AZ-204 Practice Test 38 — 15 Questions

Question 1

You have an Azure Function app that uses Durable Functions. You notice that some orchestrations are taking longer than expected. You need to monitor the history of orchestration instances. What should you use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Durable Functions HTTP management APIs. D is correct because the Durable Functions HTTP management APIs provide direct access to the orchestration instance history, including status queries, raise events, and terminate operations. These APIs return the full execution history of an orchestration instance, allowing you to inspect each step and identify delays. This is the most targeted way to monitor the history of specific orchestration instances without additional configuration.

Answer

Application Insights

Answer

Azure Monitor Metrics

Answer

Azure Storage Explorer

Question 2

A production API needs proactive alerting for unexpected exceptions. Which two elements are required for a useful Azure Monitor alert?

Accepted Answer

A signal or metric/log query that detects the condition. A is correct because an Azure Monitor alert requires a signal (such as a metric, log query, or activity log event) to define the condition that triggers the alert. Without a signal, the alert has no basis for evaluation, making it impossible to detect unexpected exceptions proactively.

Answer

A public IP address on the app

Answer

A manually exported CSV report

Question 3

You are designing a solution that requires atomic operations on a counter stored in Azure Blob Storage. The counter must be updated by multiple instances without conflicts. Which approach should you use?

Accepted Answer

Store the counter in Azure Cosmos DB and use stored procedures to increment atomically.. Azure Cosmos DB stored procedures execute within the database engine's transactional scope, providing ACID-compliant atomic operations. This ensures that concurrent increments from multiple instances are serialized without conflicts, which is not natively supported by Azure Blob Storage's eventual consistency model.

Answer

Use Azure Queue Storage to queue increment messages.

Answer

Store the counter in Azure Table Storage and use optimistic concurrency with ETags.

Answer

Use Append Blob to append each increment as a new block and sum them later.

Question 4

Your application writes millions of small log entries per hour to an Azure Storage account. You notice throttling errors (HTTP 503) during peak traffic. You need to minimize throttling without changing the application code. What should you do?

Accepted Answer

Use a separate storage account for log data. Using a separate storage account for log data isolates the high-volume write traffic from other workloads, distributing the request load across different storage account endpoints. Azure Storage accounts have scalability targets (e.g., up to 20,000 requests per second per account for blob storage), and splitting logs into a dedicated account prevents hitting those limits, reducing HTTP 503 throttling errors without requiring code changes.

Answer

Request a storage account limit increase from Azure Support

Answer

Change the replication type to geo-redundant storage (GRS)

Answer

Enable soft delete on the blob container

Question 5

Your organization has a custom application that stores customer data in Azure Cosmos DB. You need to encrypt the data at rest using a customer-managed key stored in Azure Key Vault. Which type of Cosmos DB encryption should you configure?

Accepted Answer

Use customer-managed keys (CMK) with Azure Key Vault. Azure Cosmos DB supports customer-managed keys (CMK) integrated with Azure Key Vault to encrypt data at rest. This allows you to bring your own key (BYOK) and control key rotation, revocation, and access policies, meeting the requirement for a customer-managed key stored in Azure Key Vault.

Answer

Enable Azure Disk Encryption on the Cosmos DB instance

Answer

Enable Transparent Data Encryption (TDE)

Answer

Implement client-side encryption using the SDK

Question 6

Your Azure Kubernetes Service (AKS) cluster experiences node failures. Which Azure service provides automated node repair?

Accepted Answer

AKS node auto-repair. C is correct because AKS node auto-repair is a built-in feature that automatically detects unhealthy nodes (based on Node Conditions like 'NotReady' or 'DiskPressure') and initiates repair actions such as reimaging the node. This feature is specific to AKS and operates at the cluster level without requiring external services.

Answer

Azure Sentinel

Answer

Microsoft Defender for Cloud

Answer

Azure Monitor

Question 7

Which THREE tools can you use to diagnose performance issues in an Azure App Service? (Choose three.)

Accepted Answer

Application Insights. Application Insights is a feature of Azure Monitor that provides application performance management (APM) and telemetry for live web applications. It automatically detects performance anomalies, includes powerful analytics tools to help diagnose issues, and allows you to understand how an app is performing and being used. For an Azure App Service, you can enable Application Insights with just a few clicks to start collecting request rates, response times, failure rates, and dependency tracking.

Answer

Azure Monitor for VMs

Answer

Azure SQL Analytics

Question 8

You are deploying a microservices application on Azure Kubernetes Service (AKS). You need to monitor the resource consumption of each pod and set up alerts when CPU usage exceeds 80% for 5 minutes. What should you use?

Accepted Answer

Azure Monitor Container Insights. Azure Monitor Container Insights is the correct choice because it is specifically designed to monitor the performance of container workloads running on Azure Kubernetes Service (AKS). It collects memory and processor metrics from controllers, nodes, and containers, and supports setting metric alerts based on CPU usage thresholds, such as 80% for 5 minutes.

