AZ-204 Practice Test 1 — 30 Questions

Question 1

Three analytics pipelines each need to read every event from the same Azure Event Hub: one pipeline archives events to cold storage, one computes real-time aggregations, and one feeds a machine learning model. How should the developer configure Event Hubs to allow all three to consume independently without interfering with each other?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a separate consumer group for each pipeline; each group tracks its own offset independently. A is correct because each consumer group in Event Hubs maintains its own independent offset and checkpoint, allowing multiple consumers to read the same event stream without interfering. By creating a separate consumer group for each pipeline (archival, real-time aggregation, ML), each pipeline can process events at its own pace and from its own position in the stream, ensuring no consumer's progress affects another.

Answer

Create three separate Event Hubs in the same namespace and replicate events between them with Event Hubs Capture

Answer

Use a single consumer group and route events to different pipelines by partition key prefix

Answer

Enable Event Hubs Capture for all three pipelines so they read from the captured Avro files in storage instead of the Event Hub directly

Question 2

After deploying a new version to the staging slot and swapping to production, users report a 60-second spike in 503 errors. The application takes 45 seconds to initialize its connection pools and caches before it can serve traffic. What is the root cause, and what should the developer configure to prevent this?

Accepted Answer

Configure Application Initialization in the App Service settings so the swap waits for the warm-up path to return 200 before redirecting production traffic. The root cause is that the swap operation immediately redirects production traffic to the new slot before the application has finished its 45-second initialization (connection pools, caches). Application Initialization (warm-up) in Azure App Service can be configured to send a request to a specified path and wait for a 200 response before completing the swap, ensuring the app is ready to serve traffic. This eliminates the 503 errors by preventing the swap from routing users to an uninitialized instance.

Answer

Roll back the slot swap and investigate the new version for bugs that only appear in production

Answer

Increase the App Service health check grace period so the load balancer waits longer after the swap

Answer

Disable Always On for the staging slot so the slot starts fresh on every swap

Question 3

Multiple teams need different levels of access to the same Azure Key Vault: the DevOps team needs to create and rotate secrets, the application team needs read-only secret access, and the auditing team needs list-only access. The security team wants audit logs of all access decisions and the ability to manage permissions through a single system. What access model should the developer recommend?

Accepted Answer

Use Azure RBAC for Key Vault with role assignments scoped per team: Key Vault Secrets Officer for DevOps, Key Vault Secrets User for the app team, and Key Vault Reader for auditing. Azure RBAC for Key Vault provides a unified, centralized access management system that meets all requirements. The Key Vault Secrets Officer role allows DevOps to create and rotate secrets, the Key Vault Secrets User role grants read-only access to the application team, and the Key Vault Reader role provides list-only access for auditing. Additionally, RBAC integrates with Azure Monitor to deliver audit logs of all access decisions, satisfying the security team's need for a single management plane.

Answer

Create separate access policies for each team with the minimum required permissions

Answer

Create a separate Key Vault per team to enforce isolation between access levels

Answer

Issue shared access signatures for each team scoped to the operations they need

Question 4

A business process requires sending an approval email, waiting up to 48 hours for a manager's response, and then updating a SharePoint list based on the decision. The process owner has no programming experience and wants to build this without writing code. Which Azure service is the most appropriate?

Accepted Answer

Azure Logic Apps with the Office 365 Outlook approval action and the SharePoint connector. Azure Logic Apps is the correct choice because it provides a no-code/low-code designer that allows the process owner to visually build the approval workflow using the Office 365 Outlook 'Send approval email' action and the SharePoint connector to update the list. This fully meets the requirement of no programming experience while handling the 48-hour wait and conditional update.

Answer

Azure Durable Functions with the Human Interaction pattern using a timer and event listener

Answer

Azure Data Factory with a Copy Activity pipeline triggered by an Azure Function

Answer

Azure Event Grid with a custom webhook handler that calls the SharePoint REST API

Question 5

Backend APIs exposed through Azure API Management are consumed by multiple subscribers. The product owner wants to prevent any single subscriber from sending more than 100 requests per minute, while allowing subscribers with heavier plans to have higher limits configured separately. Which APIM policy implements per-subscriber rate limiting?

Accepted Answer

Apply the rate-limit-by-key policy using the subscription key as the counter key, with calls set to 100 and renewal-period to 60. The `rate-limit-by-key` policy in Azure API Management enforces a per-key rate limit, and using the subscription key as the counter key ensures each subscriber is limited individually. The `calls` parameter set to 100 and `renewal-period` to 60 seconds matches the requirement of 100 requests per minute per subscriber, while allowing different limits for different plans by applying separate policies with different call counts.

