AZ-204 Practice Test 40 — 15 Questions

Question 1

You are creating an Azure Functions app that uses a Blob Storage trigger to process new files. The function must process files only when they are completely written (i.e., no ongoing writes). You need to avoid processing partially written files. Which TWO configurations should you consider?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Check the blob's 'LastModified' timestamp in the function code to verify no recent changes.. Option B is correct because inspecting the blob's LastModified timestamp (and comparing it against the current time or a prior poll) lets the function confirm the blob has not been modified recently, which is a standard way to detect that writing has finished before processing. Option C is correct because a timer-triggered function that lists blobs and only processes those whose size has remained stable across polls avoids the race condition inherent in BlobTrigger, which can fire while a blob is still being written. Options A, D, and E are not valid: BatchSize applies to batching/parallelism of trigger invocations and does not guarantee a blob is fully written; there is no LeaseBlob property on the BlobTrigger binding; and ScanBlob is not a real BlobTrigger binding property.

Answer

Increase the 'BatchSize' to reduce the frequency of trigger evaluations.

Answer

Use the 'BlobTrigger' with the 'LeaseBlob' property set to 'True'.

Answer

Set the 'ScanBlob' property to 'True' in the trigger binding.

Question 2

You are building a serverless API using Azure Functions. The API must authenticate requests using Microsoft Entra ID. You need to restrict access to users from a specific Microsoft Entra tenant only. What should you configure in the function app?

Accepted Answer

Set the 'Issuer URL' to the specific tenant's endpoint.. Setting the 'Issuer URL' to the specific tenant's endpoint (e.g., https://login.microsoftonline.com/{tenant-id}/v2.0) tells Azure Functions to validate that the token was issued by that exact tenant. This restricts access to users from that tenant only, as tokens from other tenants will fail issuer validation.

Answer

Set the 'Allowed Token Audiences' to the application ID.

Answer

Enable 'Require Authentication' and set the action to 'Login with Microsoft Entra ID'.

Answer

Set the 'Client ID' to the application ID.

Question 3

You need to secure a web API that is called from a single-page application (SPA). The API uses Microsoft Entra ID for authentication. Which OAuth 2.0 flow should the SPA use?

Accepted Answer

Authorization code flow with PKCE. The authorization code flow with PKCE (Proof Key for Code Exchange) is the recommended OAuth 2.0 flow for single-page applications because it provides a secure way to obtain an access token without exposing the client secret, which cannot be stored confidentially in a browser. PKCE adds a cryptographic challenge to prevent authorization code interception attacks, making it the only flow that meets modern security standards for public clients like SPAs calling Microsoft Entra ID-protected APIs.

Answer

Resource owner password credentials flow

Answer

Client credentials flow

Answer

Implicit flow

Question 4

You need to secure access to an Azure Storage account that contains sensitive data. Which TWO of the following are recommended best practices?

Accepted Answer

Use managed identities to access storage from Azure services. Option B is correct because managed identities let Azure services (such as VMs, App Service, or Functions) authenticate to Storage using Microsoft Entra ID tokens, eliminating the need to store and manage storage account keys or connection strings in code or configuration. Option C is correct because configuring firewall rules on the storage account to allow only specific public IP addresses or Azure virtual networks (via service endpoints or private endpoints) restricts network-level access to trusted sources, which is a core defense-in-depth practice for sensitive data. Option A is not recommended because rotating keys every 24 hours is operationally impractical and unnecessary; Microsoft recommends periodic rotation (for example, every 90 days) or, better, avoiding keys entirely by using Microsoft Entra ID/managed identities. Option D is wrong because long-lived SAS tokens increase the exposure window if leaked; SAS tokens should be short-lived and scoped with least privilege. Option E is wrong because enabling anonymous public access to all containers exposes data to anyone on the internet and directly violates the goal of securing sensitive data.

Answer

Rotate storage account keys every 24 hours

Answer

Use SAS tokens with long expiry dates

Answer

Enable anonymous public access for all containers

Question 5

You are developing an ASP.NET Core web app that will be deployed to Azure App Service. The app needs to authenticate users from a Microsoft Entra ID tenant. You want to minimize development effort and rely on platform features. What should you do?

Accepted Answer

Enable App Service Authentication in the Azure portal and configure Microsoft Entra ID as the identity provider.. Enabling App Service Authentication (also known as EasyAuth) in the Azure portal allows you to configure Microsoft Entra ID as the identity provider with minimal code changes. This approach leverages the platform's built-in authentication layer, which automatically handles token validation, session management, and redirects, thereby reducing development effort and relying on Azure's managed features.

