AZ-204 Practice Test 32 — 15 Questions

Question 1

Your team is using Azure DevOps to deploy an Azure Kubernetes Service (AKS) cluster. You want to automatically roll back a deployment if the new version causes a high error rate. Which Azure service should you use to implement this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Azure Monitor. Azure Monitor, specifically Application Insights, can be configured with alert rules that trigger on metrics like server error rate. When the error rate exceeds a threshold, an Azure Monitor alert can invoke an Azure Automation runbook or a webhook to initiate a Kubernetes rollback via `kubectl rollout undo` or a Helm rollback. This provides automated, event-driven rollback without manual intervention.

Answer

Azure Service Health

Answer

Azure Traffic Manager

Answer

Azure Policy

Question 2

You are designing a solution that uses Azure Functions to process events from Azure Event Hubs. The function must process events in order and exactly once per partition. What should you do?

Accepted Answer

Use the Event Hubs trigger for Azure Functions with default configuration.. The Event Hubs trigger for Azure Functions, by default, processes events in order and exactly once per partition. It uses checkpointing to track the offset of the last successfully processed event, ensuring that each event is processed only once and in sequence within a partition. This default behavior aligns with the requirement without needing additional configuration.

Answer

Enable session state in the function app.

Answer

Use a Service Bus queue trigger with a singleton lock.

Answer

Disable checkpointing to ensure no duplicates.

Question 3

A containerized checkout API deployed to Azure Container Apps must scale to zero when idle and scale out based on queue length. What should the developer configure?

Accepted Answer

A KEDA-based scale rule for the queue trigger. Azure Container Apps supports KEDA (Kubernetes Event-Driven Autoscaling) for scaling based on external metrics. A KEDA-based scale rule configured with an Azure Queue Storage trigger allows the containerized checkout API to scale to zero when no messages are in the queue and scale out dynamically as queue length increases, meeting the requirement precisely.

Answer

A manual replica count only

Answer

An Availability Set

Answer

An Azure Front Door health probe

Question 4

You are troubleshooting an Azure App Service that runs a Node.js application. The application returns HTTP 500 errors intermittently. Application Insights is configured. Which telemetry item should you examine first to find the root cause?

Accepted Answer

Exceptions. HTTP 500 errors indicate server-side failures, and Application Insights captures these as Exception telemetry when an unhandled exception occurs in the Node.js runtime. Examining the Exception telemetry first allows you to see the stack trace, error message, and call details, which directly point to the root cause of the intermittent failures.

Answer

Traces

Answer

Dependencies

Answer

Requests

Question 5

Your company develops a microservices application deployed to Azure Kubernetes Service (AKS). You need to enable secure communication between services using managed identities. Which Azure service should you use to manage the identities and access control for the pods?

Accepted Answer

Microsoft Entra Workload ID. Microsoft Entra Workload ID (formerly Azure AD Workload Identity) is the correct choice because it integrates with Kubernetes to automatically project an Azure AD-managed identity into each pod. This allows pods to authenticate to Azure resources (e.g., Key Vault, Storage) without managing secrets, using federated identity credentials that map a Kubernetes service account to an Azure AD application or user-assigned managed identity.

Answer

Azure Service Bus

Answer

Azure Key Vault

Answer

Azure Policy

Question 6

You are designing a solution that stores large media files (up to 5 GB each) in Azure Blob Storage. The application must support concurrent uploads with the ability to pause and resume. You need to ensure efficient use of network bandwidth and provide progress reporting. Which approach should you use?

Accepted Answer

Use the Azure Storage SDK to upload blobs in blocks, and implement pause/resume logic using block IDs.. Azure Blob Storage supports block blobs, which allow you to upload large files in independent blocks. By using the Azure Storage SDK, you can assign unique block IDs to each block, enabling pause/resume by tracking which block IDs have been committed. This approach also provides fine-grained progress reporting per block and efficient network bandwidth usage through parallel uploads.

Answer

Use AzCopy with the --resume parameter.

Answer

Use Page blobs with 512-byte pages.

Answer

Use Append blobs and append data in chunks.

Question 7

You have an Azure App Service web app that uses Azure SQL Database. The connection string is stored in Azure Key Vault. You need to automatically rotate the database password every 30 days without app downtime. Which solution should you implement?

Accepted Answer

Store the connection string as a Key Vault reference in App Service application settings and use Key Vault's auto-rotation.. Key Vault references in App Service application settings allow the web app to dynamically retrieve the connection string from Key Vault at runtime. By enabling Key Vault's auto-rotation feature (e.g., using a rotation function or event grid trigger), the database password can be rotated every 30 days without any app downtime, as the app reads the latest secret on each request or after a cached secret expires.

Answer

Use Azure CLI to update the connection string in App Service settings.

Answer

Use Managed Identity to access SQL Database instead of a password.

Answer

Update the connection string in the application code and redeploy.

Question 8

You are deploying a sensitive application on Azure Kubernetes Service (AKS). You need to ensure that secrets, such as database connection strings, are encrypted at rest and in transit, and that the cluster has no static credentials. Which feature should you enable?

Accepted Answer

Use Azure Key Vault Provider for Secrets Store CSI Driver. The Azure Key Vault Provider for Secrets Store CSI Driver integrates with AKS to securely fetch secrets from Azure Key Vault, encrypting them at rest (Key Vault uses AES-256) and in transit (TLS 1.2+). It eliminates static credentials by using a managed identity or service principal to authenticate to Key Vault, ensuring no secrets are stored on disk or in etcd.

