AZ-204 Practice Test 36 — 15 Questions

Question 1

A developer exposes several backend APIs through Azure API Management. Clients must be throttled by subscription to protect the backend. What should be configured?

Accepted Answer

API Management rate-limit or quota policy. Azure API Management provides built-in rate-limit and quota policies that allow you to throttle client requests based on the subscription key. This directly protects backend services from excessive traffic by enforcing per-subscription call rates and quotas, which aligns with the requirement to throttle clients by subscription.

Answer

Blob soft delete

Answer

Application Insights sampling

Answer

Private DNS zone only

Question 2

A Durable Functions workflow for a checkout API must call five independent activity functions and continue only after all results are available. Which pattern is appropriate?

Accepted Answer

Fan-out/fan-in. The fan-out/fan-in pattern is correct because Durable Functions provides the `CallActivityAsync` method in parallel to invoke multiple independent activity functions simultaneously, and the `Task.WhenAll` pattern waits for all results before proceeding. This matches the requirement to call five independent activities and continue only after all results are available, which is the exact definition of fan-out/fan-in.

Answer

Human interaction

Answer

Function chaining

Answer

Monitor pattern

Question 3

You are developing a web app that processes images uploaded by users. The processing can take up to 30 seconds per image. You need to ensure that the web app remains responsive and can handle spikes in traffic. Which Azure service should you use to offload the image processing?

Accepted Answer

Azure Queue Storage. Azure Queue Storage is correct because it provides a durable, asynchronous message queue that can decouple the web app's frontend from the long-running image processing task. By placing a message for each image onto a queue, the web app can immediately return a response to the user, while a background worker (e.g., an Azure Function or WebJob) polls the queue and processes images as capacity allows. This pattern ensures the web app remains responsive under traffic spikes, as the queue acts as a buffer that scales independently.

Answer

Azure Cosmos DB

Answer

Azure Event Grid

Answer

Azure SignalR Service

Question 4

Refer to the exhibit. You run the Azure CLI command to retrieve a secret from Azure Key Vault. The output shows the secret metadata but not the secret value. The command returns without error. What is the most likely cause?

Accepted Answer

The command output only shows metadata by default; you must specify --query "value" to retrieve the secret value.. The Azure CLI `az keyvault secret show` command returns the secret metadata (including attributes like id, enabled, created, updated) by default, but does not include the secret value unless you explicitly request it using the `--query "value"` parameter. Since the command completed without error and only metadata was shown, the most likely cause is that the output was not filtered to retrieve the secret value.

Answer

The secret has expired.

Answer

The user does not have the Key Vault Secrets Officer role.

Answer

The secret is in a soft-deleted state.

Question 5

A company has an Azure Service Bus namespace with a topic that receives high-throughput messages. They need to ensure that if a subscriber fails, messages are not lost and can be replayed. The subscriber is a client application that uses the PeekLock receive mode. What should they configure?

Accepted Answer

Enable dead-lettering on the subscription.. Dead-lettering on a subscription allows messages that cannot be processed by a subscriber to be moved to a dead-letter queue (DLQ) instead of being lost. When a subscriber using PeekLock mode fails to process a message (e.g., exceeds MaxDeliveryCount or the lock expires), the message is automatically transferred to the DLQ. This ensures messages are preserved and can be replayed later by reprocessing the DLQ, meeting the requirement for no message loss and replay capability.

Answer

Enable auto-forwarding on the subscription.

Answer

Set a SQL filter on the subscription.

Answer

Disable dead-lettering on the subscription.

Question 6

A web app uses Azure Key Vault to store secrets. The app runs in a production environment and needs to authenticate to Key Vault without storing connection strings in configuration files. Which authentication method should be used?

Accepted Answer

Managed identity. Managed identity (Option B) is correct because it allows the web app to authenticate to Azure Key Vault without storing any credentials in code or configuration files. Azure automatically manages the identity for the app, and the app uses the Azure Identity SDK to obtain tokens via the Azure Instance Metadata Service (IMDS) endpoint, which eliminates the need for connection strings or secrets.

