AZ-204 Practice Test 41 — 15 Questions

Question 1

A serverless app must react whenever audit documents are inserted or updated in Cosmos DB. Which trigger should the Azure Function use? The design must avoid adding custom operational scripts.

Accepted Answer

Cosmos DB trigger. The Azure Cosmos DB trigger is the correct choice because it natively listens to the Cosmos DB change feed, which captures inserts and updates to documents. This allows the Azure Function to react automatically without any custom scripts or polling logic, aligning with the serverless and operational simplicity requirements.

Answer

Queue trigger

Answer

Timer trigger

Answer

HTTP trigger

Question 2

A company uses Azure Cosmos DB for a global e-commerce platform. They need to query product inventory across multiple regions with low latency. The data is partitioned by product category. Some queries filter on category and price range. What indexing policy should be configured to optimize these queries?

Accepted Answer

Create a composite index with (category, price).. A composite index on (category, price) allows Cosmos DB to efficiently satisfy queries that filter on both fields in a single index seek, avoiding a full scan. Composite indexes are designed for multi-property filters and sort orders, which directly matches the requirement to query by category and price range with low latency.

Answer

Use a wildcard index for all properties.

Answer

Add a hash index on category and a range index on price.

Answer

Enable spatial index on price.

Question 3

A company uses Azure Service Bus for messaging between microservices. They need to ensure that messages are processed in order within a partition. Which feature should they enable?

Accepted Answer

Sessions. Sessions in Azure Service Bus provide strict message ordering and first-in-first-out (FIFO) guarantees within a session. By setting the SessionId property on messages, all messages with the same session ID are processed sequentially by a single receiver, ensuring order is preserved even across multiple partitions or competing consumers.

Answer

Duplicate detection

Answer

Partitioning

Answer

Dead-letter queue

Question 4

You are developing an application that needs to retrieve secrets from Azure Key Vault. The application will run as an Azure Functions app. Which authentication method should you use to access Key Vault?

Accepted Answer

Use a system-assigned managed identity. A system-assigned managed identity is the recommended authentication method for Azure Functions to access Key Vault because it eliminates the need to store credentials in code or configuration. When enabled, Azure automatically creates a service principal in Microsoft Entra ID for the function app, and the function can authenticate to Key Vault using this identity via the Azure Identity SDK (e.g., DefaultAzureCredential). This approach is secure, fully managed, and aligns with the principle of least privilege.

Answer

Use a client certificate stored in the function app

Answer

Use the Key Vault connection string from app settings

Answer

Use the storage account access key from the function app

Question 5

Match each Azure DevOps component to its function.

Accepted Answer

Azure Boards: Manage work items, user stories, and bugs.. Correct matches: Azure Boards tracks work items, Azure Repos hosts source code, Azure Pipelines automates builds and deployments. Common confusions include mixing up Boards with Repos, or Repos with Pipelines.

Answer

Azure Boards: Store and version source code.

Answer

Azure Repos: Build, test, and deploy to any platform.

Question 6

A long-running webhook processor must process thousands of independent files. The developer wants status tracking, checkpoints, and replay-safe orchestration. Which Azure Functions capability should be used?

Accepted Answer

Durable Functions orchestrator. Durable Functions orchestrator is correct because it provides built-in support for status tracking, checkpointing, and replay-safe orchestration via the Event Sourcing pattern. The orchestrator function automatically saves execution history to a storage table, enabling reliable resumption after crashes or restarts, which is essential for processing thousands of independent files with long-running workflows.

Answer

Blob lifecycle management

Answer

Timer trigger only

Answer

Azure Policy remediation

Question 7

You need to deploy a containerized application to Azure Container Instances (ACI) with a public IP address and a DNS name label. Which YAML property should you configure for the DNS name?

Accepted Answer

dnsNameLabel. The `dnsNameLabel` property in the Azure Container Instances YAML definition is used to assign a custom DNS prefix to the container group's public IP address. When combined with the Azure region's default domain suffix (e.g., `eastus.azurecontainer.io`), this creates a fully qualified domain name (FQDN) like `<dnsNameLabel>.eastus.azurecontainer.io`, allowing clients to resolve the container group via DNS without needing the raw IP address.

Answer

containerGroupName

Answer

ipAddress

Answer

ports

Question 8

Which Azure Blob Storage access tier is optimized for infrequently accessed data with a minimum storage duration of 30 days?

Accepted Answer

Cool. The Cool tier is optimized for infrequently accessed data and has a minimum storage duration of 30 days, matching both requirements. The Archive tier is for infrequently accessed data but requires a minimum storage duration of 180 days, so it does not meet the 30-day requirement. The Hot tier is for frequently accessed data. The Premium tier is for high-performance, frequently accessed data. 'Transactional' is not a standard Azure Blob Storage access tier. Therefore, among the given options, only Cool satisfies all criteria.

