AZ-204 Practice Test 39 — 15 Questions

Question 1

Which TWO actions should you take to enable a user-assigned managed identity for an Azure App Service web app?

Accepted Answer

Create the managed identity resource in Microsoft Entra ID.. A user-assigned managed identity is a standalone Azure resource created in Microsoft Entra ID (formerly Azure AD). It must exist as an identity resource before it can be assigned to any Azure service, including an App Service web app. This identity is then tied to a specific tenant and can be used by multiple Azure resources.

Answer

Configure the identity in each deployment slot separately.

Answer

Store the identity's client ID in an app setting.

Answer

Create the managed identity in the same resource group as the web app.

Question 2

Arrange the steps to configure auto-scaling for an Azure App Service in the correct order.

Accepted Answer

Navigate to App Service, then scale out, then enable autoscale, then configure rules, then set limits.. First navigate to App Service, then scale out, enable autoscale, configure rules, set limits.

Answer

Navigate to App Service, then enable autoscale, then scale out, then configure rules, then set limits.

Answer

Navigate to App Service, then scale out, then configure rules, then enable autoscale, then set limits.

Answer

Navigate to App Service, then scale out, then enable autoscale, then set limits, then configure rules.

Question 3

Your company uses Azure API Management to expose APIs to external partners. You need to enforce throttling limits per subscription key. Which policy should you add?

Accepted Answer

rate-limit by key policy with @(context.Subscription.Id) as counter key. The `rate-limit by key` policy in Azure API Management allows you to enforce throttling limits based on a specific counter key. Using `@(context.Subscription.Id)` as the counter key ensures that each subscription key is tracked individually, enabling per-subscription throttling as required.

Answer

rate-limit policy with IP address filtering

Answer

rate-limit by key policy with no counter key

Answer

validate-jwt policy with claims check

Question 4

You are developing a web application that uses Azure Files shares for storing user documents. Users complain that they sometimes see stale file listings. The application uses the SMB protocol. What should you do to ensure the file listing is always current?

Accepted Answer

Set the SMB_DIRECTORY_CACHE_MAX_AGE registry key to 0 on clients.. The SMB protocol caches directory listings on the client side to improve performance. By setting the SMB_DIRECTORY_CACHE_MAX_AGE registry key to 0, you disable this caching, forcing the client to always fetch the latest directory listing from the Azure file share. This ensures that users see current file listings instead of stale cached data.

Answer

Enable soft delete for the file share.

Answer

Switch to using REST API for file listings.

Answer

Disable CDN caching for the storage account.

Question 5

Refer to the exhibit. An Azure OpenAI Service account is deployed with this ARM template. After deployment, a developer tries to call the OpenAI endpoint from an Azure App Service that has no public IP. The request is blocked. What change should be made to allow access?

Accepted Answer

Configure a private endpoint for the OpenAI account.. The ARM template sets `networkAcls.defaultAction` to `Deny`, which blocks all traffic by default. Since the App Service has no public IP, it cannot be reached via IP-based rules. Configuring a private endpoint for the OpenAI account creates a private network connection over Azure's backbone, bypassing the public endpoint and allowing the App Service to access the OpenAI service securely without requiring a public IP.

Answer

Add a service tag for App Service in the ipRules.

Answer

Change the defaultAction to Allow.

Answer

Add the App Service's outbound IP address to the ipRules.

Question 6

Arrange the steps to implement Azure Key Vault for storing and retrieving secrets in an application in the correct order.

Accepted Answer

Create Key Vault, then Add a secret, then Grant access to the secret, then Retrieve the secret, then Use the secret. The correct sequence for implementing Azure Key Vault is: first create the Key Vault, then add the secret, grant access to the secret (e.g., via access policies or RBAC), retrieve the secret in the application, and finally use it. This ensures proper resource creation and security before accessing sensitive data.

Answer

Create Key Vault, then Grant access to the secret, then Add a secret, then Retrieve the secret, then Use the secret

Answer

Create Key Vault, then Add a secret, then Retrieve the secret, then Grant access to the secret, then Use the secret

Answer

Add a secret, then Create Key Vault, then Grant access to the secret, then Retrieve the secret, then Use the secret

Question 7

You have an Azure API Management instance that exposes a REST API. You need to secure the API using OAuth 2.0 with Microsoft Entra ID. The API should accept tokens from multiple client applications. Which policy should you add to the inbound processing section?

Accepted Answer

. The policy is the correct choice because it validates the OAuth 2.0 token presented in the Authorization header, ensuring that only requests with valid tokens from Microsoft Entra ID are processed. This policy checks the token's signature, issuer, audience, and expiration, and returns a 401 status code if validation fails, which is essential for securing the API against unauthorized access from multiple client applications.

Answer

<xml-to-json>

Answer

<rate-limit>

Answer

<cache-lookup>

Question 8

Arrange the steps to deploy an Azure App Service using Azure CLI in the correct order.

Accepted Answer

Create resource group, then App Service plan, then web app, then deploy code, then verify. To deploy an App Service, first create a resource group, then an App Service plan, then the web app, deploy code, and finally verify.

