AZ-204 Practice Test 41 — 15 Questions

Question 1

You are designing a data archiving solution for compliance. Data must be stored for 7 years, with immediate deletion prohibited until the retention period expires. The solution must minimize storage costs while ensuring data is not modifiable. Which THREE Azure features should you combine?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Azure Blob Storage. Azure Blob Storage is the correct foundational service because it supports immutable storage, which enforces a WORM (Write Once, Read Many) policy. This ensures data cannot be modified or deleted during the retention period, meeting compliance requirements. Combined with time-based retention policies and cool/archive tiers, it provides a cost-effective, unmodifiable archive solution.

Answer

Azure Files

Answer

Azure Backup

Question 2

Which TWO actions should you take to secure an Azure Kubernetes Service (AKS) cluster that runs a critical workload? (Choose two.)

Accepted Answer

Enable Azure AD integration with Kubernetes RBAC. Integrating Azure AD with Kubernetes RBAC provides centralized identity management and fine-grained access control for the AKS cluster. This allows you to authenticate users via Azure AD and authorize their actions using Kubernetes RBAC roles, ensuring that only authenticated and authorized users can perform operations on the cluster, which is critical for securing a production workload.

Answer

Store secrets as Kubernetes secrets without encryption

Answer

Enable SSH access to all nodes for troubleshooting

Answer

Deploy Azure Firewall in the cluster VNet

Question 3

Your company uses Azure API Management to manage APIs. You need to implement policies that ensure only authenticated requests from partners are allowed, and that responses are cached to improve performance. Which THREE policies should you configure?

Accepted Answer

cache-store. (cache-store) is correct because it is part of the caching policy in Azure API Management. When combined with cache-lookup, it stores the response in the internal or external cache after the backend has processed the request, reducing latency and backend load for subsequent identical requests. This directly supports the requirement to improve performance by caching responses.

Answer

set-header

Answer

rate-limit

Question 4

Your company is migrating a monolithic application to Azure. The application consists of several components that need to be deployed and scaled independently. You need to design a container orchestration solution. Which TWO services should you consider?

Accepted Answer

Azure Container Apps. Azure Container Apps (B) is correct because it provides a serverless container orchestration platform that allows you to deploy and scale microservices independently without managing the underlying Kubernetes infrastructure. It supports event-driven scaling, revision management, and split traffic routing, making it ideal for migrating monolithic applications to a microservices architecture with minimal operational overhead.

Answer

Azure Container Instances

Answer

Azure Batch

Answer

Azure Service Fabric

Question 5

You need to implement a solution for storing and retrieving large amounts of unstructured data (e.g., images, videos, backups) in Azure, with high durability and availability. The solution must allow access from anywhere via HTTP/HTTPS and support both public and private access. Which TWO Azure storage services should you consider?

Accepted Answer

Azure Data Lake Storage Gen2. Azure Blob Storage is purpose-built for storing large amounts of unstructured data such as images, videos, and backups, offering high durability (99.9999999999% with RA-GRS) and availability. It supports access via HTTP/HTTPS from anywhere, and provides both public (anonymous) and private (SAS tokens, RBAC) access controls, making it the primary choice for this scenario.

Answer

Azure Table Storage

Answer

Azure Queue Storage

Answer

Azure Files

Question 6

Which TWO Azure Monitor features can help troubleshoot a web app that returns slow response times intermittently?

Accepted Answer

Live Metrics. Live Metrics (C) is correct because it provides real-time, low-latency monitoring of a web app's performance, including CPU, memory, and request rates, allowing you to observe intermittent slow responses as they happen without sampling delays. Application Map (D) is correct because it visualizes the distributed components of your application and their dependencies, helping you identify which downstream service or component is causing latency spikes during intermittent slowdowns.

Answer

Sentinel incidents

Answer

Advisor recommendations

Answer

Policy compliance

Question 7

Which TWO approaches can you use to call an external REST API from an Azure Function while ensuring the API key is not exposed in the function code?

Accepted Answer

Store the API key as an environment variable in the function app settings.. Storing the API key in the function app settings (environment variables) keeps it out of the source code and allows the function to access it via the `Environment.GetEnvironmentVariable` method at runtime. Option E is correct because Azure Key Vault, combined with a Managed Identity, provides a secure, auditable, and rotation-friendly way to store secrets without embedding them in code or configuration files.

Answer

Store the API key in GitHub repository secrets.

Answer

Hardcode the API key in the function code.

Answer

Pass the API key in an HTTP header and include it in the source code.

Question 8

Which TWO actions should you take to reduce the cost of an Azure App Service plan that is underutilized?

Accepted Answer

Scale out to fewer instances. Scaling out to fewer instances directly reduces the number of VMs running the App Service plan, which lowers the compute cost. Since the plan is underutilized, fewer instances can handle the existing load without performance degradation, making this a cost-optimization action.

Answer

Deploy the application to a different region

Answer

Enable auto-scaling

Answer

Purchase Reserved Instances

Question 9

Which THREE are valid ways to authenticate an Azure Functions app to an Azure Service Bus namespace?

Accepted Answer

Using an Azure AD token obtained via DefaultAzureCredential. DefaultAzureCredential from the Azure Identity library can authenticate to Azure Service Bus using Azure AD tokens. This credential chain attempts multiple authentication sources (environment variables, managed identity, Visual Studio, etc.) to obtain a token, which is then used to authorize requests to the Service Bus namespace via Azure RBAC.

