AZ-204 Practice Test 32 — 15 Questions

Question 1

You are building a solution that processes orders from multiple regions. Orders must be processed in the order they are received, but processing can take up to 5 minutes. You need to ensure exactly-once processing and minimize latency. Which Azure service and configuration should you use?

Accepted Answer

Azure Service Bus Queue with sessions enabled. Service Bus Queues with sessions provide FIFO ordering and duplicate detection. Option A is wrong because default queues don't guarantee order. Option C is wrong because Event Hubs is for streaming, not ordered queues. Option D is wrong because Storage Queues don't guarantee FIFO.

Answer

Azure Event Hubs with consumer groups

Answer

Azure Service Bus Queue with duplicate detection enabled

Answer

Azure Queue Storage with poison messages

Question 2

Which TWO are best practices when using Azure Service Bus for high-throughput messaging?

Accepted Answer

Enable batching of messages when sending. Batching messages reduces overhead. Using partitioned queues improves throughput. Option C is wrong because large messages reduce throughput. Option D is wrong because sessions can limit throughput. Option E is wrong because duplicate detection adds overhead.

Answer

Enable duplicate detection for all queues

Answer

Use sessions to guarantee ordering

Answer

Send messages larger than 256 KB to reduce the number of messages

Question 3

Refer to the exhibit. A developer deploys this ARM template to create a web app with a connection string to Azure Cosmos DB. The deployment succeeds but the web app cannot connect to Cosmos DB. What is the most likely cause?

Accepted Answer

The connection string should use a secret reference to Azure Key Vault. Option B is correct because the connection string should use a secret reference to Azure Key Vault for security, and the raw master key in plaintext is not allowed. Option A is incorrect because the function is correct. Option C is incorrect because the listKeys function works. Option D is incorrect because the deployment succeeded.

Answer

The listKeys function is used incorrectly

Answer

The web app name parameter is missing

Answer

The listKeys function requires a different API version

Question 4

A developer needs to store a large number of binary files (images) that are accessed frequently from a web app. Which Azure storage solution is most cost-effective?

Accepted Answer

Azure Blob Storage. Option A is correct because Blob Storage is optimized for storing large amounts of unstructured data like images. Option B (Azure Files) is for file shares; Option C (Cosmos DB) is a database; Option D (Queue Storage) is for messages.

Answer

Azure Queue Storage

Answer

Azure Files

Answer

Azure Cosmos DB

Question 5

Your web app needs to authenticate users with Microsoft Entra ID (formerly Azure AD). Which OAuth 2.0 flow should you use for a single-page application (SPA) that uses MSAL.js?

Accepted Answer

Authorization code flow with PKCE. The authorization code flow with PKCE is the recommended OAuth 2.0 flow for SPAs. Option B is wrong because implicit flow is deprecated. Option C is wrong because client credentials flow is for daemon apps. Option D is wrong because resource owner password credentials flow is not recommended.

Answer

Client credentials flow

Answer

Implicit flow

Answer

Resource owner password credentials flow

Question 6

You are developing a web app that uses Azure Key Vault to retrieve secrets. The app must authenticate using a system-assigned managed identity. Which endpoint should you use to get an access token for Key Vault?

Accepted Answer

http://169.254.169.254/metadata/identity/oauth2/token?resource=https://vault.azure.net&api-version=2018-02-01. The correct endpoint for getting a token via managed identity on Azure App Service is http://169.254.169.254/metadata/identity/oauth2/token (the Instance Metadata Service endpoint). Option A is the Azure CLI login endpoint, B is the Graph API token endpoint, and D is the ARM token endpoint, which do not use managed identity for Key Vault.

Answer

https://login.microsoftonline.com/{tenantId}/oauth2/v2.0/token

Answer

https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups/{rg}/providers/Microsoft.KeyVault/vaults/{vaultName}

Answer

https://graph.microsoft.com/v1.0/me

Question 7

Which THREE features of Azure API Management help enforce security policies for APIs? (Choose three.)

Accepted Answer

rate-limit policy. Option A is correct: validate-jwt validates tokens. Option B is correct: rate-limit throttles requests to prevent abuse. Option D is correct: IP filtering restricts access by source IP. Option C is wrong: cache-lookup improves performance but not security. Option E is wrong: transform XML to JSON changes format, not security.

Answer

xml-to-json policy

Answer

cache-lookup policy

Question 8

Refer to the exhibit. An Azure Function is configured with an Event Hub trigger to process telemetry data. The function uses the EventProcessorHost to read events. The developer notices that the function is not processing all events; some events are skipped. What is the most likely cause?

Accepted Answer

The cardinality is set to 'many' causing batch processing issues. Option C is correct because the cardinality is set to 'many', which means the function receives a batch of events. If the batch size is too large, some events may be skipped due to timeouts. Option A is incorrect because the connection string is secure. Option B is incorrect because $Default is a valid consumer group. Option D is incorrect because the event hub name is correct.