Answer

Client secret stored in app settings

Answer

Storage account access keys

Answer

Certificate stored in Key Vault

Question 7

You are developing a solution that needs to store and retrieve JSON documents with a flexible schema. The data is accessed via REST API and requires low-latency reads. Which Azure Storage service should you use?

Accepted Answer

Azure Cosmos DB. Azure Cosmos DB is the correct choice because it natively supports storing and querying JSON documents with a flexible schema via its SQL API, and it guarantees single-digit millisecond read latencies at the 99th percentile, which meets the low-latency requirement. Unlike other Azure storage services, Cosmos DB is a fully managed NoSQL database designed for REST API access with automatic indexing of all JSON properties.

Answer

Azure Blob Storage

Answer

Azure Table Storage

Answer

Azure Files

Question 8

You are deploying a Java application to Azure App Service on Linux. The application requires a specific JDK version not available in the built-in stack. You need to provide the JDK without creating a custom container. What should you do?

Accepted Answer

Use a startup script to download and set JAVA_HOME. Azure App Service on Linux allows you to use a startup script to download a custom JDK and set the JAVA_HOME environment variable before the application starts. This approach avoids the need for a custom container while providing the specific JDK version required by the application.

Answer

Mount an Azure Files share containing the JDK

Answer

Use the Azure App Service Windows stack with a custom JDK

Answer

Create a custom Docker container and deploy to App Service

Question 9

A financial services company uses Azure Container Instances (ACI) to run batch processing jobs. Each job processes sensitive financial data and must use a custom container image stored in Azure Container Registry (ACR). The security requirements are: the ACI container must authenticate to ACR using a managed identity, the container must run as a non-root user, and all secrets must be injected via environment variables from Azure Key Vault using the managed identity. The ACI instance must also be deployed into a virtual network (VNet) to restrict network access. What configuration should you use?

Accepted Answer

Create a user-assigned managed identity, assign it to both ACI and ACR (with AcrPull role), grant it Key Vault access, and deploy ACI with the identity and VNet integration.. Using a user-assigned managed identity provides a persistent identity that can be assigned to both Azure Container Instances (ACI) and granted access to Azure Container Registry (ACR) and Azure Key Vault. This satisfies all security requirements: authentication to ACR via managed identity, non-root user execution (configured separately), and secret injection from Key Vault. VNet integration restricts network access. Option A is incorrect because a system-assigned managed identity is tied to the ACI lifecycle and cannot be shared across resources; while you can assign permissions to that identity on ACR, it does not provide the same level of control and persistence as a user-assigned identity. Option C is incorrect because using admin credentials for ACR is not secure and defeats the purpose of managed identities. Option D is incorrect because a service principal requires managing credentials, introducing security risks and additional overhead.

Answer

Create a system-assigned managed identity for ACI, assign AcrPull role to the identity, and grant it Key Vault access. Deploy ACI with VNet integration.

Answer

Enable ACR admin account, use admin credentials in ACI, and store secrets in Key Vault with a system-assigned managed identity for ACI.

Answer

Create a service principal, assign AcrPull role and Key Vault access, store the service principal secret in Key Vault, and configure ACI to use the service principal.

Question 10

Your application writes millions of small records (each under 1 KB) to Azure Table Storage every day. You notice that query performance degrades over time. Which design change would most improve performance?

Accepted Answer

Use a hash of the timestamp as the PartitionKey to distribute writes evenly.. Using a hash of the timestamp as the PartitionKey distributes writes evenly across partition ranges, preventing hot partitions. Azure Table Storage scales by splitting partitions across storage nodes; sequential timestamps create a hot partition on the last node, degrading throughput. A hash ensures uniform load, maximizing the account's 20,000 IOPS per partition target.

