AZ-204 Practice Test 35 — 15 Questions

Question 1

A company uses Azure DevOps to deploy microservices to Azure Kubernetes Service (AKS). They need to securely pull container images from Azure Container Registry (ACR) during deployment without storing credentials. Which authentication method should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Managed Identity. Managed Identity allows AKS to authenticate to ACR without storing any credentials in Azure DevOps or Kubernetes secrets. By enabling the AKS cluster's system-assigned or user-assigned managed identity with AcrPull role assignment, Azure AD automatically handles token acquisition via the Azure Instance Metadata Service (IMDS) endpoint, eliminating the need for static secrets.

Answer

ACR Tasks

Answer

ACR admin keys

Answer

Service principal with password

Question 2

You are deploying an Azure Kubernetes Service (AKS) cluster. You need to ensure that pods can access Azure resources (e.g., Azure Storage) using a managed identity without storing credentials. What should you configure?

Accepted Answer

Use Azure AD Workload Identity for Kubernetes (or aad-pod-identity) to assign managed identities to pods.. Azure AD Workload Identity (or the older aad-pod-identity) allows you to assign an Azure managed identity to a pod. The pod can then authenticate to Azure resources (e.g., Azure Storage) without storing any credentials, as the identity is projected into the pod via token exchange with the Azure Instance Metadata Service (IMDS). This directly meets the requirement of using a managed identity without credential storage.

Answer

Configure Azure AD integration on the AKS cluster for user authentication.

Answer

Create a service principal and distribute its secret to pods as a Kubernetes secret.

Answer

Enable managed identity on the AKS cluster and use cluster-level identity.

Question 3

You are developing a serverless application using Azure Functions that processes sensitive data. The function needs to access Azure Key Vault to retrieve a secret. You want to use managed identity for authentication. What should you do first?

Accepted Answer

Enable the system-assigned managed identity on the function app and grant it the Key Vault Secrets User role.. To use managed identity for authentication with Azure Key Vault, the first step is to enable a system-assigned managed identity on the function app, which creates an identity in Azure AD tied to the resource. Then, you must grant that identity the appropriate role (e.g., Key Vault Secrets User) on the Key Vault to authorize secret retrieval. This eliminates the need for storing credentials in code or configuration.

Answer

Enable the system-assigned managed identity on the Key Vault.

Answer

Store the client ID and client secret of a service principal in the function app settings.

Answer

Create a user-assigned managed identity and assign it to the Key Vault.

Question 4

An application publishes order events that multiple independent subscribers must process. Subscribers may be added later without changing the publisher. Which Azure messaging service should be used?

Accepted Answer

Azure Service Bus topic. Azure Service Bus topics support a publish/subscribe pattern where multiple independent subscribers can each receive a copy of the same message. This decouples the publisher from subscribers, allowing new subscribers to be added later without modifying the publisher. The topic's subscription mechanism ensures each subscriber processes the event independently.

Answer

Azure Blob Storage lifecycle policy

Answer

Azure Storage Queue

Answer

Azure Cache for Redis list only

Question 5

You deploy the above ARM template resource. After deployment, the web app cannot connect to Application Insights. The Application Insights resource exists in the same region. What is the most likely cause?

Accepted Answer

The app setting 'APPINSIGHTS_INSTRUMENTATIONKEY' is deprecated; you should use 'APPLICATIONINSIGHTS_CONNECTION_STRING' instead.. The ARM template likely sets the 'APPINSIGHTS_INSTRUMENTATIONKEY' app setting, which is deprecated. Application Insights now requires the 'APPLICATIONINSIGHTS_CONNECTION_STRING' app setting for authentication and telemetry ingestion, as the instrumentation key alone is no longer sufficient for newer SDK versions and regional endpoints.

Answer

The dependsOn is incorrect; it should reference the Application Insights resource ID.

Answer

The web app needs a user-assigned managed identity to access Application Insights.

Answer

The instrumentation key must be set under a different name, like 'APPINSIGHTS_KEY'.

