepted Answer

Set a key rotation policy. Azure Key Vault supports key rotation policies that allow you to define automatic rotation intervals (e.g., every 90 days) for cryptographic keys. When a rotation policy is set, Key Vault automatically creates a new key version and optionally expires the old one, eliminating the need for manual intervention.

Answer

Configure a Key Vault firewall

Answer

Enable soft-delete on the key vault

Answer

Use a managed HSM instead of a standard vault

Question 3

Arrange the steps to create a CI/CD pipeline using Azure DevOps for an Azure App Service in the correct order.

Accepted Answer

Create a repository and push application code, then create a build pipeline, then configure CI trigger, then create a release pipeline, then set up approval gates.. The correct sequence for setting up a CI/CD pipeline in Azure DevOps is: First, create a repository and push your application code. Next, create a build pipeline to compile and package your application. Then, configure the CI trigger within the build pipeline to automate builds on code changes. After that, create a release pipeline to define the deployment steps for the build artifacts. Finally, set up approval gates within the release pipeline to control deployments to different environments.

Answer

Create a repository and push application code, then create a build pipeline, then create a release pipeline, then configure CI trigger, then set up approval gates.

Answer

Create a build pipeline, then create a repository and push application code, then create a release pipeline, then configure CI trigger, then set up approval gates.

Answer

Create a repository and push application code, then create a release pipeline, then create a build pipeline, then configure CI trigger, then set up approval gates.

Question 4

You are developing a solution that processes orders from an e-commerce website. The order processing logic is CPU-intensive and can take up to 30 seconds per order. You need to ensure that the web front-end remains responsive and that orders are processed reliably. What should you use?

Accepted Answer

Add orders to Azure Queue Storage and process them using a background worker role.. Azure Queue Storage provides a reliable, asynchronous message-passing mechanism that decouples the CPU-intensive order processing from the web front-end. By adding orders to a queue and processing them with a background worker (e.g., a WebJob or Worker Role), the web front-end remains responsive, and the queue ensures at-least-once delivery and durability, even if the worker fails or restarts.

Answer

Use Azure WebJobs to process orders in the same App Service plan.

Answer

Use Azure Service Bus Queues with sessions for order processing.

Answer

Use Azure Functions with Durable Functions to manage order processing state.

Question 5

A company develops a web app that processes images uploaded by users. The app uses Azure Cognitive Services to analyze images for moderation. The solution must minimize latency when calling the Cognitive Services endpoint. Which service should the developer use to call the endpoint?

Accepted Answer

Azure Front Door. Azure Front Door is a global, scalable entry point that uses the Microsoft global edge network to route user traffic to the nearest regional Cognitive Services endpoint. It provides anycast-based acceleration and TLS termination at the edge, which minimizes latency by reducing the number of network hops and enabling connection reuse. This makes it the optimal choice for low-latency calls to Cognitive Services from a web app.

Answer

Azure Traffic Manager

Answer

Azure API Management

Answer

Azure Blob Storage with a public endpoint

Question 6

You are developing an Azure Function that uses a Service Bus queue trigger. You need to ensure that the function processes messages one at a time to guarantee order. Which configuration should you use?

Accepted Answer

Set the batchSize to 1 in host.json. Setting `batchSize` to 1 in `host.json` forces the Service Bus trigger to process only one message at a time from the queue. This ensures strict message ordering, as the function will not fetch or process the next message until the current one is completed (either successfully or moved to the dead-letter queue). The Service Bus trigger uses a message pump that respects the `batchSize` setting to control concurrency.

Answer

Set the maxMessages to 1 in the ServiceBusTrigger attribute

Answer

Set the function to run on a Premium Plan

Answer

Set the maxDequeueCount to 1 in host.json

Question 7

You are reviewing an ARM template that deploys a network security group (NSG) for a web application. The exhibit shows the security rules. The web application runs on port 443. You need to ensure that HTTPS traffic from the internet can reach the web servers. What is the issue with the current configuration?

Accepted Answer

There is no rule to allow HTTPS traffic (port 443) from the internet.. The ARM template's security rules do not include an inbound rule that allows HTTPS traffic (TCP port 443) from the internet. Without such a rule, the default DenyAll inbound rule will block all HTTPS requests, preventing the web application from being accessible over the internet. NSG rules are evaluated in priority order, and if no explicit allow rule exists for port 443, traffic is denied.

Answer

The SSH rule is allowing SSH from the internet, which is a security risk.

Answer

The SSH rule should have a higher priority (lower number) to ensure SSH access.

Answer

The DenyAll rule should have a lower priority (higher number) to allow more specific rules.

Question 8

You are designing a disaster recovery plan for a storage account containing critical data. The storage account is in the West US region. You need to ensure that if West US becomes unavailable, read access to the data is still possible with minimal latency. The data must be replicated asynchronously. Which replication strategy should you choose?

Accepted Answer

Read-access geo-redundant storage (RA-GRS). RA-GRS (Read-access geo-redundant storage) is the correct choice because it provides asynchronous replication to a secondary region (paired region) and enables read access to the secondary endpoint even if the primary region fails. This meets the requirement for minimal latency read access during a West US outage, as RA-GRS allows reading from the secondary region while data is asynchronously replicated.

Answer

Read-access geo-zone-redundant storage (RA-GZRS)

Answer

Locally redundant storage (LRS)

Answer

Geo-redundant storage (GRS)

Question 9

A background service must call Microsoft Graph without a signed-in user. Which Microsoft identity platform permission model is required? The design must avoid adding custom operational scripts.