Answer

Enable etcd encryption at rest

Answer

Enable Azure Disk Encryption on the node pools

Answer

Assign a managed identity to the AKS cluster

Question 9

You have an Azure CDN profile that caches content from a storage account. Users in Europe report that images load slowly. You need to improve performance for European users. What should you do?

Accepted Answer

Add an additional CDN endpoint with a European origin. Adding an additional CDN endpoint with a European origin (e.g., an Azure Storage account in a European region) reduces latency by serving content from a geographically closer point of presence (PoP). Azure CDN uses a global network of edge servers, but if the origin server is far from the users, the first-hop latency from the edge to the origin can still be high. By placing an origin in Europe, the CDN can fetch content from a nearby origin, minimizing the distance data must travel and improving load times for European users.

Answer

Enable compression on the CDN

Answer

Enable prefetching on the CDN

Answer

Configure caching rules to cache longer

Question 10

You are designing a solution for a multi-tenant SaaS application where each tenant's data is stored in separate Azure SQL databases. You need to ensure that no tenant can access another tenant's database, even if the application is compromised. What should you implement?

Accepted Answer

Assign each tenant a managed identity with a dedicated SQL login and database-level permissions. Assigning each tenant a managed identity with a dedicated SQL login and database-level permissions ensures that even if the application is compromised, the attacker cannot access another tenant's database. Managed identities provide an Azure AD-backed identity for the application, and by mapping each tenant to a separate SQL login with permissions scoped to their specific database, you enforce tenant isolation at the database authentication and authorization layer. This prevents cross-tenant access because the application can only authenticate to the database corresponding to the tenant's managed identity.

Answer

Configure a server-level firewall rule for each tenant's IP range

Answer

Implement connection pooling with a single identity

Answer

Use a single database-level login and row-level security (RLS) to filter data

Question 11

You need to deploy a web application to Azure App Service. The application requires a custom domain name and SSL/TLS certificate. You want to automate the deployment using Azure CLI. Which command should you use to upload the SSL certificate to the App Service?

Accepted Answer

az webapp config ssl upload. The `az webapp config ssl upload` command is the Azure CLI command used to upload an SSL/TLS certificate (in .pfx format) to an existing Azure App Service web app. This command binds the certificate to the app, enabling HTTPS for custom domains.

Answer

az appservice web config ssl upload

Answer

az appservice certificate import

Answer

az webapp certificate upload

Question 12

A team develops an Azure Functions app that processes IoT telemetry. They notice cold start latency is impacting performance. The function uses the Consumption plan. Which action reduces cold starts most effectively?

Accepted Answer

Change to Premium plan with pre-warmed instances. The Consumption plan for Azure Functions can cause cold start latency because the function app is deallocated after a period of inactivity. Changing to the Premium plan with pre-warmed instances keeps a specified number of instances always running and ready to handle requests, eliminating the cold start delay for those instances. This is the most effective action among the options to reduce cold starts.

Answer

Use Durable Functions for long-running workflows

Answer

Increase the function timeout to maximum

Answer

Use a dedicated App Service plan

Question 13

A company is developing an application that processes orders. The application uses Azure Service Bus queues to decouple order submission from processing. During peak hours, some messages are not processed within the required time, causing order delays. The team needs to increase throughput without changing the existing message processing logic. What should they do?

Accepted Answer

Increase the number of concurrent listeners on the queue.. Increasing the number of concurrent listeners on the Service Bus queue allows multiple message receivers to process messages in parallel, directly increasing throughput without altering the existing message processing logic. This leverages the competing consumers pattern, where each listener independently receives and processes messages from the same queue, effectively scaling out the processing capacity.

Answer

Use Azure Event Hubs instead of Service Bus.

Answer

Enable sessions on the queue to group related messages.

Answer

Increase the lock duration on messages.

Question 14

You are monitoring an Azure App Service using Application Insights. You want to alert when the average server response time exceeds 2 seconds over a 5-minute window. What should you create?

Accepted Answer

A metric alert with 'Server response time' as the signal. A metric alert is the correct choice because 'Server response time' is a pre-aggregated performance metric emitted by Azure App Service to Application Insights. Metric alerts evaluate this signal against a static threshold (e.g., >2 seconds) over a specified time window (e.g., 5 minutes) without needing custom queries, making them ideal for simple threshold-based monitoring of latency.

Answer

An availability alert

Answer

A log alert with a custom KQL query

Answer

An activity log alert

Question 15

You need to create a custom RBAC role that allows a security group to start and stop Azure virtual machines in a specific resource group, but not delete them or modify their network interfaces. Which set of actions should you include in the role definition?

Accepted Answer

Microsoft.Compute/virtualMachines/start/action and Microsoft.Compute/virtualMachines/deallocate/action. The custom RBAC role needs to allow starting and stopping (deallocating) VMs without permitting deletion or network interface modifications. The actions Microsoft.Compute/virtualMachines/start/action and Microsoft.Compute/virtualMachines/deallocate/action precisely grant the ability to start a VM and deallocate it (which stops and releases resources), while excluding delete or write permissions on the VM or its network interfaces.

Answer

Microsoft.Compute/virtualMachines/start/action and Microsoft.Compute/virtualMachines/powerOff/action

Answer

Microsoft.Compute/virtualMachines/restart/action and Microsoft.Compute/virtualMachines/deallocate/action

Answer

Microsoft.Compute/virtualMachines/start/action and Microsoft.Compute/virtualMachines/write