AZ-204 Practice Test 36 — 15 Questions

Question 1

Your company stores sensitive financial documents in Azure Blob Storage. You need to ensure that only authorized users can access the blobs, and you must avoid exposing storage account keys. You want to generate time-limited URLs that grant access to specific blobs. What should you use?

Accepted Answer

Shared Access Signatures (SAS). Option D is correct because Shared Access Signatures (SAS) allow you to grant time-limited, specific permissions to a blob without exposing account keys. Option A is incorrect because Azure RBAC does not provide time-limited, delegated access to a specific blob. Option B is incorrect because storage account keys grant full access to the account. Option C is incorrect because managed identities are used for service-to-service authentication, not for generating time-limited URLs.

Answer

Storage account access keys

Answer

Azure role-based access control (RBAC)

Answer

Managed identities for Azure resources

Question 2

You are reviewing an ARM template that deploys a network security group (NSG) for a web application. The exhibit shows the security rules. The web application runs on port 443. You need to ensure that HTTPS traffic from the internet can reach the web servers. What is the issue with the current configuration?

Accepted Answer

There is no rule to allow HTTPS traffic (port 443) from the internet.. The NSG has only two inbound rules: AllowSSH (port 22 from VirtualNetwork) and DenyAll (all traffic). There is no rule to allow HTTPS (port 443) from the internet. The DenyAll rule will block all traffic that does not match a higher-priority allow rule. Therefore, Option C is correct. Option A is incorrect because the DenyAll rule is not incorrectly placed; it's needed to block other traffic. Option B is incorrect because the SSH rule is not blocking HTTPS; it's just not allowing it. Option D is incorrect because the priority of 100 is fine.

Answer

The SSH rule is allowing SSH from the internet, which is a security risk.

Answer

The SSH rule should have a higher priority (lower number) to ensure SSH access.

Answer

The DenyAll rule should have a lower priority (higher number) to allow more specific rules.

Question 3

Your company uses Azure Service Bus topics and subscriptions to send order notifications. You notice that some messages are not being delivered to a subscription. The subscription has a SQL filter that matches messages with a 'region' property equal to 'EU'. You verify that the messages have 'region' set to 'eu' (lowercase). What is the most likely cause?

Accepted Answer

The SQL filter is case-sensitive and 'EU' does not match 'eu'.. Option B is correct because SQL filters in Service Bus are case-sensitive. Option A is wrong because the Action property does not affect filtering. Option C is wrong because the default filter is 'MatchAll', which would match all messages. Option D is wrong because the subscription already exists.

Answer

The subscription is disabled.

Answer

The subscription has no filter defined.

Answer

The subscription has a correlation filter instead.

Question 4

You deploy the above policy to an Azure API Management API. What is the effect?

Accepted Answer

Limits the API to 100 calls per 60 seconds per subscription key.. Option B is correct. The policy limits calls to 100 per 60 seconds per subscription key. Option A is wrong because it applies per key, not per IP. Option C is wrong because it limits calls, not bandwidth. Option D is wrong because the policy is inbound, not outbound.

Answer

Limits the total bandwidth to 100 MB per 60 seconds.

Answer

Limits the API to 100 calls per 60 seconds from the backend.

Answer

Limits the API to 100 calls per 60 seconds per client IP address.

Question 5

You are designing a solution that stores large media files (up to 5 GB each) in Azure Blob Storage. The application must support concurrent uploads with the ability to pause and resume. You need to ensure efficient use of network bandwidth and provide progress reporting. Which approach should you use?

Accepted Answer

Use the Azure Storage SDK to upload blobs in blocks, and implement pause/resume logic using block IDs.. Option A is correct because the Azure Storage client library's block blob upload methods automatically use chunked upload with retry, and the Put Block and Put Block List operations allow manual control for pause/resume. The block blob API supports concurrent uploads and progress tracking. Option B is incorrect because Append blobs are for append operations, not for large file uploads. Option C is incorrect because Page blobs are for random access and are not optimized for uploads. Option D is incorrect because AzCopy is a command-line tool, not suitable for an application embedding.

Answer

Use AzCopy with the --resume parameter.

Answer

Use Page blobs with 512-byte pages.

Answer

Use Append blobs and append data in chunks.

Question 6

A healthcare application stores patient diagnostic images in Azure Blob Storage. The images are accessed by radiologists worldwide. You need to reduce latency for image retrieval while maintaining security and compliance. Which TWO actions should you take?