Accepted Answer

Application permissions with client credentials flow. Application permissions with the client credentials flow are required because the background service must call Microsoft Graph without a signed-in user. This flow uses OAuth 2.0 client credentials grant (RFC 6749) where the service authenticates as itself using a client secret or certificate, not on behalf of a user. Delegated permissions (Option B) always require a signed-in user context, making them unsuitable for unattended background services.

Answer

Password hash synchronization

Answer

Delegated permissions only

Answer

Device code flow

Question 10

You are developing a solution that processes messages from an Azure Storage Queue. Each message triggers a long-running operation that may take up to 30 minutes. You need to ensure that if the processing fails, the message is not lost and can be retried later. The current implementation uses a console application that polls the queue and deletes messages after processing. What should you change?

Accepted Answer

After processing fails, update the message's visibility timeout to a later time so it becomes visible again for retry.. The correct approach is to update the message's visibility timeout to a later time when processing fails. This makes the message reappear in the queue after the specified timeout, allowing another consumer to retry processing. Azure Storage Queue messages have a default visibility timeout of 30 seconds, but you can extend it to up to 7 days. This ensures the message is not lost and can be retried without being deleted or moved prematurely.

Answer

Move the message to a poison queue after the first failure.

Answer

Increase the polling interval to reduce the chance of missing messages.

Answer

Delete the message only if processing succeeds; otherwise, leave it in the queue.

Question 11

You develop a containerized application that runs on Azure Container Instances (ACI). The application needs to securely access Azure SQL Database using a connection string. You want to minimize administrative effort and avoid storing secrets in the container image. What should you do?

Accepted Answer

Enable managed identity for the container group and use Microsoft Entra authentication to Azure SQL.. Enabling a managed identity for the container group allows the application to authenticate to Azure SQL Database using Microsoft Entra ID (formerly Azure Active Directory) without storing any secrets. The application requests an access token from the Azure Instance Metadata Service (IMDS) endpoint at 169.254.169.254, then uses that token to connect to Azure SQL. This eliminates the need to manage connection strings or secrets, minimizing administrative effort and keeping secrets out of the container image.

Answer

Embed the connection string in the container image as a configuration file.

Answer

Store the connection string in an environment variable in the container group.

Answer

Mount a volume from Azure Key Vault using a secret volume.

Question 12

You are deploying a web app on Azure App Service that stores secrets in Azure Key Vault. The app uses managed identity to access Key Vault. During testing, you get a 403 Forbidden error when the app tries to read a secret. What is the most likely cause?

Accepted Answer

The Key Vault access policy does not grant the managed identity the 'Get' permission for secrets.. The 403 Forbidden error indicates that the request was authenticated but not authorized. Since the app uses managed identity to access Key Vault, the most likely cause is that the Key Vault access policy does not grant the managed identity the 'Get' permission for secrets. Without this specific permission, the identity can authenticate but cannot retrieve secret values, resulting in a 403 response.

Answer

The managed identity is not assigned to the app.

Answer

The Key Vault has soft-delete enabled.

Answer

The Key Vault firewall is set to allow only selected networks.

Question 13

You are monitoring an Azure Web App with Application Insights. You notice that the dependency duration for a SQL database call has significantly increased. You need to identify the specific SQL query that is causing the slowness. Which Application Insights feature should you use?

Accepted Answer

Performance blade and drill into Dependencies. The Performance blade in Application Insights allows you to drill into specific operations, including dependencies. By selecting the SQL dependency with increased duration, you can view the 'Dependencies' tab to see the exact SQL query text, duration, and other details. This directly identifies the slow query without needing to instrument code changes.

Answer

Application Map

Answer

Live Metrics Stream

Answer

Smart Detection

Question 14

Refer to the exhibit. You are deploying an Azure Key Vault using this ARM template. Your team plans to use RBAC to manage access. The vault must be accessible from Azure services (e.g., Azure VMs) without public IP addresses. After deployment, a developer reports that they cannot access secrets from a VM in the same region, even though the VM has a managed identity with the Key Vault Secrets User role. What is the most likely cause?

Accepted Answer

The vault's network ACLs block all traffic except from Azure services, but VMs are not considered Azure services.. The ARM template's network ACLs are configured with a default action of 'Deny' and an exception for 'AzureServices' only. Azure VMs without public IP addresses are not considered part of the 'AzureServices' bypass category; that category is reserved for Azure platform services like Azure Resource Manager or Azure Policy, not for compute instances. Therefore, the VM's traffic is blocked by the firewall, even though it has a managed identity with the correct RBAC role.

Answer

Soft delete is enabled, which prevents access to secrets until they are recovered.

Answer

The accessPolicies array is empty, so RBAC is not working.

Answer

The vault name is not unique and conflicts with another vault.

Question 15

You are using Application Insights to monitor a web application. The business team wants to track how many users click a specific button on the page. You need to send custom telemetry data from the client-side JavaScript. Which Application Insights JavaScript SDK method should you call?

Accepted Answer

appInsights.trackEvent. The correct method is `trackEvent` because it is specifically designed for capturing user interactions, such as button clicks, as custom events in Application Insights. Unlike other methods, `trackEvent` allows you to attach custom properties and measurements, making it ideal for business metrics like click tracking. This method sends the data as a custom event telemetry item, which can be analyzed in the Azure portal under 'Events'.

Answer

appInsights.trackTrace

Answer

appInsights.trackPageView

Answer

appInsights.trackException