Answer

Using a client certificate

Answer

Using a SAS key stored in code

Question 10

Match each Azure messaging pattern to its description.

Accepted Answer

Azure Queue Storage: Simple message queuing for decoupling application components.. Azure messaging patterns include Queue Storage for simple queuing, Service Bus Topics for pub-sub with filters, Event Grid for event routing, and Event Hubs for streaming. Common confusions involve attributing advanced features like dead-lettering to Queue Storage or mixing IoT scenarios with Service Bus Topics.

Answer

Azure Queue Storage: Reliable message delivery with dead-lettering and scheduling.

Answer

Azure Service Bus Topic: Real-time IoT device communication.

Question 11

A company stores sensitive data in an Azure Storage account. They need to restrict access based on the client's IP address and require that clients use a valid SAS token. Which mechanism should they use?

Accepted Answer

SAS token with IP ACL.. A SAS token with an IP ACL (access control list) allows you to restrict access to a specific client IP address or range of IP addresses while also requiring a valid SAS token for authentication. This meets both requirements: IP-based restriction and SAS token validation. The IP ACL is specified as part of the SAS token's signed IP (sip) parameter, which enforces that requests must originate from the allowed IP range.

Answer

Microsoft Entra ID authentication.

Answer

Shared Key.

Answer

Firewall and virtual networks.

Question 12

Refer to the exhibit. An Azure App Service deployment is configured using this ARM template snippet. The web app is built from a GitHub repository. However, when a pull request is merged to main, the app does not automatically deploy. What is the most likely cause?

Accepted Answer

The GitHub Actions workflow file is missing from the repository.. The most likely cause is that the GitHub Actions workflow file is missing from the repository. The ARM template configures the web app to use GitHub Actions for deployment, but it does not create the workflow file. Without the workflow file in the repository at the path referenced (e.g., .github/workflows/), the deployment will not trigger on pull request merges. Option A is incorrect because isManualIntegration: false means automated deployment is expected. Option B is unlikely because the runtime stack is typically specified correctly in the ARM template. Option C is incorrect because the branch is set to main, which typically triggers deployments on merges to main.

Answer

The isManualIntegration property is set to false.

Answer

The runtime stack is incorrect for the application.

Answer

The branch is set to main, but the deployments only trigger on a different branch.

Question 13

You are building a serverless API using Azure Functions. The API must authenticate requests using Microsoft Entra ID. You need to restrict access to users from a specific Microsoft Entra tenant only. What should you configure in the function app?

Accepted Answer

Set the 'Issuer URL' to the specific tenant's endpoint.. Setting the 'Issuer URL' to the specific tenant's endpoint (e.g., https://login.microsoftonline.com/{tenant-id}/v2.0) tells Azure Functions to validate that the token was issued by that exact tenant. This restricts access to users from that tenant only, as tokens from other tenants will fail issuer validation.

Answer

Set the 'Allowed Token Audiences' to the application ID.

Answer

Enable 'Require Authentication' and set the action to 'Login with Microsoft Entra ID'.

Answer

Set the 'Client ID' to the application ID.

Question 14

You need to secure a web API that is called from a single-page application (SPA). The API uses Microsoft Entra ID for authentication. Which OAuth 2.0 flow should the SPA use?

Accepted Answer

Authorization code flow with PKCE. The authorization code flow with PKCE (Proof Key for Code Exchange) is the recommended OAuth 2.0 flow for single-page applications because it provides a secure way to obtain an access token without exposing the client secret, which cannot be stored confidentially in a browser. PKCE adds a cryptographic challenge to prevent authorization code interception attacks, making it the only flow that meets modern security standards for public clients like SPAs calling Microsoft Entra ID-protected APIs.

Answer

Resource owner password credentials flow

Answer

Client credentials flow

Answer

Implicit flow

Question 15

You are building an Azure Logic App that needs to call an external REST API. The API requires an API key to be passed in the 'X-API-Key' header. You have stored the API key as a secret in Azure Key Vault. The Logic App uses a managed identity that has read access to the Key Vault secret. You want to retrieve the API key securely at runtime and include it in the HTTP request. Which approach should you use?

Accepted Answer

Add a 'Get secret' action from Key Vault to retrieve the secret, then use the 'HTTP' action and set the 'X-API-Key' header to the secret value using a dynamic expression.. It uses the native 'Get secret' action from Azure Key Vault to securely retrieve the API key at runtime, leveraging the Logic App's managed identity for authentication. The secret value can then be dynamically injected into the 'X-API-Key' header of the subsequent HTTP action using an expression like `@{outputs('Get_secret')?['value']}`. This approach follows the principle of least privilege and avoids hardcoding secrets or exposing them in configuration.

Answer

Configure the HTTP action to use managed identity authentication and set the 'Audience' to the Key Vault URL. This will automatically pass the API key as the Authorization header.

Answer

Store the API key in an Azure App Service application setting and reference it from the Logic App using the 'appsetting' function.

Answer

Use the 'Invoke an HTTP endpoint' action with Application Insights dependency tracking enabled. The API key is automatically logged by Application Insights.