AZ-204 Practice Test 34 — 15 Questions

Question 1

A long-running claims processing function must process thousands of independent files. The developer wants status tracking, checkpoints, and replay-safe orchestration. Which Azure Functions capability should be used?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Durable Functions orchestrator. Durable Functions orchestrator is correct because it provides built-in support for status tracking, checkpoints (via event sourcing), and replay-safe orchestration, which are essential for a long-running claims processing function that must handle thousands of independent files reliably. The orchestrator function manages state and execution flow, automatically saving progress and allowing replay from checkpoints in case of failures, ensuring exactly-once processing semantics.

Answer

Timer trigger only

Answer

Azure Policy remediation

Answer

Blob lifecycle management

Question 2

A company has an Azure Function app that processes messages from an Azure Storage queue. The function fails intermittently with timeout exceptions when the queue has many messages. What is the best approach to handle this?

Accepted Answer

Increase the batch size in the function's host.json. Increasing the batch size in host.json allows the function to retrieve more messages per invocation, reducing the number of polling cycles and improving throughput. This directly addresses timeout exceptions under high queue load by processing messages more efficiently within the function's execution time limit.

Answer

Upgrade to a Premium plan

Answer

Decrease the batch size to reduce processing time per batch

Answer

Scale out the function app to multiple instances

Question 3

You need to ensure that data stored in Azure Blob Storage is encrypted at rest using a customer-managed key stored in Azure Key Vault. Which feature should you configure?

Accepted Answer

Azure Storage encryption with customer-managed keys in Azure Key Vault. Azure Storage encryption with customer-managed keys in Azure Key Vault allows you to use your own encryption keys to protect data at rest in Blob Storage. This feature leverages Azure Storage Service Encryption (SSE) but wraps the data encryption key with a customer-managed key stored in Azure Key Vault, providing full control over key rotation and access policies.

Answer

Azure Disk Encryption (ADE) for the storage account

Answer

Azure Information Protection (AIP) for the blob container

Answer

Azure Storage Service Encryption (SSE) with Microsoft-managed keys

Question 4

Which TWO actions should you take to securely store and access secrets for a legacy application that cannot be modified? The application runs on an Azure Virtual Machine and needs to read a database connection string. The solution must use Azure Key Vault and adhere to the principle of least privilege.

Accepted Answer

Configure the application to read the connection string from a local file that is updated by the Key Vault extension.. The legacy application cannot be modified, so it cannot directly call the Key Vault REST API or SDK. The Azure Key Vault VM extension (also known as the Key Vault Sync extension) runs as a daemon on the VM, retrieves secrets from Key Vault using a managed identity, and writes them to a local file. The application reads the connection string from that local file, achieving secure secret access without code changes.

Answer

Create a new VM and install the Key Vault extension during provisioning.

Answer

Assign a managed identity to the legacy application.

Answer

Use a user-assigned managed identity and assign it to the VM.

Question 5

An Azure App Service application has availability failures. The developer needs distributed tracing across requests and dependencies. What should be enabled?

Accepted Answer

Application Insights with dependency tracking. Application Insights with dependency tracking is the correct choice because it provides distributed tracing across requests and dependencies in an Azure App Service application. It automatically collects telemetry data, including end-to-end transaction details, and maps dependencies like SQL databases, HTTP calls, and Azure services, enabling developers to diagnose availability failures by correlating traces across components.

Answer

Storage account static website logs

Answer

Azure Policy compliance scan

Answer

Cost Management budgets only

Question 6

Refer to the exhibit. You run the Azure CLI command to store a secret in Key Vault. Later, you run 'az keyvault secret show --vault-name myvault --name MySecret'. What will be displayed?

Accepted Answer

The secret's metadata and the value 'P@ssw0rd123'.. The `az keyvault secret show` command retrieves the secret's metadata along with its value in plaintext. When you store a secret using `az keyvault secret set`, the value is stored securely, and the `show` command returns the full secret object, including the `value` field, as demonstrated in the exhibit where the stored value is 'P@ssw0rd123'.

Answer

The secret's metadata only, without the value.

Answer

The secret's metadata with the value masked as '*****'.

Answer

An error because you cannot retrieve a secret after it is set.

Question 7

You need to diagnose why an Azure App Service web app returns HTTP 503 errors during peak traffic. Which Application Insights feature should you use?

Accepted Answer

Live Metrics. Live Metrics (D) is the correct choice because it provides real-time monitoring of server-side performance metrics, including HTTP 503 errors, as they occur during peak traffic. This allows you to immediately correlate the errors with spikes in CPU, memory, or request rates, enabling rapid diagnosis of resource exhaustion or throttling issues in the App Service plan.

Answer

Availability tests

Answer

Log Analytics query for failed requests

Answer

Application Map

Question 8

You deploy the above ARM template. Later, you update the web app's code by deploying a new ZIP package to Azure Blob Storage and updating the WEBSITE_RUN_FROM_PACKAGE setting with the new package URL. However, the web app continues to run the old code. What is the most likely cause?

Accepted Answer

The value '1' indicates the package is from local storage, not an external URL.. When the WEBSITE_RUN_FROM_PACKAGE app setting is set to '1', it tells Azure App Service to use a local package stored in the site's wwwroot folder. To use an external package from Azure Blob Storage, the setting must be set to the full URL of the blob (with a SAS token if private). Keeping the value as '1' means the service ignores the new blob URL and continues to run the old local package.

Answer

The app setting name is misspelled. It should be 'WEBSITE_RUN_FROM_ZIP'.

Answer

The setting requires a value of '0' to enable external packages.

Answer

The ARM template uses an incorrect apiVersion.

Question 9

You need to upload a large file (500 MB) to Azure Blob Storage from a .NET application with high throughput and resilience to network interruptions. Which approach should you use?