Answer

Apply the quota policy to the product with a total of 100 calls per minute shared across all subscribers

Answer

Apply an ip-filter policy that blocks IP addresses making more than 100 requests per minute

Answer

Configure a backend circuit breaker policy to return cached responses after 100 calls

Question 6

Three microservices collaborate on a single user transaction: an App Service API, an Azure Function that processes a Service Bus message, and a downstream storage service. Traces appear separately in Application Insights with no parent-child relationship. What is needed to correlate all three into a single end-to-end trace?

Accepted Answer

Install the Application Insights SDK on all three services and ensure W3C Trace Context header propagation is enabled for both HTTP calls and Service Bus messages. Distributed tracing across HTTP and asynchronous messaging requires the Application Insights SDK on each service and propagation of the W3C Trace-Context standard (traceparent and tracestate headers). This ensures that the App Service API, Azure Function, and downstream storage service share a single trace ID, enabling Application Insights to correlate all telemetry into one end-to-end transaction view.

Answer

Use the same Application Insights instrumentation key for all three services — no additional configuration is needed

Answer

Add a custom x-correlation-id header in each service and log it with TelemetryClient.TrackEvent

Answer

Enable Azure Monitor cross-resource queries and write a KQL join across all three services' logs

Question 7

The team is writing an Azure Function that needs to retrieve secrets from Azure Key Vault at runtime. The security policy prohibits storing client secrets, connection strings, or certificates in application settings or source code. What is the recommended approach?

Accepted Answer

Enable a system-assigned managed identity on the Function App and grant it Key Vault Secrets User (or Get/List access policy) permission on the vault. A system-assigned managed identity provides a secure, credential-free way for an Azure Function to authenticate to Key Vault. Azure automatically manages the identity's lifecycle and tokens, eliminating the need to store any secrets in application settings or code. The Function App uses the managed identity to obtain an Azure AD token, which it presents to Key Vault to retrieve secrets, fully complying with the security policy.

Answer

Create an App Registration, generate a client secret, store the secret in an Application Setting, and authenticate using ClientSecretCredential

Answer

Generate a Key Vault SAS token and embed it in the function's connection string setting

Answer

Use the Key Vault REST API with the vault's access key embedded in the code

Question 8

You are building an Azure Logic App that needs to call a third-party REST API. The API requires an API key to be passed in the 'X-API-Key' header. You have stored the API key as a secret in Azure Key Vault. The Logic App uses a managed identity that has read access to the Key Vault secret. You want to retrieve the API key securely at runtime and include it in the HTTP request. Which approach should you use?

Accepted Answer

Use the 'Get secret' action from the Azure Key Vault connector, configured to authenticate with a managed identity. Then pass the output to the 'HTTP' action's header as 'X-API-Key'.. It uses the Azure Key Vault connector's 'Get secret' action with managed identity authentication to securely retrieve the API key at runtime. The output is then passed directly into the HTTP action's 'X-API-Key' header, ensuring the secret is never exposed in the Logic App definition or logs. This approach follows the principle of least privilege and avoids hardcoding secrets.

Answer

Create an API connection for the external API, providing the API key in the connection parameters. Then use that connection in the Logic App.

Answer

Store the API key directly in the Logic App definition's 'constants' section and reference it in the HTTP action.

Answer

Use the 'HTTP' action with 'Managed Identity' authentication type, and configure the external API to accept Microsoft Entra ID tokens.

Question 9

An application stores sensor readings in Azure Table Storage. Each sensor produces thousands of readings per hour. Queries always filter by sensor ID and time range. A developer needs to choose the partition key and row key. Which design best balances query performance and write throughput?

Accepted Answer

Partition key: sensor ID; row key: ISO timestamp of the reading. It uses sensor ID as the partition key, which ensures all readings for a given sensor are stored in the same partition, enabling efficient range queries by row key (timestamp). This design avoids hot partitions by distributing writes across different sensors, while the row key allows fast point lookups and range scans within a time window, balancing query performance and write throughput.

Answer

Partition key: a single constant ('all-sensors'); row key: sensor ID + timestamp

Answer

Partition key: timestamp (rounded to the hour); row key: sensor ID

Answer

Partition key: random GUID per reading; row key: timestamp

Question 10

You are monitoring a web application with Application Insights. The application occasionally returns HTTP 500 errors. You want to be notified immediately when the error rate exceeds 5% of all requests in a rolling 5-minute window. Which feature of Application Insights should you configure?