Answer

Implement custom OAuth 2.0 middleware in the app.

Answer

Add Microsoft.Identity.Web NuGet package and configure it in Startup.cs to use Microsoft Entra ID.

Answer

Use Microsoft Entra ID App Roles and add role checks in the code.

Question 6

You are developing a web application that processes images uploaded by users. The images must be resized and analyzed for offensive content before being stored. You need to implement the solution with minimal latency and cost. What should you do?

Accepted Answer

Use an Azure Function triggered by Blob Storage, with Consumption plan.. Using an Azure Function triggered by Blob Storage on a Consumption plan provides a serverless, event-driven architecture that automatically scales to process each image upload with minimal latency and cost. The Consumption plan charges only for execution time and resources used, making it cost-effective for sporadic workloads, while the Blob Storage trigger ensures immediate processing upon upload without polling or additional infrastructure.

Answer

Use Azure Batch to process images in parallel.

Answer

Use Durable Functions to orchestrate the resizing and analysis.

Answer

Use Azure Logic Apps with a trigger for each upload.

Question 7

Which THREE considerations are important when designing a solution using Azure API Management (APIM) to secure backend APIs?

Accepted Answer

Implement rate limiting to prevent abuse. Option A is correct because implementing rate limiting (via the rate-limit or rate-limit-by-key policy) in APIM protects backend APIs from abuse, throttling excessive requests and mitigating denial-of-service or brute-force scenarios. Option C is correct because using OAuth2 authentication with Microsoft Entra ID (Microsoft Entra ID) lets APIM validate caller identity through token issuance and scopes, ensuring only authorized clients can reach the backend. Option D is correct because JWT validation policies (validate-jwt) verify token signatures, issuers, audiences, and claims at the gateway, enforcing authentication and authorization before requests reach the backend. Option B is wrong because storing backend database credentials in APIM policies exposes secrets in policy definitions; credentials should be kept in Azure Key Vault and referenced via named values. Option E is wrong because disabling TLS removes transport encryption, exposing API traffic to interception and violating security best practices.

Answer

Store backend database credentials in APIM policies

Answer

Disable TLS to improve performance

Question 8

Which TWO actions should you take to optimize costs for an Azure SQL Database that is underutilized? (Choose two.)

Accepted Answer

Purchase reserved capacity. Option C (Purchase reserved capacity) is correct because committing to a 1- or 3-year reservation for Azure SQL Database provides a significant discount (up to ~33% for 1-year and ~55% for 3-year) compared to pay-as-you-go pricing, directly reducing cost for a database that will continue running. Option E (Scale down to a lower service tier) is correct because an underutilized database is provisioned with more DTUs/vCores than it needs, so moving to a lower service tier or compute size reduces the hourly provisioned cost while still meeting actual workload demand. Option A (Enable geo-replication) is incorrect because it adds a secondary readable database and increases cost rather than optimizing it. Option B (Increase the DTU or vCore limit) is incorrect because it raises provisioned resources and cost, the opposite of optimization for an underutilized database. Option D (Enable read scale-out) is incorrect because, while it can offload read workloads, it does not reduce the cost of an underutilized database and may require a higher service tier.

Answer

Enable geo-replication

Answer

Increase the DTU or vCore limit

Answer

Enable read scale-out

Question 9

Your company runs a batch processing job on Azure Batch. The job processes large datasets and requires access to Azure Storage. You need to ensure that the compute nodes can securely access the storage account without exposing credentials. What should you configure?

Accepted Answer

Managed identity for the Batch pool. Managed identities for Azure resources allow compute nodes to authenticate to Azure Storage without storing credentials. Option A is wrong because Microsoft Entra ID service principals require managing credentials and are not the simplest approach for Batch compute nodes to access storage. Option B is wrong because storage account access keys are shared secrets that should not be exposed. Option D is wrong because shared access signatures (SAS) tokens can be exposed and need to be managed.

Answer

Azure AD service principal

Answer

Storage account access keys

Answer

Shared access signatures (SAS)

Question 10

A queue-processing application stores work items in Azure Queue Storage. A worker crashes after receiving a message. What determines when the message becomes available for another worker?

Accepted Answer

Visibility timeout. When a worker receives a message from Azure Queue Storage, the message becomes invisible to other workers for a period defined by the visibility timeout. If the worker crashes without deleting or updating the message, the visibility timeout expires and the message reappears in the queue, making it available for another worker to process. This mechanism ensures at-least-once processing and prevents message loss on worker failure.

