AZ-204 Practice Test 39 — 15 Questions

Question 1

Your team uses Azure DevOps to deploy a web app to Azure App Service. The deployment fails intermittently with a '500 Internal Server Error' after successful code upload. You want to capture a memory dump of the process when the error occurs. What should you configure?

Accepted Answer

Use App Service Diagnostics to collect a memory dump. Option D is correct because App Service Diagnostics provides the ability to collect memory dumps and procdumps for crash analysis. Options A, B, C are wrong because Application Insights Snapshot Debugger, Azure Monitor autoscale, and Azure API Management do not capture memory dumps on the App Service.

Answer

Configure an autoscale rule in Azure Monitor

Answer

Set up Azure API Management policies

Answer

Enable Application Insights Snapshot Debugger

Question 2

Your application running on Azure App Service is experiencing intermittent high latency. You have enabled Application Insights and noticed that the 'Server response time' metric spikes during peak hours. What is the most likely cause of this issue?

Accepted Answer

The App Service plan is under-provisioned and hitting CPU limits.. Option B is correct because high CPU usage on the App Service plan during peak hours can cause increased response times. Option A is incorrect because low memory usage would not cause high latency. Option C is incorrect because auto-scaling typically reduces latency. Option D is incorrect because regional failover does not cause intermittent spikes during regular peak hours.

Answer

Auto-scaling is configured too aggressively.

Answer

The application is using regional failover, causing delays.

Answer

The application is using too much memory.

Question 3

Your Azure Functions app (running on the Consumption plan) processes messages from an Azure Storage queue. Occasionally, the function fails due to a timeout after 5 minutes. You need to increase the maximum execution time without changing the plan. What should you do?

Accepted Answer

Migrate the function app to the Premium or Dedicated plan. Option C is correct because on the Consumption plan, the maximum execution time is 5 minutes by default and cannot be increased; you must upgrade to the Premium or Dedicated plan to have longer timeouts. Option A is wrong because the Consumption plan does not allow increasing functionTimeout beyond 10 minutes (actually 5 minutes for the Consumption plan). Option B is wrong because adjusting the queue message visibility timeout does not affect function execution time. Option D is wrong because Azure Durable Functions can orchestrate longer workflows but the function itself still has a timeout.

Answer

Set the functionTimeout property in host.json to 10 minutes

Answer

Use Durable Functions to split the work

Answer

Increase the visibility timeout of the queue message

Question 4

You are developing a solution that uses Azure Functions with a consumption plan. The function processes messages from an Azure Service Bus queue. During a load test, you notice that the function takes a long time to start processing messages after a period of inactivity. What is the most likely cause of this cold start delay?

Accepted Answer

The function is using a consumption plan, which may scale to zero instances.. Option C is correct because the consumption plan can cause cold starts after inactivity due to scaling down to zero instances. Option A is incorrect because Service Bus Premium does not affect function cold starts. Option B is incorrect because the function timeout does not cause cold starts. Option D is incorrect because premium plans reduce cold starts, not cause them.

Answer

The function timeout is set too low.

Answer

The function is using a premium plan with pre-warmed instances.

Answer

The Service Bus namespace is using the Premium tier.

Question 5

Your application uses Azure Cosmos DB with the SQL API. You notice that read requests are being throttled (HTTP 429) during peak hours. You need to improve read performance without changing the application code. Which action should you take?

Accepted Answer

Increase the provisioned throughput (RU/s) for the container. Option B is correct because increasing RU/s for the container directly increases throughput, reducing throttling. Option A is wrong because adding a global index is not a standard Cosmos DB concept; indexing is automatic. Option C is wrong because changing consistency to Strong reduces performance. Option D is wrong because enabling multi-region writes improves write availability, not read performance.

Answer

Add a composite index to the container

Answer

Enable multi-region writes for the Cosmos DB account

Answer

Change the default consistency level to Strong

Question 6

You are building an Azure Logic App that needs to call an external REST API. The API requires an API key to be passed in the 'X-API-Key' header. You have stored the API key as a secret in Azure Key Vault. The Logic App uses a managed identity that has read access to the Key Vault secret. You want to retrieve the API key securely at runtime and include it in the HTTP request. Which approach should you use?

