AZ-204 Practice Test 31 — 15 Questions

Question 1

A microservices application deployed on Azure Kubernetes Service (AKS) needs to securely store and retrieve configuration settings. The configuration should be updated without redeploying containers. Which Azure service should be used?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Azure App Configuration. Azure App Configuration is purpose-built for managing configuration settings for microservices applications. It provides a centralized store for key-value pairs and feature flags, supports dynamic configuration updates without requiring container restarts or redeployments, and integrates natively with AKS via the App Configuration Kubernetes Provider or the Azure SDK. This enables live configuration changes that are automatically picked up by running containers.

Answer

Azure Cosmos DB

Answer

Azure Key Vault

Answer

Azure Blob Storage

Question 2

You are developing a web application that allows users to upload images. The application runs on Azure App Service. You need to ensure that uploaded images are stored in Azure Blob Storage and that the application remains responsive. What should you use?

Accepted Answer

Generate a SAS token for the user to upload directly to Blob Storage.. Generating a SAS token allows the user's browser to upload images directly to Azure Blob Storage without routing the data through the App Service. This keeps the web application responsive by offloading the upload workload to Azure Storage, avoiding blocking the App Service's limited HTTP request threads and reducing latency.

Answer

Upload the image to the App Service and then copy it to Blob Storage.

Answer

Use Azure Files for image storage.

Answer

Make the Blob container public for anonymous uploads.

Question 3

Your application stores sensitive data in Azure Table Storage. You need to encrypt the data at rest. What should you do?

Accepted Answer

No action needed; Azure Storage Service Encryption (SSE) is enabled by default.. Azure Storage Service Encryption (SSE) automatically encrypts all data at rest in Azure Table Storage using 256-bit AES encryption, and it is enabled by default for all new and existing storage accounts. Since the question asks about encrypting data at rest and does not specify a need for customer-managed keys or client-side control, the default SSE meets the requirement without any additional configuration.

Answer

Implement client-side encryption using Azure Key Vault.

Answer

Enable server-side encryption with customer-managed keys in Azure Key Vault.

Answer

Enable Azure Disk Encryption on the virtual machines accessing the storage.

Question 4

You need to restrict access to an Azure web app so that only traffic from a specific virtual network (VNet) can reach it. The web app is already deployed. What should you configure on the web app?

Accepted Answer

Access restrictions. Access restrictions (also known as IP restrictions) allow you to define allow/deny rules based on source IP addresses or Virtual Network (VNet) service endpoints. By configuring a service endpoint-based rule that permits traffic only from your specific VNet, you can block all other inbound traffic to the web app. This is the correct mechanism for restricting access at the web app level without modifying the underlying infrastructure.

Answer

VNet integration

Answer

Network Security Group (NSG) on the subnet

Answer

Point-to-Site VPN

Question 5

An application uses Azure Redis Cache to improve performance. The team notices that cache misses are high and the cache is not effectively reducing database load. What should they do to improve cache hit ratio?

Accepted Answer

Increase the time-to-live (TTL) for cached items. High cache misses often indicate that cached data is expiring too quickly, forcing the application to fetch data from the database. Increasing the time-to-live (TTL) for cached items keeps frequently accessed data in the cache longer, directly improving the cache hit ratio. This is the most straightforward fix when the cache is underutilized due to premature eviction, not because of capacity or policy issues.

Answer

Increase the cache size

Answer

Implement cache-aside pattern with manual invalidation

Answer

Change the eviction policy to allkeys-lfu

Question 6

You are developing an application that reads data from Azure Table Storage. The application must retrieve all entities for a specific partition key. Which query approach is the most efficient?

Accepted Answer

Query with a filter on PartitionKey only.. In Azure Table Storage, the PartitionKey is the primary index for partitioning data. Querying with a filter on PartitionKey only allows the service to perform a partition scan, which is the most efficient way to retrieve all entities within a single partition because it avoids cross-partition queries and leverages the partition-level index directly.

Answer

Query with a filter on RowKey only.