Answer

Transactional

Answer

Archive

Answer

Premium

Answer

Hot

Question 9

You are developing a serverless application using Azure Functions that processes orders. Each order must be validated by calling a third-party API. If the third-party API is unavailable, the function should retry with exponential backoff. How should you implement this?

Accepted Answer

Implement retry logic with exponential backoff and circuit breaker using Polly within the function. It uses the Polly library to implement retry logic with exponential backoff and circuit breaker, which is a lightweight and flexible approach. Option B is incorrect because the trigger binding's automatic retries are for infrastructure failures (e.g., message delivery), not for application-level errors like API unavailability. Option C is incorrect because a long timeout does not handle transient faults; it just waits. Option D is incorrect because, while Azure Durable Functions does support retry via CallActivityWithRetryAsync, it introduces unnecessary complexity (orchestration overhead) for a simple HTTP call that can be handled directly with a library like Polly.

Answer

Enable automatic retries on the function's trigger binding

Answer

Configure the function to have a long timeout and hope the API responds

Answer

Use Azure Durable Functions to orchestrate the retry

Question 10

Which TWO methods can you use to authenticate an Azure App Service web app to Azure SQL Database without storing credentials in code? (Choose two.)

Accepted Answer

Store the SQL connection string in Azure Key Vault and use a Key Vault reference in the app settings.. Azure App Service supports Key Vault references in application settings, allowing you to reference secrets stored in Azure Key Vault without hardcoding credentials. This pattern uses the Managed Service Identity (MSI) of the App Service to authenticate to Key Vault at runtime, retrieving the SQL connection string securely. Option B is correct because enabling a system-assigned managed identity on the App Service and granting it access to the Azure SQL Database via an Microsoft Entra ID user or contained database user eliminates the need for any stored credentials, as the app authenticates directly to SQL using the managed identity token.

Answer

Use a connection string with a SQL username and password.

Answer

Use a service principal with a client secret stored in app settings.

Answer

Use a client certificate installed on the App Service.

Question 11

Your company uses Microsoft Defender for Cloud. You need to receive alerts when a user modifies a Key Vault access policy. What should you configure?

Accepted Answer

Set up an activity log alert on the Key Vault. Activity log alerts in Azure Monitor can be configured to trigger on specific administrative operations, such as 'Microsoft.KeyVault/vaults/accessPolicies/write'. This allows you to receive near real-time notifications when a Key Vault access policy is modified, directly addressing the requirement without additional services or complex setups.

Answer

Create an Azure Policy to audit access policy changes

Answer

Configure Microsoft Sentinel to monitor Key Vault

Answer

Enable Key Vault logging and query logs

Question 12

A function consumes messages from Azure Service Bus. Which two settings help handle transient failures safely? The design must avoid adding custom operational scripts.

Accepted Answer

Configure max delivery count with a dead-letter queue. Configuring a max delivery count with a dead-letter queue allows the system to automatically move a message to the dead-letter queue after a specified number of failed delivery attempts. This prevents poison messages from being retried indefinitely, handling transient failures safely without custom scripts. Option B is correct because idempotent message processing ensures that if a message is processed more than once due to transient failures or retries, the system state remains consistent, avoiding duplicate side effects.

Answer

Disable lock renewal for long processing

Answer

Use anonymous sender access

Question 13

You are designing a solution that requires asynchronous processing of messages from an Azure Service Bus queue. The solution must guarantee at-least-once delivery and handle poison messages automatically. Which combination of Service Bus features should you use?

Accepted Answer

PeekLock mode with dead-letter queue. PeekLock mode is required for at-least-once delivery because it allows the consumer to process the message and then explicitly complete it, ensuring the message is not removed from the queue until processing succeeds. The dead-letter queue automatically handles poison messages by moving messages that exceed the maximum delivery count or fail processing, preventing them from blocking the queue.

Answer

ReceiveAndDelete mode with a separate dead-letter queue

Answer

ReceiveAndDelete mode with automatic forwarding

Answer

PeekLock mode with sessions

Question 14

A developer needs to run a Kusto query against application request data to identify 95th percentile latency by operation. Where should the query be run?

Accepted Answer

Logs in Application Insights or the associated Log Analytics workspace. Application Insights stores application request data, including latency metrics, and supports Kusto queries via its Logs blade. The associated Log Analytics workspace also provides the same query capabilities, making it the correct location to run a Kusto query for 95th percentile latency by operation.

Answer

Microsoft Entra audit logs

Answer

Azure Key Vault diagnostic settings

Answer

Azure Resource Graph only

Question 15

Which THREE Azure services can be used to send email notifications from an application?

Accepted Answer

Azure Logic Apps. Azure Logic Apps is correct because it provides built-in connectors (e.g., Office 365 Outlook, SMTP, SendGrid) that allow you to design workflows to send email notifications without writing custom code. You can trigger these workflows from various sources (HTTP requests, timers, Azure services) and include conditional logic, making it a serverless, low-code solution for email notifications.

Answer

Azure Event Grid

Answer

Azure Service Bus