Question 6

You are building an event-driven solution that processes orders from an Azure Storage Queue. Each order triggers an Azure Function. To improve reliability, you need to automatically retry processing if an exception occurs, but only up to 3 times. You must also preserve the original order message in a poison queue after max retries. Which configuration should you use in the function's host.json?

Accepted Answer

Set 'maxDequeueCount' to 3. The 'maxDequeueCount' setting in the host.json for an Azure Storage Queue-triggered function controls the number of times a message is dequeued for processing before it is moved to the poison queue. Setting it to 3 ensures that after three failed processing attempts (due to exceptions), the message is automatically redirected to the poison queue, preserving the original message for later inspection.

Answer

Set 'prefetchCount' to 3

Answer

Set 'newBatchThreshold' to 3

Answer

Set 'batchSize' to 3

Question 7

You need to authenticate an Azure Function to an Azure SQL Database using a managed identity. The function has a system-assigned managed identity enabled. Which connection string setting should you use in the function's application settings?

Accepted Answer

Server=tcp:myserver.database.windows.net;Database=mydb;Authentication=Active Directory Managed Identity;. The connection string `Authentication=Active Directory Managed Identity` tells the SQL client to use the system-assigned managed identity of the Azure Function to acquire an access token from Azure AD, without needing any explicit credentials. This is the standard way to authenticate an Azure resource with a managed identity to Azure SQL Database.

Answer

Server=tcp:myserver.database.windows.net;Database=mydb;Authentication=Active Directory Password;

Answer

Server=tcp:myserver.database.windows.net;Database=mydb;User Id=myuser;Password=mypassword;

Answer

Server=tcp:myserver.database.windows.net;Database=mydb;Authentication=Active Directory Managed Identity;User Id=<client-id>;

Question 8

You are creating an Azure function that uses an output binding to write messages to an Azure Storage Queue. The function must ensure that messages are not lost if the function fails after writing to the queue. Which approach should you use?

Accepted Answer

Use the queue output binding with a queue trigger input binding in the same function.. Using a queue output binding together with a queue trigger input binding leverages the Azure Functions runtime's transactional behavior. When a function has a queue trigger, the incoming message is kept in the queue until the function completes successfully. If the function fails after writing to the output queue (e.g., a crash or exception), the output binding write is rolled back (not committed), and the input message is not deleted from the source queue. This ensures no message is lost: the output message is never written if the function fails, and the input message remains for retry. Without the queue trigger, if the function were triggered by another source (e.g., HTTP), a failure after the output write could still result in the output message being committed (since the function completes), but the context of the operation might be lost. The queue trigger input binding provides the necessary atomicity for this specific scenario.

Answer

Use a separate queue client SDK to write messages and handle errors manually.

Answer

Write to the queue directly in the function code and rely on the function's retry policy.

Answer

Use a durable function to orchestrate the writing and processing.

Question 9

Your Azure Logic Apps workflow fails intermittently with timeout errors. What should you do to improve reliability?

Accepted Answer

Configure retry policies for failed actions. Intermittent timeout errors in Azure Logic Apps indicate that some actions are taking longer than the default timeout to complete. Configuring retry policies for failed actions allows the workflow to automatically reattempt the operation, which can resolve transient failures due to network congestion or temporary service unavailability. This directly improves reliability by handling intermittent timeouts without manual intervention.

Answer

Increase the action timeout to maximum

Answer

Reduce the number of parallel branches

Answer

Use Azure API Management in front of Logic Apps

Question 10

Your company has a microservices application deployed on Azure Kubernetes Service (AKS). One service, OrderProcessor, needs to read messages from an Azure Service Bus queue and write results to Azure Cosmos DB. The processing must be reliable: if the service crashes mid-processing, the message should not be lost and should be retried. You also need to ensure that messages are processed in order within a partition. The solution should minimize code changes and leverage platform features. Which approach should you use?

