AZ-204 Practice Test 4 — 10 Questions

Question 1

You are building an Azure Logic App that must consume messages from an Azure Service Bus queue. The queue messages are JSON payloads containing order information. The Logic App must process each message exactly once and in the order they are received. You need to configure the trigger in the Logic App. Which trigger type and property should you choose?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use a Service Bus trigger with the 'PeekLock' mode and set the 'IsSessionsEnabled' property to true. Service Bus sessions provide first-in-first-out (FIFO) ordering and exactly-once processing. By enabling sessions (IsSessionsEnabled = true) and using PeekLock mode, the Logic App can lock a message while processing, ensuring it is not delivered to other consumers, and sessions guarantee that messages with the same session ID are processed in order. This meets the requirement of processing each message exactly once and in the order received.

Answer

Use a Service Bus trigger with the 'PeekLock' mode and set the 'IsSessionsEnabled' property to false

Answer

Use a Service Bus trigger with the 'ReceiveAndDelete' mode

Answer

Use an Event Grid trigger for Service Bus

Question 2

You are using Azure File Storage to share configuration files across multiple virtual machines running a legacy application. The application requires SMB 3.0 protocol with encryption. You need to ensure the file share is accessible from all VMs without exposing it to the internet. Which configuration should you use?

Accepted Answer

Create a storage account with a private endpoint and mount the file share using the private IP. A private endpoint assigns the storage account a private IP address from your virtual network, allowing VMs to access the file share over SMB 3.0 with encryption without exposing the storage account to the public internet. This meets the requirement for secure, private connectivity while supporting the legacy application's SMB 3.0 protocol needs.

Answer

Create a storage account with a shared access signature (SAS) token and mount using the SAS URL

Answer

Create a storage account with a public endpoint and use a VPN gateway to connect the VMs

Answer

Create a storage account with a public endpoint and configure the firewall to allow only the VNet

Question 3

Refer to the exhibit. You run the Azure CLI command to list blobs in a container that are larger than 1 MB. The command returns no results even though you know there are blobs larger than 1 MB. What is the most likely cause?

Accepted Answer

The storage account has hierarchical namespace enabled (Azure Data Lake Storage Gen2). The Azure CLI command uses the `az storage blob list` command with a JMESPath query to filter blobs larger than 1 MB. However, when a storage account has hierarchical namespace enabled (Azure Data Lake Storage Gen2), the blob listing API returns directory entries and file entries in a flat list, but the `az storage blob list` command does not support the hierarchical namespace by default. The command may return no results because the underlying REST API (Blob Service REST API) does not properly enumerate blobs in a Data Lake Storage Gen2 account without using the `--use-hierarchical-namespace` flag or the `az storage fs file list` command instead. This is a known limitation where the standard blob list operation fails to list files in a hierarchical namespace-enabled account.

Answer

The JMESPath query uses backticks incorrectly

Answer

The --container-name parameter is case-sensitive

Answer

The --account-name parameter is incorrect

Question 4

You are designing an Azure Table Storage table to store temperature readings from IoT devices. Each reading includes a device ID (string), timestamp (datetime), temperature value, and location. You need to optimize the table design for this query: "Retrieve all temperature readings for a specific device ID within a given one-hour time range." The query must be efficient and minimize partition scans. Which PartitionKey and RowKey combination should you use?

Accepted Answer

PartitionKey = device ID, RowKey = timestamp (formatted as inverted ticks). Using device ID as the PartitionKey ensures all readings for a specific device are in the same partition, allowing efficient point queries. Using timestamp formatted as inverted ticks (e.g., DateTime.MaxValue.Ticks - DateTime.UtcNow.Ticks) as the RowKey enables range queries within a one-hour window by leveraging the lexicographic ordering of RowKey values, minimizing partition scans.

Answer

PartitionKey = timestamp (rolled up to day), RowKey = device ID

Answer

PartitionKey = location, RowKey = device ID

Answer

PartitionKey = device ID + timestamp (composite), RowKey = empty

Question 5

You are building an Azure Logic App that must consume messages from an Azure Service Bus queue. The queue messages are JSON payloads containing order information. The Logic App must process each message exactly once and in the order they are received. You need to configure the trigger in the Logic App. Which trigger type and property should you choose?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use the 'HTTP' action with 'OAuth 2.0' authentication and configure the authorization endpoint, client ID, and client secret.. The 'HTTP' action with 'OAuth 2.0' authentication type in Azure Logic Apps is specifically designed to handle the authorization code grant flow, including interactive user consent. It manages the token lifecycle (acquisition, refresh, and storage) automatically, minimizing development effort. You only need to configure the authorization endpoint, client ID, and client secret, and the runtime handles the redirect and token exchange.

