AZ-204 Practice Test 37 — 15 Questions

Question 1

You need to store a large number of small files (each < 100 KB) that will be accessed frequently from a web application. The files are static assets (CSS, JavaScript, images). Which Azure storage option provides the best performance for serving these files directly to users?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Azure Blob Storage with Azure CDN. Azure Blob Storage is optimized for storing large volumes of unstructured data, including small static files. By integrating Azure CDN, you cache these files at edge nodes closer to users, drastically reducing latency and offloading origin requests. This combination provides the best performance for frequently accessed static assets served directly to a web application's users.

Answer

Azure Queue Storage

Answer

Azure Table Storage

Answer

Azure Files

Question 2

You are developing a serverless function using Azure Functions that needs to write logs to a Log Analytics workspace. The function uses a managed identity. Which RBAC role should you assign to the function's managed identity?

Accepted Answer

Log Analytics Contributor. The Log Analytics Contributor role is required because it grants the managed identity the necessary permissions to send data to a Log Analytics workspace, including the ability to create and manage data collection rules and write log data. This role is specifically designed for scenarios where an Azure resource, such as an Azure Function, needs to ingest logs into Log Analytics via the Data Collection API.

Answer

Log Analytics Reader

Answer

Monitoring Contributor

Answer

Storage Blob Data Contributor

Question 3

You are designing a serverless application using Azure Functions. The solution must process messages from an Azure Service Bus queue and update a Cosmos DB database. Which binding configuration should you use on the function?

Accepted Answer

Service Bus trigger with Cosmos DB output binding. The requirement specifies processing messages from an Azure Service Bus queue and updating a Cosmos DB database. A Service Bus trigger binds the function to the queue, and a Cosmos DB output binding writes the processed data directly to Cosmos DB, enabling a seamless serverless workflow without additional code for database operations.

Answer

Service Bus trigger with Table storage output binding

Answer

Blob trigger with Cosmos DB output binding

Answer

HTTP trigger with Cosmos DB input binding

Question 4

Which TWO actions should you take to enable a user-assigned managed identity for an Azure App Service web app?

Accepted Answer

Create the managed identity resource in Microsoft Entra ID.. A user-assigned managed identity is a standalone Azure resource created in Microsoft Entra ID (formerly Azure AD). It must exist as an identity resource before it can be assigned to any Azure service, including an App Service web app. This identity is then tied to a specific tenant and can be used by multiple Azure resources.

Answer

Configure the identity in each deployment slot separately.

Answer

Store the identity's client ID in an app setting.

Answer

Create the managed identity in the same resource group as the web app.

Question 5

Arrange the steps to configure auto-scaling for an Azure App Service in the correct order.

Accepted Answer

Navigate to App Service, then scale out, then enable autoscale, then configure rules, then set limits.. First navigate to App Service, then scale out, enable autoscale, configure rules, set limits.

Answer

Navigate to App Service, then enable autoscale, then scale out, then configure rules, then set limits.

Answer

Navigate to App Service, then scale out, then configure rules, then enable autoscale, then set limits.

Answer

Navigate to App Service, then scale out, then enable autoscale, then set limits, then configure rules.

Question 6

Your company uses Azure API Management to expose APIs to external partners. You need to enforce throttling limits per subscription key. Which policy should you add?

Accepted Answer

rate-limit by key policy with @(context.Subscription.Id) as counter key. The `rate-limit by key` policy in Azure API Management allows you to enforce throttling limits based on a specific counter key. Using `@(context.Subscription.Id)` as the counter key ensures that each subscription key is tracked individually, enabling per-subscription throttling as required.

Answer

rate-limit policy with IP address filtering

Answer

rate-limit by key policy with no counter key

Answer

validate-jwt policy with claims check

Question 7

You are developing a web application that uses Azure Files shares for storing user documents. Users complain that they sometimes see stale file listings. The application uses the SMB protocol. What should you do to ensure the file listing is always current?

Accepted Answer

Set the SMB_DIRECTORY_CACHE_MAX_AGE registry key to 0 on clients.. The SMB protocol caches directory listings on the client side to improve performance. By setting the SMB_DIRECTORY_CACHE_MAX_AGE registry key to 0, you disable this caching, forcing the client to always fetch the latest directory listing from the Azure file share. This ensures that users see current file listings instead of stale cached data.

Answer

Enable soft delete for the file share.

Answer

Switch to using REST API for file listings.

Answer

Disable CDN caching for the storage account.

Question 8

Refer to the exhibit. An Azure OpenAI Service account is deployed with this ARM template. After deployment, a developer tries to call the OpenAI endpoint from an Azure App Service that has no public IP. The request is blocked. What change should be made to allow access?

Accepted Answer

Configure a private endpoint for the OpenAI account.. The ARM template sets `networkAcls.defaultAction` to `Deny`, which blocks all traffic by default. Since the App Service has no public IP, it cannot be reached via IP-based rules. Configuring a private endpoint for the OpenAI account creates a private network connection over Azure's backbone, bypassing the public endpoint and allowing the App Service to access the OpenAI service securely without requiring a public IP.

