AZ-204 Practice Test 39 — 15 Questions

Question 1

You are developing an Azure Functions app that uses Durable Functions to orchestrate a long-running workflow. The workflow involves calling multiple external APIs. You need to ensure that the orchestration can survive a function app restart. Which feature should you use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use the default checkpointing and replay mechanism.. Durable Functions inherently use a checkpointing and replay mechanism to persist the orchestration state to a storage backend (Azure Storage queues, tables, and blobs). This ensures that after a function app restart, the orchestrator function can replay from the last checkpoint, restoring the exact execution context and continuing the workflow without data loss.

Answer

Log orchestration state to Application Insights.

Answer

Implement retry policies on the activity functions.

Answer

Set a high timeout on the orchestration.

Question 2

Which TWO actions can help you reduce latency for a globally distributed web application? (Choose two.)

Accepted Answer

Use Azure Traffic Manager with performance routing. Azure Traffic Manager with performance routing directs user traffic to the closest endpoint based on the lowest network latency, reducing response times for globally distributed users. Option E is correct because Azure Front Door uses anycast and global edge points of presence (PoPs) to route traffic to the nearest region, providing both latency reduction and application acceleration.

Answer

Use Azure Application Gateway with Web Application Firewall

Answer

Scale up the App Service plan to a higher tier

Answer

Enable multi-region writes on Azure Cosmos DB

Question 3

You are running an Azure App Service web app on the Basic tier. Users report slow initial responses due to cold starts. You need to keep the app warm without upgrading the hosting plan. Which feature should you enable?

Accepted Answer

Enable 'Always On' in the App Service configuration.. The 'Always On' feature prevents the App Service from being unloaded after periods of inactivity, eliminating cold starts by keeping the application loaded in memory. This is available on the Basic tier and above, so it solves the problem without requiring a plan upgrade.

Answer

Upgrade to a Premium plan to get pre-warmed instances.

Answer

Implement an auto-scaling rule to maintain a minimum instance count.

Answer

Reduce the web app's idle timeout via application code.

Question 4

Which TWO of the following are valid use cases for Azure Queue Storage? (Choose TWO.)

Accepted Answer

Building a reliable messaging layer between microservices.. Azure Queue Storage provides a reliable, persistent message queue that enables asynchronous communication between microservices. It guarantees at-least-once delivery and supports message visibility timeouts, making it ideal for decoupling components in a distributed architecture.

Answer

Broadcasting messages to multiple subscribers.

Answer

Storing large JSON documents for later retrieval.

Answer

Streaming high-volume telemetry data for real-time analytics.

Question 5

You are designing a data archiving solution for compliance. Data must be stored for 7 years, with immediate deletion prohibited until the retention period expires. The solution must minimize storage costs while ensuring data is not modifiable. Which THREE Azure features should you combine?

Accepted Answer

Azure Blob Storage. Azure Blob Storage is the correct foundational service because it supports immutable storage, which enforces a WORM (Write Once, Read Many) policy. This ensures data cannot be modified or deleted during the retention period, meeting compliance requirements. Combined with time-based retention policies and cool/archive tiers, it provides a cost-effective, unmodifiable archive solution.

Answer

Azure Files

Answer

Azure Backup

Question 6

Which TWO actions should you take to secure an Azure Kubernetes Service (AKS) cluster that runs a critical workload? (Choose two.)

Accepted Answer

Enable Azure AD integration with Kubernetes RBAC. Integrating Microsoft Entra ID with Kubernetes RBAC provides centralized identity management and fine-grained access control for the AKS cluster. This allows you to authenticate users via Microsoft Entra ID and authorize their actions using Kubernetes RBAC roles, ensuring that only authenticated and authorized users can perform operations on the cluster, which is critical for securing a production workload.

Answer

Store secrets as Kubernetes secrets without encryption

Answer

Enable SSH access to all nodes for troubleshooting

Answer

Deploy Azure Firewall in the cluster VNet

Question 7

Your company uses Azure API Management to manage APIs. You need to implement policies that ensure only authenticated requests from partners are allowed, and that responses are cached to improve performance. Which THREE policies should you configure?

Accepted Answer

cache-store. (cache-store) is correct because it is part of the caching policy in Azure API Management. When combined with cache-lookup, it stores the response in the internal or external cache after the backend has processed the request, reducing latency and backend load for subsequent identical requests. This directly supports the requirement to improve performance by caching responses.

Answer

set-header

Answer

rate-limit

Question 8

Your company is migrating a monolithic application to Azure. The application consists of several components that need to be deployed and scaled independently. You need to design a container orchestration solution. Which TWO services should you consider?