Answer

Blob lease duration

Answer

Message TTL only

Answer

Poison queue threshold only

Question 11

Your company stores sensitive financial documents in Azure Blob Storage. You need to ensure that only authorized users can access the blobs, and you must avoid exposing storage account keys. You want to generate time-limited URLs that grant access to specific blobs. What should you use?

Accepted Answer

Shared Access Signatures (SAS). Shared Access Signatures (SAS) are the correct choice because they allow you to delegate access to specific blobs with granular permissions (read, write, delete) and enforce a time-limited validity period, all without exposing the storage account keys. This directly meets the requirement of generating time-limited URLs for authorized access while keeping the account keys secure.

Answer

Storage account access keys

Answer

Azure role-based access control (RBAC)

Answer

Managed identities for Azure resources

Question 12

Your company stores backup files in an Azure Blob Storage account. These files are written once and then need to be retained for 7 years. During the first year, the files are accessed weekly. After the first year, they are accessed rarely (once per month). You want to minimize storage costs. Which combination of access tiers and lifecycle management should you apply?

Accepted Answer

Store in Hot tier and move to Cool after 1 year, then to Archive after 7 years.. For data accessed weekly during the first year, the Hot tier is appropriate, or the Cool tier if storage cost savings significantly outweigh transaction costs. For data accessed monthly after the first year, the Cool tier is the most cost-effective choice, balancing lower storage costs with reasonable access costs without incurring rehydration fees or significant latency. The Archive tier is suitable only for data that is rarely accessed (e.g., less than once a year) and can tolerate significant retrieval latency and cost. Therefore, the optimal strategy among the given options is to store in Hot for the first year, move to Cool for the subsequent years of monthly access, and then to Archive only after the 7-year retention period if access truly ceases.

Answer

Store in Cool tier and move to Archive after 1 year.

Answer

Store directly in Archive tier and rehydrate to Cool when needed for access.

Answer

Store in Hot tier and move to Archive after 90 days.

Question 13

You need to ensure that an Azure Functions app can access a blob in Azure Storage using its system-assigned managed identity. What should you do first?

Accepted Answer

Enable the managed identity in the Function App. To use a system-assigned managed identity, it must first be enabled on the Azure Functions app. This action creates the identity in Microsoft Entra ID. Once the identity is enabled, you can then assign the necessary Azure RBAC role, such as 'Storage Blob Data Reader', to this identity at the storage account scope to grant it permissions to access the blob storage. Therefore, enabling the managed identity is the foundational first step.

Answer

Configure CORS on the storage account

Answer

Assign the Storage Blob Data Reader role to the managed identity at the storage account scope

Answer

Generate a SAS token for the blob

Question 14

You are deploying a web app to Azure App Service that must use a custom domain with TLS/SSL. You have purchased an SSL certificate from a third-party CA. How should you upload and bind the certificate to the custom domain?

Accepted Answer

Upload the .pfx file to the App Service TLS/SSL settings and bind it to the custom domain.. Azure App Service requires a .pfx file containing both the public certificate and the private key to bind a custom domain with TLS/SSL. The .pfx file is uploaded directly in the App Service's TLS/SSL settings, and then the certificate is bound to the custom domain, enabling HTTPS traffic.

Answer

Place the certificate files in the wwwroot folder of the app and configure the web.config.

Answer

Import the certificate into Azure Key Vault and reference it from App Service.

Answer

Upload the .cer file to the App Service and let Azure generate the private key.

Question 15

You need to securely transfer an on-premises database backup to Azure Blob Storage. The backup file is 500 GB. You have limited bandwidth (10 Mbps) and need the transfer to complete within 24 hours. What is the best solution?

Accepted Answer

Use Azure Data Box to physically ship the data to Azure.. Given the 500 GB backup file and a 10 Mbps bandwidth limit, the theoretical maximum transfer time over the internet is approximately 500 GB * 8 bits/byte / (10 Mbps) = 400,000 seconds ≈ 111 hours, far exceeding the 24-hour requirement. Azure Data Box is the best solution because it allows you to physically ship the data on a secure, ruggedized device, bypassing network constraints entirely and ensuring the transfer completes within the required timeframe.

Answer

Use Azure File Sync to replicate the backup to Azure Files.

Answer

Use AzCopy to copy the backup file directly to Blob Storage.

Answer

Set up an ExpressRoute connection and use AzCopy.