Answer

The event hub name is misspelled

Answer

The consumer group is set to $Default

Answer

The connection string is stored as a securestring parameter

Question 9

Which TWO Azure services can be used to implement a pub/sub messaging pattern?

Accepted Answer

Azure Service Bus Topics. Options B and D are correct. Service Bus Topics support pub/sub with multiple subscribers. Event Grid also supports pub/sub with event subscriptions. Option A (Queue Storage) is point-to-point; Option C (Event Hubs) is for event streaming, but can be used for pub/sub; Option E (Blob Storage) is not messaging.

Answer

Azure Blob Storage

Answer

Azure Event Hubs

Answer

Azure Queue Storage

Question 10

You are using Azure Logic Apps to integrate with a third-party CRM. The CRM API requires OAuth 2.0 authentication with a client secret. The secret must be stored securely and rotated automatically. What should you do?

Accepted Answer

Store the secret in Azure Key Vault and use a managed identity to access it. Store the secret in Key Vault and reference it from the Logic App using a managed identity. Option A is wrong because storing secrets in Logic App definitions is insecure. Option C is wrong because storing in App Configuration is not designed for secrets. Option D is wrong because managed identity alone does not store the secret.

Answer

Use a system-assigned managed identity without storing the secret

Answer

Store the secret in the Logic App definition as a string parameter

Answer

Store the secret in Azure App Configuration with encryption

Question 11

You are building an event-driven solution that processes orders from an Azure Storage Queue. Each order triggers an Azure Function. To improve reliability, you need to automatically retry processing if an exception occurs, but only up to 3 times. You must also preserve the original order message in a poison queue after max retries. Which configuration should you use in the function's host.json?

Accepted Answer

Set 'maxDequeueCount' to 3. The 'maxDequeueCount' setting in host.json controls the number of times the function tries to process a message before moving it to the poison queue. Setting it to 3 achieves the requirement. Option A is wrong because 'prefetchCount' controls how many messages are retrieved at once, not retries. Option B is wrong because 'newBatchThreshold' controls batch size, not retries. Option D is wrong because 'batchSize' controls how many messages are processed concurrently, not retries.

Answer

Set 'prefetchCount' to 3

Answer

Set 'newBatchThreshold' to 3

Answer

Set 'batchSize' to 3

Question 12

Refer to the exhibit. A developer runs this Azure CLI command to set an app setting for a web app. What is the impact on the web app?

Accepted Answer

The web app restarts to apply the new setting.. Option B is correct. The command sets an app setting, which triggers a restart of the web app. Option A is wrong because the setting is available immediately after restart; Option C is wrong because the app setting is stored in the app's configuration, not in a file; Option D is wrong because the command does not affect the code.

Answer

The command fails because the password is provided in plaintext.

Answer

The setting is available immediately without restart.

Answer

The setting is stored in a local configuration file.

Question 13

You need to authenticate an Azure Function to an Azure SQL Database using a managed identity. The function has a system-assigned managed identity enabled. Which connection string setting should you use in the function's application settings?

Accepted Answer

Server=tcp:myserver.database.windows.net;Database=mydb;Authentication=Active Directory Managed Identity;. When using managed identity, you do not include User ID and Password. Instead, you set 'Authentication=Active Directory Managed Identity' in the connection string. Option A is for SQL authentication, B uses the client ID of a user-assigned managed identity, and D uses a service principal.

Answer

Server=tcp:myserver.database.windows.net;Database=mydb;Authentication=Active Directory Password;

Answer

Server=tcp:myserver.database.windows.net;Database=mydb;User Id=myuser;Password=mypassword;

Answer

Server=tcp:myserver.database.windows.net;Database=mydb;Authentication=Active Directory Managed Identity;User Id=<client-id>;

Question 14

Your app uses Azure Key Vault to store secrets. You need to grant the app access to read secrets using managed identity. Which RBAC role should you assign to the app's managed identity?

Accepted Answer

Key Vault Secrets User. Key Vault Secrets User is the least-privilege role for reading secrets. Option A is wrong because Key Vault Reader only allows listing secrets, not reading values. Option C is wrong because Key Vault Contributor allows management. Option D is wrong because Key Vault Crypto Officer is for cryptographic keys.

Answer

Key Vault Crypto Officer

Answer

Key Vault Reader

Answer

Key Vault Contributor

Question 15

Which THREE are valid ways to authenticate an Azure app to an Azure resource using managed identities?

Accepted Answer

Managed identity using Azure AD tokens. System-assigned, user-assigned, and when accessing resources that support managed identity authentication, the app can use the managed identity. Option D is wrong because certificates are not a managed identity type. Option E is wrong because connection strings are not managed identity.

Answer

Client certificate

Answer

Connection string