Accepted Answer

Create a log alert using a Kusto query that calculates the percentage of failed requests over the last 5 minutes, with an alert condition when the result exceeds 0.05.. A log alert using a Kusto query allows you to calculate the exact percentage of failed requests over a rolling 5-minute window and trigger when that percentage exceeds 0.05 (5%). This is the only option that supports a dynamic, percentage-based threshold on a rolling time window, which is required for the stated condition. Metric alerts on 'Failed requests' measure absolute counts, not percentages, and Smart Detection does not allow custom percentage thresholds.

Answer

Create a Smart Detection rule for anomalous failures.

Answer

Create a metric alert on the 'Failed requests' metric with a threshold of 5%.

Answer

Create an availability test that checks for HTTP 200 responses and alert on failures.

Question 11

You are building an Azure Logic App that must call a third-party REST API secured with OAuth 2.0 Client Credentials flow. The client ID and client secret are stored in Azure Key Vault. You need to securely obtain an access token and include it in requests to the API. Which approach should you use in the Logic App?

Accepted Answer

Enable a system-assigned managed identity for the Logic App, grant it access to Key Vault, use the 'Get secret' action to retrieve the client secret into a variable, then use the HTTP action with 'Active Directory OAuth' authentication referencing that variable for the secret.. It securely retrieves the client secret from Azure Key Vault at runtime using a managed identity, avoiding any hardcoded secrets. The Logic App's system-assigned managed identity is granted access to Key Vault, then the 'Get secret' action fetches the secret into a variable, which is passed to the HTTP action's 'Active Directory OAuth' authentication. This approach follows the principle of least privilege and eliminates secret exposure in connection definitions or source code.

Answer

Use the HTTP action with 'Active Directory OAuth' authentication and hardcode the client secret in the connection parameters.

Answer

Create an Azure API connection (custom connector) with the OAuth 2.0 settings and store the secret in the connector's definition.

Answer

Store the client secret in an Azure App Service application setting and reference it in the Logic App via a connector.

Question 12

You are developing an ASP.NET Core web app that uses Azure SQL Database. The SQL connection string contains a password that must be rotated every 30 days. The app runs on Azure App Service. You want to store the connection string securely and enable automatic rotation without redeploying the app. Which approach should you use?

Accepted Answer

Store the connection string in an App Setting and use Key Vault references. Configure a Key Vault policy to automatically rotate the secret.. Azure App Service supports Key Vault references in App Settings, allowing you to securely store the connection string in Key Vault and reference it without exposing the password. By configuring a Key Vault policy to automatically rotate the secret (e.g., using a scheduled rotation or event-driven trigger), the password can be rotated every 30 days without redeploying the app, as the App Service runtime resolves the reference at runtime.

Answer

Store the connection string in an App Setting as a plain text value and use deployment slots to swap when the password changes.

Answer

Use a managed identity to access the SQL database directly, bypassing the connection string entirely.

Answer

Store the connection string in Azure Key Vault and use an ARM template with a secret reference at deployment time.

Question 13

You need to grant a user from another Microsoft Entra ID tenant access to a specific blob container in your Azure Storage account. The solution must use Azure RBAC and minimize administrative overhead. What should you do?

Accepted Answer

Invite the user as a guest in your Microsoft Entra ID tenant and assign the Storage Blob Data Reader role to the container.. It uses Azure RBAC to grant cross-tenant access by inviting the user as a guest in your Microsoft Entra ID tenant, then assigning the Storage Blob Data Reader role at the container scope. This minimizes administrative overhead by leveraging existing role assignments without managing shared keys or SAS tokens, and it follows the principle of least privilege by scoping access to a specific container.

Answer

Generate a shared access signature (SAS) with read permissions for the container.

Answer

Add the user as a Storage Blob Data Reader at the storage account level.

Answer

Share the storage account key with the user.

Question 14

You are building an Azure Logic App that must call an external REST API. The API requires an API key passed in the Authorization header. You need to store the API key securely and reference it in the Logic App without exposing it in the workflow definition. What should you do?

Accepted Answer

A. Azure Logic Apps can securely reference API keys stored in Azure Key Vault using a managed identity. By configuring the Logic App with a system-assigned or user-assigned managed identity, you grant it access to retrieve the secret from Key Vault at runtime without hardcoding the key in the workflow definition or connection parameters. This approach ensures the API key is never exposed in the Logic App's JSON definition or source control.

Answer

B

Answer

C

Answer

D

Question 15

You are using Azure Application Insights to monitor a web application. You need to create a custom dashboard that shows the number of failed requests per endpoint over the last 24 hours. Which query language should you use?