Accepted Answer

Azure Container Apps. Azure Container Apps (B) is correct because it provides a serverless container orchestration platform that allows you to deploy and scale microservices independently without managing the underlying Kubernetes infrastructure. It supports event-driven scaling, revision management, and split traffic routing, making it ideal for migrating monolithic applications to a microservices architecture with minimal operational overhead.

Answer

Azure Container Instances

Answer

Azure Batch

Answer

Azure Service Fabric

Question 9

You need to implement a solution for storing and retrieving large amounts of unstructured data (e.g., images, videos, backups) in Azure, with high durability and availability. The solution must allow access from anywhere via HTTP/HTTPS and support both public and private access. Which TWO Azure storage services should you consider?

Accepted Answer

Azure Data Lake Storage Gen2. Azure Blob Storage is purpose-built for storing large amounts of unstructured data such as images, videos, and backups, offering high durability (99.9999999999% with RA-GRS) and availability. It supports access via HTTP/HTTPS from anywhere, and provides both public (anonymous) and private (SAS tokens, RBAC) access controls, making it the primary choice for this scenario.

Answer

Azure Table Storage

Answer

Azure Queue Storage

Answer

Azure Files

Question 10

Which TWO Azure Monitor features can help troubleshoot a web app that returns slow response times intermittently?

Accepted Answer

Live Metrics. Live Metrics (C) is correct because it provides real-time, low-latency monitoring of a web app's performance, including CPU, memory, and request rates, allowing you to observe intermittent slow responses as they happen without sampling delays. Application Map (D) is correct because it visualizes the distributed components of your application and their dependencies, helping you identify which downstream service or component is causing latency spikes during intermittent slowdowns.

Answer

Sentinel incidents

Answer

Advisor recommendations

Answer

Policy compliance

Question 11

Which TWO approaches can you use to call an external REST API from an Azure Function while ensuring the API key is not exposed in the function code?

Accepted Answer

Store the API key as an environment variable in the function app settings.. Storing the API key in the function app settings (environment variables) keeps it out of the source code and allows the function to access it via the `Environment.GetEnvironmentVariable` method at runtime. Option E is correct because Azure Key Vault, combined with a Managed Identity, provides a secure, auditable, and rotation-friendly way to store secrets without embedding them in code or configuration files.

Answer

Store the API key in GitHub repository secrets.

Answer

Hardcode the API key in the function code.

Answer

Pass the API key in an HTTP header and include it in the source code.

Question 12

Which TWO actions should you take to reduce the cost of an Azure App Service plan that is underutilized?

Accepted Answer

Scale out to fewer instances. Scaling out to fewer instances directly reduces the number of VMs running the App Service plan, which lowers the compute cost. Since the plan is underutilized, fewer instances can handle the existing load without performance degradation, making this a cost-optimization action.

Answer

Deploy the application to a different region

Answer

Enable auto-scaling

Answer

Purchase Reserved Instances

Question 13

Which THREE are valid ways to authenticate an Azure Functions app to an Azure Service Bus namespace?

Accepted Answer

Using an Azure AD token obtained via DefaultAzureCredential. DefaultAzureCredential from the Azure Identity library can authenticate to Azure Service Bus using Microsoft Entra ID tokens. This credential chain attempts multiple authentication sources (environment variables, managed identity, Visual Studio, etc.) to obtain a token, which is then used to authorize requests to the Service Bus namespace via Azure RBAC.

Answer

Using a client certificate

Answer

Using a SAS key stored in code

Question 14

Match each Azure messaging pattern to its description.

Accepted Answer

Azure Queue Storage: Simple message queuing for decoupling application components.. Azure messaging patterns include Queue Storage for simple queuing, Service Bus Topics for pub-sub with filters, Event Grid for event routing, and Event Hubs for streaming. Common confusions involve attributing advanced features like dead-lettering to Queue Storage or mixing IoT scenarios with Service Bus Topics.

Answer

Azure Queue Storage: Reliable message delivery with dead-lettering and scheduling.

Answer

Azure Service Bus Topic: Real-time IoT device communication.

Question 15

A company stores sensitive data in an Azure Storage account. They need to restrict access based on the client's IP address and require that clients use a valid SAS token. Which mechanism should they use?

Accepted Answer

SAS token with IP ACL.. A SAS token with an IP ACL (access control list) allows you to restrict access to a specific client IP address or range of IP addresses while also requiring a valid SAS token for authentication. This meets both requirements: IP-based restriction and SAS token validation. The IP ACL is specified as part of the SAS token's signed IP (sip) parameter, which enforces that requests must originate from the allowed IP range.

Answer

Microsoft Entra ID authentication.

Answer

Shared Key.

Answer

Firewall and virtual networks.