Answer

Store all records in a single blob and use Blob Storage.

Answer

Increase the storage account's throughput limits.

Answer

Use a single PartitionKey and a sequential RowKey.

Question 11

You are deploying a microservices application to Azure Kubernetes Service (AKS). One service needs to retrieve configuration values from Azure App Configuration. The configuration includes sensitive values that must be stored in Azure Key Vault. The solution should not require application code changes to reference Key Vault. What should you use?

Accepted Answer

Store the configuration values as Key Vault references in Azure App Configuration.. Azure App Configuration supports Key Vault references, which allow you to store a reference to a secret in Key Vault rather than the secret itself. When the application retrieves the configuration value, App Configuration automatically resolves the reference and fetches the secret from Key Vault, requiring no code changes. This satisfies the requirement of storing sensitive values in Key Vault while keeping the application code unchanged.

Answer

Use Azure AD managed identity to access Key Vault directly from the service.

Answer

Store the secrets in Kubernetes Secrets and mount them as environment variables.

Answer

Use the Azure Key Vault SDK directly in the service to retrieve secrets.

Question 12

A developer is building an application that needs to store and retrieve large binary files (e.g., images, videos). The application runs on Azure Virtual Machines. Which Azure service provides the most cost-effective storage for these files?

Accepted Answer

Azure Blob Storage. Azure Blob Storage is designed specifically for storing massive amounts of unstructured data, such as images and videos, and offers the lowest cost per gigabyte for large binary files compared to other Azure storage options. It supports scalable, durable, and highly available storage with tiered pricing (Hot, Cool, Archive) to optimize costs based on access patterns.

Answer

Azure SQL Database

Answer

Azure Cosmos DB

Answer

Azure Files

Question 13

You are designing a solution that uses Azure Event Grid to handle events from multiple Azure services. The events must be filtered and routed to different endpoints based on event type. Which component should you use to filter events before they are sent to subscribers?

Accepted Answer

Event subscription with filters. C is correct because Event Subscriptions in Azure Event Grid allow you to define filters on event types, subject prefixes/suffixes, and advanced filtering (e.g., based on data fields) to control which events are delivered to each subscriber. This filtering happens before the events are sent to the endpoint, ensuring only matching events are routed.

Answer

Event grid domain

Answer

Event grid topic

Answer

Event handler

Question 14

Your company is deploying a multi-container application using Azure Container Instances (ACI) in a virtual network. You need to ensure that containers can communicate with each other using localhost. Which TWO actions should you take?

Accepted Answer

Deploy all containers in the same container group.. Containers within the same container group in Azure Container Instances share the same network namespace, including the same IP address and port space. This allows them to communicate over localhost (127.0.0.1) without additional configuration, as they are essentially running on the same virtual machine. Option E is incorrect because using the container group's FQDN does not enable localhost communication; the FQDN resolves to the group's IP address, which is not localhost. Containers in the same group can communicate via localhost directly, without needing the FQDN.

Answer

Define environment variables on each container with the hostnames.

Answer

Assign different private IP addresses to each container.

Answer

Deploy containers in separate container groups and use service discovery.

Answer

Use the container group's fully qualified domain name (FQDN) to communicate.

Question 15

You are designing a solution where an Azure Logic App needs to send emails via Microsoft Graph. The Logic App should authenticate without user interaction. What authentication method should you use?

Accepted Answer

Use a user-assigned managed identity and grant it the Mail.Send application permission. A user-assigned managed identity provides a secure, passwordless authentication method for Azure resources. By granting it the Mail.Send application permission (not delegated), the Logic App can authenticate to Microsoft Graph without any user interaction, as managed identities are automatically managed by Azure and do not require credential rotation or storage.

Answer

Use OAuth 2.0 authorization code grant with a user account

Answer

Use a service principal and store its client secret in the Logic App configuration

Answer

Use basic authentication with an email account password