Accepted Answer

Use Azure Functions with a Service Bus trigger that uses sessions for ordered processing.. Azure Functions with a Service Bus trigger using sessions provides exactly-once processing and ordered message delivery within a partition. The Service Bus trigger automatically uses PeekLock mode, ensuring messages are not lost if the function crashes, and sessions guarantee FIFO ordering within a session. This minimizes code changes by leveraging the platform's built-in retry and checkpointing mechanisms.

Answer

Use the Azure Service Bus SDK with ReceiveAndDelete mode in a background worker.

Answer

Use the Azure Service Bus SDK with PeekLock mode and manual message completion.

Answer

Use Azure Event Hubs with a consumer group and checkpointing.

Question 11

Your team is migrating a legacy application to Azure. The application uses a proprietary database that is not supported by Azure SQL or Cosmos DB. You need to provide a managed database service with minimal rearchitecture. Which Azure service should you use?

Accepted Answer

Azure Virtual Machines with the database software installed. Azure Virtual Machines (IaaS) is the correct choice because the proprietary database is not supported by any Azure PaaS database service. By deploying the database software on a VM, you retain full control over the database engine and configuration, enabling a lift-and-shift migration with minimal rearchitecture. This approach avoids the need to rewrite application code or adapt to a different database schema.

Answer

Azure Database for MySQL

Answer

Azure Database Migration Service

Answer

Azure SQL Database

Question 12

You are designing a solution that uses Azure File Shares. The application requires low-latency access to files from multiple Azure virtual machines in the same region. The files are accessed frequently and must support SMB protocol. Which storage account type and tier should you recommend?

Accepted Answer

FileStorage (premium file shares).. Azure premium file shares (FileStorage) provide low-latency, high-performance access using the SMB protocol, which is required for frequently accessed files from multiple VMs in the same region. Standard tiers (cool or transaction-optimized) do not meet the low-latency requirement, and BlobStorage does not support SMB protocol natively.

Answer

Standard general-purpose v2 with cool tier.

Answer

Standard general-purpose v2 with transaction-optimized tier.

Answer

BlobStorage with hot tier.

Question 13

An application stores customer invoices in Azure Blob Storage. Deleted blobs must be recoverable for 14 days. What should be enabled?

Accepted Answer

Blob soft delete with a 14-day retention period. Blob soft delete protects against accidental deletion by retaining deleted blobs for a specified retention period. Enabling it with a 14-day retention period ensures that deleted invoices remain recoverable for exactly 14 days, meeting the requirement without additional cost or complexity.

Answer

Archive access tier

Answer

Static website hosting

Answer

Immutable blob legal hold

Question 14

You are developing a solution that needs to consume an external SOAP web service. Which approach should you use to integrate it into a modern .NET Core application?

Accepted Answer

Use the WCF Client (System.ServiceModel) to generate a proxy and call the SOAP service.. System.ServiceModel (WCF Client) provides built-in support for SOAP protocols, including WS-* standards, message security, and automatic proxy generation from WSDL. In modern .NET Core (and .NET 5+), the WCF client libraries are available via the System.ServiceModel.Http NuGet package, making it the most appropriate and feature-complete way to consume a SOAP service in a .NET Core application.

Answer

Use gRPC client to call the service.

Answer

Use HttpClient to send raw HTTP requests with SOAP envelope.

Answer

Use Azure Logic Apps with a SOAP connector.

Question 15

You are designing a solution that uses Azure Event Hubs to ingest telemetry data. The data must be encrypted at rest and in transit. Additionally, you need to ensure that only authorized applications can publish messages to the event hub. Which combination of features should you use?

Accepted Answer

Use SAS tokens or managed identities for authentication, and rely on default encryption at rest and in transit.. Azure Event Hubs automatically encrypts data at rest with Azure Storage Service Encryption (SSE) and in transit with TLS 1.2. For authorization, SAS tokens or managed identities provide the necessary application-level authentication to publish messages. This combination meets all stated requirements without additional configuration.

Answer

Use managed identities for applications and enable encryption at rest using customer-managed keys.

Answer

Use Azure Private Link to connect applications to Event Hubs.

Answer

Enable Azure Firewall on the Event Hubs namespace and use IP filtering.