Accepted Answer

Add a 'Get secret' action from Key Vault to retrieve the secret, then use the 'HTTP' action and set the 'X-API-Key' header to the secret value using a dynamic expression.. Option A is correct because it uses the native 'Get secret' action from Azure Key Vault to securely retrieve the API key at runtime, leveraging the Logic App's managed identity for authentication. The secret value can then be dynamically injected into the 'X-API-Key' header of the subsequent HTTP action using an expression like `@{outputs('Get_secret')?['value']}`. This approach follows the principle of least privilege and avoids hardcoding secrets or exposing them in configuration.

Answer

Configure the HTTP action to use managed identity authentication and set the 'Audience' to the Key Vault URL. This will automatically pass the API key as the Authorization header.

Answer

Store the API key in an Azure App Service application setting and reference it from the Logic App using the 'appsetting' function.

Answer

Use the 'Invoke an HTTP endpoint' action with Application Insights dependency tracking enabled. The API key is automatically logged by Application Insights.

Question 7

You are building an Azure Logic App that needs to call an external HTTP API secured with OAuth 2.0 Client Credentials flow. The client ID and client secret are stored in Azure Key Vault. You need to obtain an access token and include it in the Authorization header of each request. Which combination of actions should you use within the Logic App?

Accepted Answer

Use an HTTP action with the OAuth 2.0 authentication type. Set the client secret parameter to a secure reference to the Key Vault secret.. Option A is correct because the HTTP action in Azure Logic Apps natively supports the OAuth 2.0 authentication type, which can directly handle the Client Credentials flow. By setting the client secret parameter to a secure reference (e.g., `@Microsoft.KeyVault(SecretUri=...)`) pointing to the secret stored in Azure Key Vault, you avoid exposing credentials in the workflow definition. The Logic Apps runtime automatically retrieves the secret from Key Vault, obtains an access token from the token endpoint, and includes it in the Authorization header of each request without requiring custom token management.

Answer

Use two HTTP actions: first, call the token endpoint with credentials to get a token, then use the token in the second action. Store credentials in a string variable.

Answer

Use the HTTP action with managed identity authentication.

Answer

Use the 'Invoke an Microsoft Entra ID protected API' connector with the client credentials grant type.

Question 8

A retail system uses Azure Service Bus to process orders. Each order has multiple messages (e.g., payment, shipping, confirmation) that must be processed in sequence. You need to guarantee that all messages belonging to the same order are handled by the same consumer in order. Which Service Bus feature should you use?

Accepted Answer

Sessions. Sessions in Azure Service Bus enable ordered, first-in-first-out (FIFO) processing of related messages. By setting the SessionId property to the order ID, all messages for that order are grouped into a session, ensuring a single consumer processes them sequentially. This guarantees that payment, shipping, and confirmation messages for the same order are handled in order and by the same consumer.

Answer

Scheduled messages

Answer

Dead-letter queue

Answer

Auto-forwarding

Question 9

You are building an Azure Logic App that needs to call an external API secured with OAuth 2.0 client credentials flow. You have registered an application in Microsoft Entra ID with client ID 'myClientId' and client secret stored in Key Vault. Which action should you use to authenticate?

Accepted Answer

HTTP action with Active Directory OAuth authentication. Option A is correct because the HTTP action in Azure Logic Apps supports an 'Active Directory OAuth' authentication type that directly implements the OAuth 2.0 client credentials flow. By providing the tenant ID, client ID, and referencing the client secret from Key Vault (via a secure parameter or connection reference), the Logic App can obtain an access token from Microsoft Entra ID and authenticate to the external API without custom code.

Answer

HTTP action with Managed Identity authentication

Answer

Invoke the API through Azure API Management

Answer

Use the Microsoft Entra ID OAuth 2.0 connector

Question 10

You are building an Azure Logic App that calls an external REST API secured with the OAuth 2.0 client credentials flow. You have registered an app in Microsoft Entra ID with client ID and client secret stored in Azure Key Vault. The Logic App uses a system-assigned managed identity with Get permission on the secret. Which action should you use in the Logic App designer to authenticate to the API?

Accepted Answer

HTTP action with 'Active Directory OAuth' authentication type, referencing the client ID and client secret. Option A is correct because the OAuth 2.0 client credentials flow requires a client ID and client secret to obtain an access token from Microsoft Entra ID. The HTTP action's 'Active Directory OAuth' authentication type directly supports this flow, allowing you to reference the client ID and the client secret stored in Azure Key Vault. The Logic App's system-assigned managed identity has Get permission on the secret, enabling it to retrieve the secret at runtime without exposing it in the workflow definition.