Accepted Answer

Kusto Query Language (KQL). Azure Application Insights stores telemetry data in a Log Analytics workspace, which is queried using Kusto Query Language (KQL). To create a custom dashboard showing failed requests per endpoint over the last 24 hours, you would use a KQL query that filters on 'requests' where 'success == false', then summarizes by 'cloud_RoleInstance' or 'url' using the 'summarize' operator and the 'bin' function for time intervals. KQL is the native query language for Azure Monitor and Application Insights, making it the correct choice for this scenario.

Answer

Python

Answer

SQL

Answer

PowerShell

Question 16

You are developing an Azure Function that runs on a Consumption Plan. The function calls an external API that enforces a rate limit of 10 requests per second. When the function scales out to multiple instances, you must ensure the rate limit is not exceeded. Which pattern should you implement?

Accepted Answer

Use a queue-based load leveling pattern with an Azure Storage Queue.. A queue-based load leveling pattern uses an Azure Storage Queue to buffer incoming requests, allowing the function to process them at a controlled rate. This decouples the function's scaling from the external API's rate limit, ensuring that even with multiple function instances, the total request rate does not exceed 10 requests per second. The queue acts as a buffer, and the function can be configured to dequeue and process messages at a fixed rate, effectively smoothing out spikes in demand.

Answer

Use a singleton attribute on the function to ensure only one instance runs.

Answer

Use a static SemaphoreSlim in the function code to limit concurrent calls.

Answer

Configure the function's host.json to limit concurrency to 1.

Question 17

You have an Azure Storage account with cool tier blobs. You need to implement lifecycle management to move blobs to the archive tier after 30 days if they have not been accessed, and delete them after 365 days. Which lifecycle management rule action should you configure?

Accepted Answer

Use a rule with condition 'daysAfterLastAccessTimeGreaterThan' to tier and delete, and enable blob access tracking.. The requirement specifies 'if they have not been accessed', which requires tracking last access time. Lifecycle management rules support the 'daysAfterLastAccessTimeGreaterThan' condition, but blob access tracking must be enabled for this condition to work. Option A includes both the condition and enabling access tracking, making it the correct choice. Option D uses 'daysAfterModificationGreaterThan', which tracks last modification time, not access time, so it does not meet the requirement.

Answer

Use a rule with condition 'daysAfterLastAccessTimeGreaterThan' to tier and delete.

Answer

Use a rule with condition 'daysAfterSnapshotCreationGreaterThan' to tier and delete.

Answer

Use a rule with condition 'daysAfterModificationGreaterThan' to tier after 30 days and delete after 365 days.

Question 18

You are monitoring an Azure web application with Application Insights. You need to identify the top 5 slowest API endpoints over the last 7 days. The results should show the endpoint URL, average response time, and request count. Which feature or query should you use?

Accepted Answer

Use the 'Performance' blade under 'Investigate' in the Application Insights resource.. The 'Performance' blade in Application Insights provides a pre-built, optimized view that automatically aggregates request data by endpoint URL, displaying average response time and request count. It allows you to sort by average duration to quickly identify the top 5 slowest API endpoints over the last 7 days without writing any custom query.

Answer

Use Log Analytics and run a query on the 'requests' table to aggregate by URL and sort by avg(duration).

Answer

Use the 'Application Map' feature to visualize dependencies and endpoints.

Answer

Configure Smart Detection to automatically identify slow API endpoints.

Question 19

Your company uses Azure Key Vault to store secrets. You need to ensure that only a specific Microsoft Entra ID application can read a particular secret, while other applications are denied access. You want to apply the principle of least privilege. Which access control method should you configure?

Accepted Answer

Assign the application to the Key Vault Secrets User RBAC role at the secret scope. Azure RBAC allows you to assign the Key Vault Secrets User role at the secret scope, which grants read access exclusively to the specified Microsoft Entra ID application for that particular secret. This aligns with the principle of least privilege by restricting access to only the necessary secret, without granting broader permissions at the vault level.

Answer

Assign the application to the Key Vault Contributor RBAC role

Answer

Use Key Vault access policies

Answer

Use managed identity and assign the Key Vault Secrets User role at the vault scope

Question 20

You are monitoring an Azure App Service with Application Insights. You need to create a custom dashboard that shows the number of requests over time and the average server response time. Which Application Insights feature should you use to create this dashboard?

Accepted Answer

Metrics Explorer. Metrics Explorer is the correct feature because it allows you to create custom charts and dashboards by selecting specific metrics like 'Requests' and 'Server response time' from your Application Insights resource. You can aggregate these metrics over time and pin them to an Azure dashboard for monitoring. Live Metrics Stream shows real-time data but cannot be used for historical charting or dashboard pinning, while Analytics (Logs) requires Kusto queries for custom visualizations and is not optimized for simple metric dashboards.

Answer

Live Metrics Stream

Answer

Analytics (Logs)

Answer

Availability Tests