AZ-204 Practice Test 35 — 15 Questions

Question 1

You are designing a solution that uses Azure Event Grid to handle events from multiple Azure services. The events must be filtered and routed to different endpoints based on event type. Which component should you use to filter events before they are sent to subscribers?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Event subscription with filters. C is correct because Event Subscriptions in Azure Event Grid allow you to define filters on event types, subject prefixes/suffixes, and advanced filtering (e.g., based on data fields) to control which events are delivered to each subscriber. This filtering happens before the events are sent to the endpoint, ensuring only matching events are routed.

Answer

Event grid domain

Answer

Event grid topic

Answer

Event handler

Question 2

You are designing a solution where an Azure Logic App needs to send emails via Microsoft Graph. The Logic App should authenticate without user interaction. What authentication method should you use?

Accepted Answer

Use a user-assigned managed identity and grant it the Mail.Send application permission. A user-assigned managed identity provides a secure, passwordless authentication method for Azure resources. By granting it the Mail.Send application permission (not delegated), the Logic App can authenticate to Microsoft Graph without any user interaction, as managed identities are automatically managed by Azure and do not require credential rotation or storage.

Answer

Use OAuth 2.0 authorization code grant with a user account

Answer

Use a service principal and store its client secret in the Logic App configuration

Answer

Use basic authentication with an email account password

Question 3

You are designing a solution to store and serve large media files (500 MB to 2 GB) to a global audience. The files must be accessible via HTTPS with low latency. Which Azure Storage option should you use?

Accepted Answer

Azure Blob Storage with Azure CDN. Azure Blob Storage is optimized for storing large, unstructured data like media files, and integrating it with Azure CDN caches content at edge nodes worldwide, reducing latency for global users. HTTPS access is natively supported, and CDN ensures low-latency delivery by serving files from the nearest point of presence (PoP).

Answer

Azure Queue Storage

Answer

Azure Files with SMB protocol

Answer

Azure Table Storage

Question 4

You are migrating an on-premises application to Azure. The application uses a network file share (NFS) to store files. You need to minimize code changes. Which Azure storage service should you use?

Accepted Answer

Azure Files. Azure Files provides fully managed file shares in the cloud that support the Server Message Block (SMB) protocol and the Network File System (NFS) protocol. Since your on-premises application already uses an NFS share, migrating to Azure Files with NFS support allows you to mount the share directly with minimal code changes, as the application can continue to use the same file system semantics and NFS client calls.

Answer

Azure Disk Storage

Answer

Azure Blob Storage

Answer

Azure Queue Storage

Question 5

Which THREE factors should you consider when choosing between Azure Functions (Consumption plan) and Azure Container Instances for running a background job that processes messages from Azure Service Bus?

Accepted Answer

Scaling behavior (automatic vs. manual).. Option A is correct because Azure Functions on the Consumption plan provides automatic, event-driven scaling (scale controller reacts to Service Bus queue depth), whereas Azure Container Instances requires manual scaling or external orchestration, which is a key decision factor for a background message processor. Option B is correct because the Consumption plan bills per execution plus GB-s (consumption-based), while ACI bills per second for allocated vCPU and memory, making the cost model a fundamental differentiator for steady vs. bursty workloads. Option D is correct because Azure Functions has a native Service Bus trigger binding that handles message polling, peek-lock, completion/abandon, and dead-lettering automatically, whereas ACI would require you to implement the Service Bus SDK logic yourself. Option C is not a differentiator here because ACI supports custom base images but Azure Functions also supports custom containers (on Premium/Dedicated or via containerized Functions), and it is not one of the primary factors for this scenario. Option E is not a primary factor because cold start latency is a performance consideration, not a core architectural factor for choosing between these two compute options for a Service Bus background job.

Answer

Ability to use custom base images.

Answer

Cold start latency.

Question 6

You are developing an Azure Function that processes messages from an Azure Storage queue. The function must handle transient failures when writing to a downstream database. You need to implement a retry policy. What is the recommended approach?

Accepted Answer

Configure the retry policy in the function's host.json file.. Azure Functions provides a built-in retry policy that can be configured declaratively in the host.json file, specifically using the 'retry' section for fixed-delay or exponential-backoff strategies. This is the recommended approach for handling transient failures in a clean, configurable manner without custom code, and it applies to all function executions in the function app.

Answer

Do nothing; Azure Functions automatically retries failed executions indefinitely.

Answer

Use a try-catch block in the function code to retry on failure.

Answer

Use Durable Functions with a retry policy.

Question 7

Arrange the steps to implement Azure Functions with a Cosmos DB trigger in the correct order.

Accepted Answer

Create Cosmos DB, then create Function App, then add trigger binding, then write code, then test.. First create Cosmos DB, then Function App, add trigger binding, write code, test.

Answer

Create Function App, then create Cosmos DB, then add trigger binding, then write code, then test.

Answer

Create Cosmos DB, then create Function App, then write code, then add trigger binding, then test.

Answer

Create Cosmos DB, then create Function App, then add trigger binding, then test, then write code.

Question 8

You are designing a microservices architecture where each service needs to publish events to multiple subscribers. You choose Azure Event Grid. However, one of the subscribers is a third-party service that requires HTTPS endpoint and custom headers in the event delivery. How should you configure Event Grid?