Accepted Answer

Enable Azure CDN or Azure Front Door with caching rules.. Options A and D are correct. Enabling Azure CDN or Azure Front Door caches content at edge locations, reducing latency. Geo-redundant storage provides replication to another region, but does not reduce latency for read access unless read-access is enabled (RA-GRS). Option B (RA-GRS) provides a secondary read endpoint, but does not improve latency for all users globally. Option C incorrectly suggests deleting the blob after reading. Option E (Premium tier) improves performance but is costly and not specifically for global latency reduction.

Answer

Upgrade to Premium Block Blob storage.

Answer

Enable read-access geo-redundant storage (RA-GRS).

Answer

Use Blob Storage lifecycle management to delete blobs after reading.

Question 7

You are reviewing a lifecycle management rule configured on an Azure Storage account. The rule is defined as shown in the exhibit. You notice that blobs tagged with project=temp are not being moved to the Archive tier as expected. What is the most likely cause?

Accepted Answer

The condition uses an incorrect operator for age.. Option C is correct. The rule uses `"greaterThan": 90` which is not a valid operator. Lifecycle management supports `daysAfterModificationGreaterThan` or `daysAfterCreationGreaterThan`. The invalid condition causes the rule to fail. Option A is incorrect because tags are supported. Option B is incorrect because block blobs support SetBlobTier. Option D is incorrect because Archive tier is available for block blobs.

Answer

The rule does not include a filter for blob index tags.

Answer

The Archive tier is not supported for this storage account type.

Answer

Block blobs cannot be moved to the Archive tier.

Question 8

You are a developer at a global e-commerce company. The company uses Azure Blob Storage to store product images and customer uploads. The application is deployed in the East US region. You need to design a solution that meets the following requirements: - Customers upload images (up to 10 MB) that must be immediately accessible worldwide after upload. - You must minimize egress costs for data transfer from Azure to customers. - The solution must be resilient to regional outages. - You must not use any custom caching logic. Which approach should you implement?

Accepted Answer

Use Azure Front Door with caching enabled, and point it to a single Blob Storage account in East US.. Option A is correct. Azure Front Door provides global load balancing and caching at edge locations, reducing latency and egress costs by serving cached content from the closest edge. It also provides regional failover. Option B is incorrect because CDN alone does not provide regional failover or origin load balancing. Option C is incorrect because RA-GRS provides a secondary read endpoint but does not cache globally; egress costs are still incurred from the secondary region. Option D is incorrect because Premium Blob Storage does not provide global caching or failover.

Answer

Use read-access geo-redundant storage (RA-GRS) and direct customers to the secondary endpoint for reads.

Answer

Use Premium Block Blob storage in multiple regions and use Traffic Manager for routing.

Answer

Use Azure CDN from Microsoft with the storage account as origin, and enable geo-replication on the storage account.

Question 9

Which TWO actions can you take to improve the performance of an Azure App Service web app that makes calls to an external API? (Choose two.)

Accepted Answer

Use async/await patterns in the code to avoid blocking threads.. Options B and D are correct. Caching responses reduces redundant calls, and using async/await frees up threads. Option A is wrong because increasing instance count adds cost but may not improve per-request latency. Option C is wrong because multiple API calls per request increase latency. Option E is wrong because keeping a persistent connection may help but is not a direct performance improvement for the described issue.

Answer

Use a connection pool to reuse connections to the API.

Answer

Send multiple requests in parallel to the API.

Answer

Scale out the App Service to more instances.

Question 10

You are deploying a web app on Azure App Service that stores secrets in Azure Key Vault. The app uses managed identity to access Key Vault. During testing, you get a 403 Forbidden error when the app tries to read a secret. What is the most likely cause?

Accepted Answer

The Key Vault access policy does not grant the managed identity the 'Get' permission for secrets.. The app's managed identity must be granted a Key Vault access policy (or RBAC role) to read secrets. Without it, Key Vault denies access with a 403 error. Option A is incorrect because enabling soft-delete doesn't affect access. Option C is incorrect because the firewall rule would block all access, not just for the app. Option D is incorrect because the managed identity is for the app, not the user.

Answer

The managed identity is not assigned to the app.

Answer

The Key Vault has soft-delete enabled.

Answer

The Key Vault firewall is set to allow only selected networks.

Question 11

Your company uses Microsoft Entra ID for identity management. You need to ensure that users accessing a line-of-business application from unmanaged devices must complete a multi-factor authentication (MFA) challenge. What should you configure?