Accepted Answer

Use the Azure Storage SDK for .NET with the UploadAsync method that automatically splits the file into blocks. The Azure Storage SDK's UploadAsync method automatically uses block blob staging, splitting the 500 MB file into multiple blocks that are uploaded in parallel. This provides high throughput and resilience: if a network interruption occurs, only the failed blocks need to be retried, not the entire file. The SDK handles block management and final commit, making it ideal for large file uploads.

Answer

Use HTTP PUT with the entire file in a single request

Answer

Use the Azure Portal to upload the file

Answer

Use AzCopy with a single command

Question 10

You are developing a solution that uses Azure Container Apps. Your application is a microservice that needs to expose a gRPC endpoint. The service must scale to zero when idle. What should you do?

Accepted Answer

Deploy the microservice to Azure Container Apps and configure a scale rule with minReplicas set to 0.. Azure Container Apps natively supports gRPC endpoints and can scale to zero by setting `minReplicas` to 0 in a scale rule. This configuration allows the microservice to run only when there are active requests, reducing costs during idle periods. The combination of gRPC support and dynamic scaling makes Container Apps the correct choice for this scenario.

Answer

Use Azure Functions with a gRPC trigger.

Answer

Deploy the microservice to Azure Kubernetes Service with a virtual node.

Answer

Deploy the microservice to Azure Container Instances with a scale rule.

Question 11

You have an Azure Container Apps environment running multiple microservices. One microservice is experiencing high CPU usage and slow response times. You need to configure autoscaling rules to scale based on HTTP requests. Which scaling rule should you add?

Accepted Answer

HTTP scaling rule (KEDA). KEDA's HTTP scaling rule is specifically designed to scale Azure Container Apps based on the number of concurrent HTTP requests, which directly addresses high CPU usage and slow response times caused by request load. Unlike CPU or memory metrics, HTTP scaling reacts to incoming request volume proactively, allowing the microservice to handle spikes before resource saturation occurs.

Answer

CPU percentage scaling rule

Answer

Memory percentage scaling rule

Answer

Custom scaling rule using Azure Monitor metrics

Question 12

You have an Azure Web App that uses Azure SQL Database. You need to securely connect to the database using Managed Identity. Which connection string setting should you use?

Accepted Answer

Server=tcp:myserver.database.windows.net;Database=mydb;Authentication=Active Directory Managed Identity;User Id=myapp;. It uses the 'Authentication=Active Directory Managed Identity' keyword, which tells the SQL client to acquire an access token from Azure AD via the managed identity endpoint. The 'User Id' is set to the name of the managed identity (the app's system-assigned or user-assigned identity), and no password is needed because the token is obtained automatically. This enables a passwordless, secure connection to Azure SQL Database without storing credentials.

Answer

Server=tcp:myserver.database.windows.net;Database=mydb;User Id=myadmin;Password=mypassword;

Answer

Server=tcp:myserver.database.windows.net;Database=mydb;Integrated Security=True;

Answer

Server=tcp:myserver.database.windows.net;Database=mydb;Authentication=Active Directory Password;User Id=myuser@domain.com;Password=...;

Question 13

A company uses Azure API Management (APIM) to expose APIs to external partners. They want to validate JSON Web Tokens (JWTs) from partners' Microsoft Entra ID tenants before requests reach the backend. The solution must support multiple partner tenants and minimize latency. What should you implement?

Accepted Answer

Use APIM inbound policy with validate-jwt and specify openid-config URL for each partner tenant.. The `validate-jwt` policy in APIM can be configured with an `openid-config` URL for each partner tenant, allowing APIM to fetch the tenant-specific signing keys and validate JWTs issued by any Microsoft Entra ID tenant. This approach supports multiple tenants without adding a broker or per-tenant authorization servers, and it minimizes latency by performing validation at the APIM gateway before requests reach the backend.

Answer

Use Azure AD B2C as a token broker between partners and the API.

Answer

Configure OAuth 2.0 authorization server in APIM for each partner tenant.

Answer

Use client certificate authentication in APIM to map certificates to partner tenants.

Question 14

You are building a web application that stores user-uploaded images in Azure Blob Storage. The application requires that images be accessible only via a time-limited URL. Which security mechanism should you use?

Accepted Answer

Generate a shared access signature (SAS) token for each blob.. A shared access signature (SAS) token provides delegated, time-limited access to a specific blob without exposing the storage account key. By generating a SAS token with an expiration time, you can enforce that the image URL is only valid for a limited period, meeting the requirement exactly. This is the standard Azure mechanism for granting granular, time-bound access to blob storage resources.

Answer

Use storage account access keys in the application code.

Answer

Assign the 'Storage Blob Data Reader' role to the application's managed identity.

Answer

Use Azure Key Vault to store and retrieve the storage account key.

Question 15

You are designing a solution that stores customer order data in Azure Table Storage. The data includes OrderID (string), CustomerID (string), OrderDate (datetime), and TotalAmount (decimal). You need to query orders for a specific customer within a date range efficiently. Which partition key and row key design should you use?

Accepted Answer

PartitionKey = CustomerID, RowKey = OrderDate (inverted ticks for descending order). Azure Table Storage queries are most efficient when they use PartitionKey for exact matches and RowKey for range scans. By setting PartitionKey = CustomerID, all orders for a specific customer are stored in the same partition, allowing fast retrieval. Using RowKey = OrderDate (inverted ticks for descending order) enables efficient date-range filtering within that partition, as Azure Table Storage supports range queries on RowKey.

Answer

PartitionKey = OrderDate, RowKey = OrderID

Answer

PartitionKey = OrderDate, RowKey = CustomerID

Answer

PartitionKey = OrderID, RowKey = CustomerID