Answer

Azure Monitor VM Insights

Answer

Application Insights

Answer

Azure Service Health

Question 9

Your team develops a containerized web app using Azure Kubernetes Service (AKS). You need to ensure that the application can automatically scale based on HTTP request load. Which Kubernetes resource should you configure?

Accepted Answer

HorizontalPodAutoscaler. The HorizontalPodAutoscaler (HPA) is the correct Kubernetes resource for automatically scaling the number of pod replicas based on observed CPU, memory, or custom metrics like HTTP request rate. In an AKS cluster, HPA adjusts the replica count of a Deployment or ReplicaSet to match the target metric, enabling the application to handle varying HTTP load without manual intervention.

Answer

VerticalPodAutoscaler

Answer

PodDisruptionBudget

Answer

NetworkPolicy

Question 10

You are planning to migrate an on-premises application to Azure App Service. The application consists of a web frontend and a background worker that processes messages from a queue. Which TWO Azure services should you use to implement this solution?

Accepted Answer

Azure Functions. Azure Functions (C) is correct because it provides a serverless compute service that can be triggered by queue messages, making it ideal for the background worker that processes messages from a queue. Azure App Service (D) is correct because it hosts the web frontend, providing a fully managed platform for web applications with built-in scaling and load balancing.

Answer

Azure Kubernetes Service

Answer

Azure Batch

Answer

Azure Logic Apps

Question 11

You are designing a microservices solution using Azure Container Apps. One service must be exposed externally via HTTPS, while others should only be accessible within the environment. You need to configure networking for this scenario. What should you do?

Accepted Answer

Configure each container app's ingress: set the external service to 'External' and the internal services to 'Internal'.. Azure Container Apps allows you to control ingress at the individual container app level. Setting the external service's ingress to 'External' makes it reachable from the internet via HTTPS, while setting internal services to 'Internal' restricts access to only within the Container Apps environment, using the internal FQDN. This provides the required isolation without needing separate environments or complex network policies.

Answer

Enable external ingress at the environment level and use network policies to restrict access.

Answer

Deploy the external service in a different environment and use an internal load balancer.

Answer

Use a Dapr sidecar to route requests between services.

Question 12

Your web app needs to authenticate users with Microsoft Entra ID (formerly Azure AD). Which OAuth 2.0 flow should you use for a single-page application (SPA) that uses MSAL.js?

Accepted Answer

Authorization code flow with PKCE. The authorization code flow with PKCE (Proof Key for Code Exchange) is the recommended OAuth 2.0 flow for single-page applications (SPAs) using MSAL.js because it provides a secure way to obtain tokens without exposing the client secret. PKCE ensures that even if the authorization code is intercepted, it cannot be exchanged for tokens without the original code verifier, mitigating authorization code injection attacks. Microsoft deprecated the implicit flow for SPAs in favor of this flow due to its enhanced security.

Answer

Client credentials flow

Answer

Implicit flow

Answer

Resource owner password credentials flow

Question 13

You need to store a large number of small files (each < 100 KB) that will be accessed frequently from a web application. The files are static assets (CSS, JavaScript, images). Which Azure storage option provides the best performance for serving these files directly to users?

Accepted Answer

Azure Blob Storage with Azure CDN. Azure Blob Storage is optimized for storing large volumes of unstructured data, including small static files. By integrating Azure CDN, you cache these files at edge nodes closer to users, drastically reducing latency and offloading origin requests. This combination provides the best performance for frequently accessed static assets served directly to a web application's users.

Answer

Azure Queue Storage

Answer

Azure Table Storage

Answer

Azure Files

Question 14

You are developing a serverless function using Azure Functions that needs to write logs to a Log Analytics workspace. The function uses a managed identity. Which RBAC role should you assign to the function's managed identity?

Accepted Answer

Log Analytics Contributor. The Log Analytics Contributor role is required because it grants the managed identity the necessary permissions to send data to a Log Analytics workspace, including the ability to create and manage data collection rules and write log data. This role is specifically designed for scenarios where an Azure resource, such as an Azure Function, needs to ingest logs into Log Analytics via the Data Collection API.

Answer

Log Analytics Reader

Answer

Monitoring Contributor

Answer

Storage Blob Data Contributor

Question 15

You are designing a serverless application using Azure Functions. The solution must process messages from an Azure Service Bus queue and update a Cosmos DB database. Which binding configuration should you use on the function?

Accepted Answer

Service Bus trigger with Cosmos DB output binding. The requirement specifies processing messages from an Azure Service Bus queue and updating a Cosmos DB database. A Service Bus trigger binds the function to the queue, and a Cosmos DB output binding writes the processed data directly to Cosmos DB, enabling a seamless serverless workflow without additional code for database operations.

Answer

Service Bus trigger with Table storage output binding

Answer

Blob trigger with Cosmos DB output binding

Answer

HTTP trigger with Cosmos DB input binding