Accepted Answer

Set custom headers in the event subscription's 'Delivery Properties' configuration.. Azure Event Grid allows you to specify custom HTTP headers in the 'Delivery Properties' section of an event subscription. This feature lets you add static or dynamic headers (e.g., authentication tokens or correlation IDs) that are included in the HTTPS POST request to the subscriber's endpoint. It directly addresses the requirement for custom headers without needing any additional infrastructure.

Answer

Use Event Grid's 'Advanced Filters' to add custom headers to events.

Answer

Use Event Grid domains to route events to the third-party service.

Answer

Configure a dead-letter destination to handle delivery failures.

Question 9

Your application writes temperature data to Azure Table Storage every second. You have noticed that queries for the latest readings are slower than expected. What is the most likely cause?

Accepted Answer

The PartitionKey is not being used in the query filter.. In Azure Table Storage, queries that do not include the PartitionKey in the filter result in a full table scan, which is significantly slower than a point query that uses both PartitionKey and RowKey. Since the application writes data every second, the latest readings likely have a timestamp-based RowKey, but without filtering by PartitionKey, the query must scan all partitions, causing poor performance.

Answer

The storage account access tier is set to Cool.

Answer

The table name is too long.

Answer

The application is using an outdated version of the Azure Storage SDK.

Question 10

A Kubernetes-based IoT command API on AKS must pull images from Azure Container Registry without storing registry passwords in Kubernetes secrets. What should be used?

Accepted Answer

Attach the ACR to AKS or grant the kubelet managed identity AcrPull. Attaching an ACR to an AKS cluster or granting the kubelet managed identity the AcrPull role enables Microsoft Entra ID-based authentication without storing credentials in Kubernetes secrets. The kubelet on each node uses its managed identity to obtain an ACR access token via Microsoft Entra ID, allowing secure image pulls. This approach eliminates the need for manual password management and follows security best practices for Azure-integrated workloads.

Answer

Use an App Service deployment slot

Answer

Store the ACR admin password in every deployment manifest

Answer

Make the container registry public

Question 11

You are developing a solution that uses Azure Functions with a consumption plan. The function processes messages from an Azure Service Bus queue. During a load test, you notice that the function takes a long time to start processing messages after a period of inactivity. What is the most likely cause of this cold start delay?

Accepted Answer

The function is using a consumption plan, which may scale to zero instances.. The cold start delay occurs because the consumption plan scales the function app to zero instances after a period of inactivity. When a new message arrives, Azure Functions must allocate a new instance, load the function code, and initialize the runtime, which introduces latency. This is a well-known characteristic of the consumption plan's scale-to-zero behavior.

Answer

The function timeout is set too low.

Answer

The function is using a premium plan with pre-warmed instances.

Answer

The Service Bus namespace is using the Premium tier.

Question 12

You need to ensure that secrets stored in Azure Key Vault are automatically rotated every 90 days. Which feature should you configure?

Accepted Answer

Use Key Vault secret rotation with Event Grid and Azure Functions. Azure Key Vault does not natively rotate secrets automatically. To achieve automatic rotation every 90 days, you must integrate Key Vault with Event Grid to detect secret expiration events and trigger an Azure Function that generates a new secret version and updates the expiration date. This pattern is the recommended solution for automated secret rotation.

Answer

Set an access policy for the secret

Answer

Enable soft delete and purge protection

Answer

Set a secret expiration date

Question 13

You need to grant access to a blob stored in Azure Blob Storage for 30 minutes to a user who does not have an Azure account. Which security mechanism should you use?

Accepted Answer

Shared Access Signature (SAS) token. A Shared Access Signature (SAS) token is the correct choice because it provides delegated, time-limited access to a specific blob resource without requiring the user to have an Azure account. You can set the token's expiry to 30 minutes, granting temporary access via a URI that includes the necessary authentication parameters. This mechanism is designed for scenarios where you need to grant granular, time-bound access to external users or clients.

Answer

Azure RBAC roles

Answer

Storage account access keys

Answer

Managed identity

Question 14

You are developing a serverless application using Azure Functions. The function must process messages from an Azure Storage Queue and write results to Azure Cosmos DB. Which binding should you use for the output?

Accepted Answer

Azure Cosmos DB output binding. The Azure Cosmos DB output binding allows you to write the results of queue-triggered function execution directly to a Cosmos DB container. The function processes messages from an Azure Storage Queue (input binding) and uses the output binding to insert or upsert documents into Cosmos DB without writing any SDK code.

Answer

Azure Blob Storage output binding

Answer

Azure Cosmos DB input binding

Answer

Azure Storage Queue output binding

Question 15

You query Application Insights with the KQL query in the exhibit. The chart shows a spike in 500 errors at 2:00 PM. What is the next step to diagnose the cause?

Accepted Answer

Query exceptions and traces for the 2:00 PM hour. When a spike in 500 errors is detected in Application Insights, the next logical step is to query exceptions and traces for the specific time period (2:00 PM). This allows you to correlate the error count with detailed exception messages, stack traces, and dependency calls, which directly reveal the root cause of the failures. KQL queries like `exceptions | where timestamp between (datetime(14:00) .. datetime(15:00))` or joining with `traces` provide the granular data needed for diagnosis.

Answer

Check availability tests for the same period

Answer

Scale up the App Service plan

Answer

Run a profiler on the 2:00 PM time range