Answer

Add a service tag for App Service in the ipRules.

Answer

Change the defaultAction to Allow.

Answer

Add the App Service's outbound IP address to the ipRules.

Question 9

Arrange the steps to implement Azure Key Vault for storing and retrieving secrets in an application in the correct order.

Accepted Answer

Create Key Vault, then Add a secret, then Grant access to the secret, then Retrieve the secret, then Use the secret. The correct sequence for implementing Azure Key Vault is: first create the Key Vault, then add the secret, grant access to the secret (e.g., via access policies or RBAC), retrieve the secret in the application, and finally use it. This ensures proper resource creation and security before accessing sensitive data.

Answer

Create Key Vault, then Grant access to the secret, then Add a secret, then Retrieve the secret, then Use the secret

Answer

Create Key Vault, then Add a secret, then Retrieve the secret, then Grant access to the secret, then Use the secret

Answer

Add a secret, then Create Key Vault, then Grant access to the secret, then Retrieve the secret, then Use the secret

Question 10

You have an Azure API Management instance that exposes a REST API. You need to secure the API using OAuth 2.0 with Microsoft Entra ID. The API should accept tokens from multiple client applications. Which policy should you add to the inbound processing section?

Accepted Answer

. The policy is the correct choice because it validates the OAuth 2.0 token presented in the Authorization header, ensuring that only requests with valid tokens from Microsoft Entra ID are processed. This policy checks the token's signature, issuer, audience, and expiration, and returns a 401 status code if validation fails, which is essential for securing the API against unauthorized access from multiple client applications.

Answer

<xml-to-json>

Answer

<rate-limit>

Answer

<cache-lookup>

Question 11

Arrange the steps to deploy an Azure App Service using Azure CLI in the correct order.

Accepted Answer

Create resource group, then App Service plan, then web app, then deploy code, then verify. To deploy an App Service, first create a resource group, then an App Service plan, then the web app, deploy code, and finally verify.

Answer

Create App Service plan, then resource group, then web app, then deploy code, then verify

Answer

Create resource group, then web app, then App Service plan, then deploy code, then verify

Answer

Deploy code, then resource group, then App Service plan, then web app, then verify

Question 12

You find the above ARM template for an App Service. What is a security concern with this configuration?

Accepted Answer

The password is passed as a parameter and may be exposed in deployment logs.. When a password is passed as an ARM template parameter, its value can be captured in deployment logs (e.g., Azure Activity Logs or PowerShell verbose output) if the parameter is not marked as 'secureString'. This exposes sensitive credentials to anyone with log access, violating security best practices. In contrast, using a secureString parameter encrypts the value and masks it in logs.

Answer

The connection string is stored in the source code.

Answer

The connection string type should be 'Custom' instead of 'SQLAzure'.

Answer

The connection string is not encrypted at rest.

Question 13

Your application uses Azure Key Vault to store cryptographic keys used for signing. You need to ensure that the keys can be used by multiple applications, but only one application should be able to delete the key. What should you do?

Accepted Answer

Assign the 'Key Vault Crypto Officer' role to the application that needs to delete, and 'Key Vault Crypto User' to others.. Azure RBAC for Key Vault allows granular permissions. The 'Key Vault Crypto Officer' role includes delete permission for keys, while the 'Key Vault Crypto User' role only allows cryptographic operations (sign, verify, encrypt, decrypt) without delete. This meets the requirement of allowing multiple applications to use keys but restricting deletion to one specific application.

Answer

Enable soft-delete and purge protection on the key vault.

Answer

Create a key rotation policy that automatically deletes old keys.

Answer

Configure the key vault firewall to allow only the authorized application's IP.

Question 14

You receive an error when deploying this ARM template: 'The serverFarmId property is required.' What is missing from the template?

Accepted Answer

The server farm resource (Microsoft.Web/serverfarms) is not defined in the template. The error 'The serverFarmId property is required' indicates that the ARM template is missing a reference to an App Service Plan (Microsoft.Web/serverfarms) resource. In Azure, a web app or function app must be associated with an App Service Plan, which defines the compute resources and pricing tier. The template must define the server farm resource and link it via the 'serverFarmId' property on the site resource.

Answer

The 'location' property is missing from the site resource

Answer

The apiVersion should be '2018-02-01'

Answer

The 'kind' property should be 'functionapp'

Question 15

You need to implement a shared access signature (SAS) for an Azure blob container that allows a client to list blobs and read blob contents. The SAS must be valid for one hour and should not allow write or delete operations. Which permissions should you include in the SAS token?

Accepted Answer

r and l. The SAS token needs 'r' (read) to allow reading blob contents and 'l' (list) to allow listing blobs in the container. These two permissions together satisfy the requirement for read-only access without write or delete capabilities.

Answer

r, l, and c

Answer

r, l, and d

Answer

r, l, and w