Answer

HTTP action with 'Managed Identity' authentication type

Answer

Invoke an API with OAuth predefined connector

Answer

HTTP action with 'Basic' authentication and pass the secret as password

Question 11

You are building a solution that processes events from multiple Azure Event Hubs. Events must be dispatched to different downstream services based on the event type. You need a serverless solution that can handle high throughput and uses managed identity to authenticate to Event Hubs. Which Azure service should you use?

Accepted Answer

Azure Functions (Event Hubs trigger) with managed identity. Azure Functions with an Event Hubs trigger supports managed identity authentication, enabling secure, passwordless connections to Event Hubs. It is a serverless, event-driven compute service that can scale to handle high throughput by processing events in parallel across multiple partitions. This makes it the ideal choice for dispatching events to downstream services based on event type.

Answer

Azure Stream Analytics

Answer

Azure Logic Apps (Event Hubs connector)

Answer

Azure Data Factory

Question 12

You are building an Azure Logic App that must call an external API that uses the OAuth 2.0 authorization code grant. The API requires the user to sign in interactively to grant consent. You want to minimize development effort and securely manage the token lifecycle. Which built-in action and authentication method should you use?

Accepted Answer

Use the 'HTTP' action with 'OAuth 2.0' authentication and configure the authorization endpoint, client ID, and client secret.. Option A is correct because the 'HTTP' action with 'OAuth 2.0' authentication type in Azure Logic Apps is specifically designed to handle the authorization code grant flow, including interactive user consent. It manages the token lifecycle (acquisition, refresh, and storage) automatically, minimizing development effort. You only need to configure the authorization endpoint, client ID, and client secret, and the runtime handles the redirect and token exchange.

Answer

Use the 'HTTP + Swagger' action with 'Identity Provider' authentication.

Answer

Use the 'API Connection' action with a custom connector that uses OAuth 2.0.

Answer

Use the 'HTTP' action with 'Managed identity' authentication.

Question 13

You are building an Azure Logic App that must call an external API secured with OAuth 2.0 Client Credentials flow. The external API is registered in a different Microsoft Entra ID tenant. You need to obtain an access token and add it to the request headers. Which action and authentication configuration should you use?

Accepted Answer

Use the HTTP action with Active Directory OAuth authentication, providing the tenant ID, client ID, and client secret.. Option C is correct because the HTTP action's Active Directory OAuth authentication type directly supports the OAuth 2.0 Client Credentials flow for cross-tenant scenarios. By providing the tenant ID, client ID, and client secret, the Logic App runtime can obtain an access token from the external tenant's token endpoint and automatically inject it into the Authorization header as a Bearer token. This is the only built-in authentication option in the HTTP action that handles the client credentials grant without custom code.

Answer

Use the HTTP action with Managed Identity authentication.

Answer

Use the HTTP + Swagger connector to import the API definition.

Answer

Use the Azure Key Vault - Get secret action to retrieve a token.

Question 14

You have an Azure Event Grid topic that receives storage blob created events. You only want to process events for files with a '.jpg' extension. You need to minimize cost and latency. How should you filter the events?

Accepted Answer

Configure a subject filter in the Event Grid subscription with suffix '.jpg'. Option A is correct because Event Grid subscriptions support subject filtering with prefix and suffix matching, allowing you to filter events at the Event Grid service level before they are delivered to your endpoint. By configuring a subject filter with suffix '.jpg', only blob created events for files ending in '.jpg' are sent to your Azure Function, minimizing both cost (fewer invocations) and latency (no unnecessary processing). This approach avoids the overhead of receiving and discarding unwanted events in your function code.

Answer

Filter inside the Azure Function code by checking the blob name extension

Answer

Use Azure Service Bus topics instead of Event Grid, with a filter on message properties

Answer

Create separate Event Grid topics for JPEG files and route only JPEG events

Question 15

You manage an API in Azure API Management. You need to enforce a rate limit of 200 requests per minute for each subscription key. Which policy should you include in the inbound policy section?

Accepted Answer

policy. The policy in Azure API Management is specifically designed to enforce a per-subscription key rate limit, such as 200 requests per minute. It operates on a sliding window counter to smooth traffic and is applied in the inbound section to evaluate each request before it reaches the backend. This matches the requirement exactly.

Answer

<quota> policy

Answer

<limit-concurrency> policy

Answer

<throttle> policy