Answer

Query with a filter on both PartitionKey and RowKey.

Answer

Query all entities and filter in application code.

Question 7

Your company stores customer payment data in an Azure SQL Database. You need to ensure that only the application's managed identity can access the database, and no SQL logins or passwords are used. Which authentication method should you configure?

Accepted Answer

Use Microsoft Entra ID authentication with the managed identity configured as a contained database user. Configuring the managed identity as a contained database user in Azure SQL Database using Microsoft Entra ID authentication allows the application to authenticate without any SQL logins or passwords. The managed identity provides an automatically managed service principal in Entra ID, which can be mapped to a contained database user (CREATE USER [<identity-name>] FROM EXTERNAL PROVIDER). This enables token-based authentication using OAuth 2.0, ensuring that only the application's identity can access the database.

Answer

SQL Server authentication with a strong password stored in Key Vault

Answer

Enable Transparent Data Encryption (TDE) and use the database's certificate

Answer

Configure the Azure SQL firewall to allow only the application's outbound IP

Question 8

A company uses Azure Logic Apps to integrate with a third-party CRM system. The CRM API requires OAuth 2.0 authentication. The developer needs to securely store the client secret and refresh token. Which Azure service should the developer use?

Accepted Answer

Azure Key Vault. Azure Key Vault is the correct service because it provides a secure, centralized store for secrets such as client secrets and refresh tokens. By storing these sensitive values in Key Vault, the developer can reference them in the Logic App workflow using the Key Vault connector, ensuring that secrets are never exposed in code or configuration. This aligns with the OAuth 2.0 requirement to protect long-lived credentials like refresh tokens.

Answer

Azure App Configuration

Answer

Azure Managed Identity

Answer

Azure SQL Database

Question 9

Your Azure App Service app uses SignalR Service to push real-time updates to clients. You notice that some clients are disconnected after 30 minutes of inactivity. What is the most likely cause and solution?

Accepted Answer

The Azure SignalR Service has a default client timeout of 30 minutes; configure the ClientTimeout setting in the SignalR service. The Azure SignalR Service has a default idle client timeout of 30 minutes. When a client connection remains idle (no data frames sent or received) for this duration, the service proactively closes the connection to conserve resources. To prevent this, you must configure the `ClientTimeout` setting in the SignalR service to a higher value or implement keep-alive mechanisms such as ping frames from the client.

Answer

The app service plan is scaled down, causing idle connections to drop

Answer

The app service plan has an idle timeout of 30 minutes

Answer

The SignalR service is in serverless mode, which disconnects idle clients

Question 10

A serverless app must react whenever audit documents are inserted or updated in Cosmos DB. Which trigger should the Azure Function use?

Accepted Answer

Cosmos DB trigger. The Azure Cosmos DB trigger listens to the change feed of a Cosmos DB container, which captures inserts and updates to documents. This makes it the ideal choice for reacting to audit document changes in a serverless app, as it automatically invokes the function when new or modified documents appear in the feed.

Answer

Queue trigger

Answer

Timer trigger

Answer

HTTP trigger

Question 11

A background service must call Microsoft Graph without a signed-in user. Which Microsoft identity platform permission model is required?

Accepted Answer

Application permissions with client credentials flow. When a background service or daemon calls Microsoft Graph without a signed-in user, it must authenticate as itself using application permissions (app roles) rather than delegated permissions. The client credentials flow (OAuth 2.0 grant type) allows the service to obtain an access token using its own credentials (client ID and client secret or certificate), without any user interaction. This flow is designed for server-to-server scenarios where the application acts on its own behalf.

Answer

Password hash synchronization

Answer

Delegated permissions only

Answer

Device code flow

Question 12

You are a developer at Contoso Ltd. The company has an existing .NET Core web application hosted on Azure App Service that allows users to upload images. The application currently stores images directly to Azure Blob Storage using connection strings stored in the Web.config file. The security team has mandated that all secrets must be stored in Azure Key Vault and rotated automatically. Additionally, the application must be able to access the Key Vault without storing any credentials in the application code or configuration files. The application uses Microsoft Entra ID for user authentication. You need to modify the application to meet these requirements with minimal changes to the application code. You have the following resources: an Azure Key Vault instance with the secrets (storage account connection string) already stored; a managed identity enabled for the App Service. You want to use the Key Vault references feature of Azure App Configuration or direct Key Vault access. Which approach should you take?