Answer

Create App Service plan, then resource group, then web app, then deploy code, then verify

Answer

Create resource group, then web app, then App Service plan, then deploy code, then verify

Answer

Deploy code, then resource group, then App Service plan, then web app, then verify

Question 9

You find the above ARM template for an App Service. What is a security concern with this configuration?

Accepted Answer

The password is passed as a parameter and may be exposed in deployment logs.. When a password is passed as an ARM template parameter, its value can be captured in deployment logs (e.g., Azure Activity Logs or PowerShell verbose output) if the parameter is not marked as 'secureString'. This exposes sensitive credentials to anyone with log access, violating security best practices. In contrast, using a secureString parameter encrypts the value and masks it in logs.

Answer

The connection string is stored in the source code.

Answer

The connection string type should be 'Custom' instead of 'SQLAzure'.

Answer

The connection string is not encrypted at rest.

Question 10

Your application uses Azure Key Vault to store cryptographic keys used for signing. You need to ensure that the keys can be used by multiple applications, but only one application should be able to delete the key. What should you do?

Accepted Answer

Assign the 'Key Vault Crypto Officer' role to the application that needs to delete, and 'Key Vault Crypto User' to others.. Azure RBAC for Key Vault allows granular permissions. The 'Key Vault Crypto Officer' role includes delete permission for keys, while the 'Key Vault Crypto User' role only allows cryptographic operations (sign, verify, encrypt, decrypt) without delete. This meets the requirement of allowing multiple applications to use keys but restricting deletion to one specific application.

Answer

Enable soft-delete and purge protection on the key vault.

Answer

Create a key rotation policy that automatically deletes old keys.

Answer

Configure the key vault firewall to allow only the authorized application's IP.

Question 11

You receive an error when deploying this ARM template: 'The serverFarmId property is required.' What is missing from the template?

Accepted Answer

The server farm resource (Microsoft.Web/serverfarms) is not defined in the template. The error 'The serverFarmId property is required' indicates that the ARM template is missing a reference to an App Service Plan (Microsoft.Web/serverfarms) resource. In Azure, a web app or function app must be associated with an App Service Plan, which defines the compute resources and pricing tier. The template must define the server farm resource and link it via the 'serverFarmId' property on the site resource.

Answer

The 'location' property is missing from the site resource

Answer

The apiVersion should be '2018-02-01'

Answer

The 'kind' property should be 'functionapp'

Question 12

You need to implement a shared access signature (SAS) for an Azure blob container that allows a client to list blobs and read blob contents. The SAS must be valid for one hour and should not allow write or delete operations. Which permissions should you include in the SAS token?

Accepted Answer

r and l. The SAS token needs 'r' (read) to allow reading blob contents and 'l' (list) to allow listing blobs in the container. These two permissions together satisfy the requirement for read-only access without write or delete capabilities.

Answer

r, l, and c

Answer

r, l, and d

Answer

r, l, and w

Question 13

A company uses Azure Event Hubs to ingest telemetry data from IoT devices. The data is processed by a stream analytics job that outputs to Azure Data Lake Storage Gen2. The developer needs to ensure that the stream analytics job can authenticate to Event Hubs without storing connection strings in code. Which authentication method should the developer use?

Accepted Answer

Use Managed Identity. Managed Identity allows the Azure Stream Analytics job to authenticate to Event Hubs without storing any credentials in code or configuration. By enabling a system-assigned or user-assigned managed identity on the Stream Analytics job, it can securely obtain an Azure AD token to access the Event Hubs namespace. This eliminates the need for connection strings or SAS tokens, aligning with the requirement to avoid storing secrets.

Answer

Use a connection string with the Event Hubs namespace

Answer

Use a client certificate

Answer

Use a Shared Access Signature (SAS) token

Question 14

You are designing a solution that requires storing millions of small (1-5 KB) messages from IoT devices. Each message has a unique device ID and timestamp. You need to support efficient point queries by device ID and time range, and also support aggregation queries (e.g., count of messages per device per hour). Which Azure storage solution should you use?

Accepted Answer

Azure Table Storage. Azure Table Storage is the correct choice because it is a NoSQL key-value store optimized for storing large volumes of structured, non-relational data. It supports efficient point queries using the PartitionKey (device ID) and RowKey (timestamp), enabling fast retrieval by device ID and time range. Additionally, it allows aggregation queries like counting messages per device per hour via partition-scanned queries or client-side aggregation, and it is cost-effective for storing millions of small (1-5 KB) messages.

Answer

Azure Cosmos DB for NoSQL

Answer

Azure Queue Storage

Answer

Azure Blob Storage with JSON files

Question 15

You find the above ARM template snippet in a deployment. What is the effect of this configuration on the App Service?

Accepted Answer

Allows cross-origin requests from app.contoso.com and portal.contoso.com without credentials.. The ARM template snippet sets `allowedOrigins` to specific domains (`app.contoso.com` and `portal.contoso.com`) and `supportCredentials` to `false`. This configuration allows cross-origin requests from those two origins but does not include credentials (cookies, HTTP authentication, or client-side certificates) in the requests, as per the CORS specification.

Answer

Configures the App Service to require authentication for cross-origin requests.

Answer

Enables CORS for all origins by setting allowedOrigins to a wildcard.

Answer

Blocks all cross-origin requests because supportCredentials is false.