Accepted Answer

Create a Conditional Access policy that requires MFA for users accessing the application, with a condition for 'Device state' set to 'Unmanaged'.. Conditional Access policies in Microsoft Entra ID allow you to enforce MFA based on device compliance. Option C is the correct approach. Option A (Intune) is used for device management but not directly for MFA enforcement. Option B (Privileged Identity Management) is for just-in-time access. Option D (identity protection) is for risk-based policies, not device state.

Answer

Configure a device compliance policy in Microsoft Intune.

Answer

Create a Conditional Access policy that requires MFA for all users.

Answer

Enable risk-based Conditional Access in Microsoft Entra ID Protection.

Question 12

You are developing a serverless application using Azure Functions that processes sensitive data. The function is triggered by an Azure Storage queue. You need to ensure that data in transit between the function and the storage account is encrypted using a customer-managed key (CMK) and that the storage account's firewall only allows access from the function's virtual network. Which two actions should you take? (Choose two.)

Accepted Answer

Configure the storage account firewall to allow access only from the function's virtual network.. To enforce CMK for data in transit, you need to use HTTPS and also require secure transfer. However, CMK for data in transit is not supported; CMK is for data at rest. The question asks for data in transit encryption using CMK, but that is not a standard feature. The best interpretation is to ensure encryption in transit (HTTPS) and restrict network access. Option A is correct: enable 'Secure transfer required' on the storage account to enforce HTTPS. Option C is correct: configure the storage account firewall to allow access only from the function's virtual network (via service endpoint or private endpoint). Option B is wrong because configuring CMK in Key Vault does not encrypt data in transit. Option D is wrong because VNet integration for the function app does not directly restrict storage access.

Answer

Configure a customer-managed key in Azure Key Vault and associate it with the storage account.

Answer

Enable VNet integration on the function app to route traffic through a virtual network.

Question 13

You are designing a solution to store secrets for a microservices application running on Azure Kubernetes Service (AKS). The secrets must be automatically rotated and remain available if the Key Vault is temporarily unavailable. Which TWO options meet the requirements?

Accepted Answer

Use the AKS add-on for Azure Key Vault (Secrets Store CSI driver) with a sync to Kubernetes secrets.. Option A is correct: AKS add-on for Key Vault (Secrets Store CSI driver) with a sync to Kubernetes secrets provides offline caching. Option D is correct: using a sidecar container that caches secrets locally in a volume also provides availability during Key Vault downtime. Option B is incorrect because reading directly from the SDK does not provide caching. Option C is incorrect because managed identity is an authentication method, not a solution for availability. Option E is incorrect because storing secrets in plain text is insecure and violates the requirement.

Answer

Have each microservice read secrets directly from Key Vault using the SDK.

Answer

Assign a managed identity to each pod and use it to authenticate to Key Vault.

Answer

Store secrets as plain text in Kubernetes secrets.

Question 14

Which THREE components are required to implement a secure authentication flow for a single-page application (SPA) using Microsoft Entra ID to call Microsoft Graph? (Choose three.)

Accepted Answer

Authorization endpoint. Options A, B, and D are correct. A SPA needs a client ID, authorization endpoint, and token endpoint. Option C is wrong because client secret is not used in public clients like SPAs. Option E is wrong because certificate is for confidential clients.

Answer

Client certificate

Answer

Client secret

Question 15

Your company has a microservices application deployed on Azure Kubernetes Service (AKS). One service, OrderProcessor, needs to read messages from an Azure Service Bus queue and write results to Azure Cosmos DB. The processing must be reliable: if the service crashes mid-processing, the message should not be lost and should be retried. You also need to ensure that messages are processed in order within a partition. The solution should minimize code changes and leverage platform features. Which approach should you use?

Accepted Answer

Use Azure Functions with a Service Bus trigger that uses sessions for ordered processing.. Option A is correct because Azure Functions with Service Bus trigger uses peek-lock mode by default, which ensures reliable processing; if the function fails, the message is not completed and will be retried; Service Bus sessions provide ordered processing per partition. Option B is wrong because the Service Bus SDK with ReceiveAndDelete would lose messages if the service crashes after receiving but before processing. Option C is wrong because Event Hubs is not designed for ordered processing per partition with message-level retries; also it's not a queue for command messages. Option D is wrong because the Service Bus SDK with PeekLock requires manual handling of message completion, lock renewal, and session management, leading to more code and complexity.

Answer

Use the Azure Service Bus SDK with ReceiveAndDelete mode in a background worker.

Answer

Use the Azure Service Bus SDK with PeekLock mode and manual message completion.

Answer

Use Azure Event Hubs with a consumer group and checkpointing.