Answer

Use the 'HTTP + Swagger' action with 'Identity Provider' authentication.

Answer

Use the 'API Connection' action with a custom connector that uses OAuth 2.0.

Answer

Use the 'HTTP' action with 'Managed identity' authentication.

Question 6

You have multiple Azure virtual machines that need to access the same Azure Key Vault to retrieve certificates. You want to minimize administrative overhead while ensuring each VM can authenticate without managing credentials. Which identity type should you use?

Accepted Answer

User-assigned managed identity assigned to each VM. A user-assigned managed identity can be created once and then assigned to multiple Azure VMs, allowing all of them to authenticate to the same Key Vault without storing any credentials. This minimizes administrative overhead compared to managing separate system-assigned identities or service principals, as the identity is independent of any single VM's lifecycle and can be reused across resources.

Answer

System-assigned managed identity on each VM

Answer

Service principal with client secret stored in each VM

Answer

Storage account key

Question 7

A developer exposes several backend APIs through Azure API Management. Clients must be throttled by subscription to protect the backend. What should be configured?

Accepted Answer

API Management rate-limit or quota policy. Azure API Management provides built-in rate-limit and quota policies that allow you to throttle client requests based on subscription keys. These policies enforce limits per subscription scope, protecting backend services from excessive traffic by rejecting requests that exceed the defined rate (e.g., requests per second) or quota (e.g., total calls per month). This directly addresses the requirement to throttle clients by subscription.

Answer

Blob soft delete

Answer

Application Insights sampling

Answer

Private DNS zone only

Question 8

You are monitoring an Azure App Service using Application Insights. You notice that HTTP 500 errors are increasing, but the standard server response time metric remains normal. You suspect that the errors are occurring in an external API call made by the application. How can you identify the dependency that is failing?

Accepted Answer

Configure Application Insights dependency tracking and view the Dependency Metrics blade.. Application Insights dependency tracking automatically monitors HTTP calls, SQL queries, and other external dependencies made by your application. By viewing the Dependency Metrics blade, you can see failure rates, durations, and dependency names, allowing you to identify which external API call is failing without modifying code.

Answer

Enable snapshot debugging for the application.

Answer

Use Application Insights Profiler to capture code-level traces.

Answer

Set up a custom event telemetry for each external call.

Question 9

You are deploying an application to Azure App Service that requires a custom startup script to initialize the environment. Where should you place the startup script in the application code?

Accepted Answer

As a startup command in the App Service configuration. Azure App Service allows you to specify a custom startup command or script in the App Service configuration (under 'General settings' or via the Azure CLI with `--startup-file`). This startup command runs before the application starts, enabling you to initialize the environment, run pre-deployment tasks, or set up dependencies. Placing the startup script in the configuration ensures it is executed by the App Service platform, which handles the runtime environment (Windows or Linux) and integrates with the application lifecycle.

Answer

In the 'web.config' file

Answer

In a 'docker-compose.yml' file

Answer

In the root of the application code as 'startup.sh'

Question 10

A company uses Azure App Service to host a web application. They need to ensure that only authenticated users from their Microsoft Entra ID tenant can access the app. They also want to prevent unauthenticated requests from reaching the app code. Which configuration should they implement?

Accepted Answer

Enable App Service Authentication with Microsoft Entra ID as the identity provider and set 'Action to take when request is not authenticated' to 'Log in with Microsoft Entra ID'.. Enabling App Service Authentication (EasyAuth) with Microsoft Entra ID as the identity provider and setting 'Action to take when request is not authenticated' to 'Log in with Microsoft Entra ID' ensures that all unauthenticated requests are redirected to Microsoft Entra ID for authentication before they reach the application code. This configuration blocks unauthenticated requests at the platform layer, preventing any unauthenticated traffic from hitting the app's runtime, which meets the requirement of keeping unauthenticated requests away from the app code.

Answer

Configure IP restrictions in the web.config to allow only the company's office IP range.

Answer

Implement a custom middleware in the app to validate tokens from Microsoft Entra ID.

Answer

Assign users to Microsoft Entra ID App Roles and check roles in the app.