Accepted Answer

In the Azure portal, update the App Service application settings to reference the Key Vault secrets using the Key Vault references feature. Enable the system-assigned managed identity for the App Service and grant it Get and List permissions on the Key Vault.. It uses the Key Vault references feature in Azure App Service, which allows you to reference secrets stored in Key Vault directly from application settings without any code changes. By enabling the system-assigned managed identity and granting it Get and List permissions on the Key Vault, the App Service can authenticate to Key Vault without storing any credentials in code or configuration files. This approach meets the security team's mandate for automatic secret rotation (Key Vault references are resolved at runtime, so rotated secrets are automatically picked up) and requires minimal changes to the application code.

Answer

Set the connection string as an environment variable in the App Service using the Azure CLI and rely on the Key Vault backup.

Answer

Create an Azure App Configuration store, import the secrets from Key Vault, and change the application to use the App Configuration provider.

Answer

Modify the application code to use the Azure Identity SDK to authenticate to Key Vault via managed identity and retrieve the connection string.

Question 13

Your application uses Azure Functions and needs to authenticate to a downstream API using OAuth 2.0. The function app uses a system-assigned managed identity. Which token endpoint should the function app call to get a token for the downstream API?

Accepted Answer

http://169.254.169.254/metadata/identity/oauth2/token. The Azure Instance Metadata Service (IMDS) endpoint at http://169.254.169.254/metadata/identity/oauth2/token is the standard way for an Azure resource (like a Function App) with a system-assigned managed identity to obtain an OAuth 2.0 access token for a downstream API. This endpoint is used internally by the Azure SDK and is the only endpoint that directly leverages the managed identity without requiring any client secret or certificate.

Answer

https://{function-app}.azurewebsites.net/.auth/login

Answer

https://{downstream-api}.azurewebsites.net/.auth/me

Answer

https://login.microsoftonline.com/{tenant}/oauth2/v2.0/token

Question 14

You are building an API that needs to validate JWT tokens issued by Microsoft Entra ID. The API is registered as an application in Entra ID. Which endpoint should the API use to obtain the signing keys?

Accepted Answer

https://login.microsoftonline.com/{tenant}/discovery/v2.0/keys. The endpoint `https://login.microsoftonline.com/{tenant}/discovery/v2.0/keys` is the Microsoft Entra ID (formerly Azure AD) v2.0 JWKS (JSON Web Key Set) URI, which returns the public signing keys used to validate the signature of JWT tokens. The API must fetch these keys to verify the token's integrity and authenticity, as the keys are rotated periodically.

Answer

https://login.microsoftonline.com/{tenant}/oauth2/v2.0/token

Answer

https://login.microsoftonline.com/{tenant}/oauth2/v2.0/authorize

Answer

https://login.microsoftonline.com/{tenant}/v2.0/.well-known/openid-configuration

Question 15

You are deploying a containerized application to Azure Container Instances. The application must restart automatically if it crashes. You set the restart policy to 'Always'. However, the container keeps restarting continuously even when there is no crash. What is the most likely cause?

Accepted Answer

The application inside the container exits with a non-zero exit code on startup.. The 'Always' restart policy in Azure Container Instances restarts the container whenever it stops, regardless of the exit code. If the application exits with a non-zero exit code on startup (e.g., due to a configuration error or missing dependency), the container will stop immediately, triggering an infinite restart loop. This is the most likely cause because the container is not crashing due to external factors but rather failing during its initialization phase.

Answer

The container is configured with an Azure Files volume that is not accessible.

Answer

The container is trying to bind to a port that is already in use on the host.

Answer

The container is exceeding the allocated CPU or memory limits.