AZ-204 Practice Test 42 — 15 Questions

Question 1

You are developing an ASP.NET Core web app that will be deployed to Azure App Service. The app needs to authenticate users from a Microsoft Entra ID tenant. You want to minimize development effort and rely on platform features. What should you do?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable App Service Authentication in the Azure portal and configure Microsoft Entra ID as the identity provider.. Enabling App Service Authentication (also known as EasyAuth) in the Azure portal allows you to configure Microsoft Entra ID as the identity provider with minimal code changes. This approach leverages the platform's built-in authentication layer, which automatically handles token validation, session management, and redirects, thereby reducing development effort and relying on Azure's managed features.

Answer

Implement custom OAuth 2.0 middleware in the app.

Answer

Add Microsoft.Identity.Web NuGet package and configure it in Startup.cs to use Microsoft Entra ID.

Answer

Use Microsoft Entra ID App Roles and add role checks in the code.

Question 2

You are developing a web application that processes images uploaded by users. The images must be resized and analyzed for offensive content before being stored. You need to implement the solution with minimal latency and cost. What should you do?

Accepted Answer

Use an Azure Function triggered by Blob Storage, with Consumption plan.. Using an Azure Function triggered by Blob Storage on a Consumption plan provides a serverless, event-driven architecture that automatically scales to process each image upload with minimal latency and cost. The Consumption plan charges only for execution time and resources used, making it cost-effective for sporadic workloads, while the Blob Storage trigger ensures immediate processing upon upload without polling or additional infrastructure.

Answer

Use Azure Batch to process images in parallel.

Answer

Use Durable Functions to orchestrate the resizing and analysis.

Answer

Use Azure Logic Apps with a trigger for each upload.

Question 3

You manage a web application on Azure App Service. You need to monitor its availability from multiple geographic locations, checking that the homepage loads and returns HTTP 200 within 5 seconds. You want an alert if any location fails. Which type of Application Insights test should you create?

Accepted Answer

Standard test. A Standard test (also known as a URL ping test) is the correct choice because it is the simplest availability test in Application Insights, designed to check that a single URL returns an HTTP 200 response within a specified timeout (here, 5 seconds). It can be configured to run from multiple geographic locations, and you can set an alert to fire if any location reports a failure, meeting the requirement exactly. In the Azure portal, this test type is explicitly named 'Standard test'.

Answer

Availability test (URL ping test)

Answer

Multi-step web test

Answer

Custom metric test

Question 4

Your company uses Azure API Management to expose APIs to external partners. You need to implement rate limiting per subscription key to prevent abuse, but you also want to allow burst traffic up to a certain limit. Which policy should you configure?

Accepted Answer

Add a 'rate-limit' policy with a renewal period of 60 seconds and a burst count of 10.. The 'rate-limit' policy in Azure API Management allows you to set a rate limit (e.g., requests per 60 seconds) with a burst count, enabling short bursts of traffic beyond the steady-state limit. When applied at the product scope, it effectively enforces per-subscription throttling, meeting the requirement to prevent abuse while allowing burst traffic.

Answer

Add a 'quota-per-key' policy with a renewal period of 1 day.

Answer

Add a 'limit' policy with a condition on subscription key.

Answer

Add a 'rate-limit-by-key' policy with a counter key of 'subscription-key'.

Question 5

An Azure Functions report export service processes Service Bus messages. The function sometimes fails after partially completing work. Which two practices improve correctness?

Accepted Answer

Use dead-letter handling for repeatedly failing messages. Azure Functions can use dead-letter handling to isolate messages that repeatedly fail processing, preventing them from blocking the queue and allowing investigation without data loss. This is a standard pattern for Service Bus triggered functions to manage poison messages gracefully.

Answer

Store connection strings in source code

Answer

Disable retries for all messages

Question 6

A storage account for thumbnail metadata must allow an application to read only blobs under one container for two hours. The application should not receive the account key. What should be issued?

Accepted Answer

A service SAS scoped to the container with read permission and expiry. A service SAS scoped to a container with read permission and an expiry of two hours is the correct approach because it provides delegated, time-limited access to specific blobs under that container without exposing the storage account key. The SAS token is generated using the account key but the application only receives the token, not the key itself, ensuring the key remains secure. This meets the requirement for read-only access to a single container for a limited duration.

Answer

A public access level on the container

Answer

A management group assignment

Answer

The storage account access key

Question 7

You need to restrict access to an Azure Storage blob container so that only users from your Microsoft Entra tenant can read blobs, and deny all other access including anonymous traffic. What should you configure?

Accepted Answer

Set public access level to private and assign RBAC roles to users. Setting the public access level to private disables anonymous access, and assigning RBAC roles such as Storage Blob Data Reader to Entra ID users ensures only authenticated users from your tenant can read blobs. Option A is incorrect because a SAS token can be shared externally, allowing access to users outside your tenant. Option C is incorrect because a network firewall only restricts by IP address and does not authenticate users; anonymous traffic from allowed IPs would still be permitted. Option D is incorrect because storage account access keys grant full administrative access to the account, not read-only access for specific users, and distributing keys is insecure.

Answer

Generate a shared access signature (SAS) for the container

Answer

Configure a network firewall to allow only your tenant's IP range

Answer

Use storage account access keys and distribute them to users

Question 8

Your company stores backup files in an Azure Blob Storage account. These files are written once and then need to be retained for 7 years. During the first year, the files are accessed weekly. After the first year, they are accessed rarely (once per month). You want to minimize storage costs. Which combination of access tiers and lifecycle management should you apply?

Accepted Answer

Store in Hot tier and move to Cool after 1 year, then to Archive after 7 years.. For data accessed weekly during the first year, the Hot tier is appropriate, or the Cool tier if storage cost savings significantly outweigh transaction costs. For data accessed monthly after the first year, the Cool tier is the most cost-effective choice, balancing lower storage costs with reasonable access costs without incurring rehydration fees or significant latency. The Archive tier is suitable only for data that is rarely accessed (e.g., less than once a year) and can tolerate significant retrieval latency and cost. Therefore, the optimal strategy among the given options is to store in Hot for the first year, move to Cool for the subsequent years of monthly access, and then to Archive only after the 7-year retention period if access truly ceases.

Answer

Store in Cool tier and move to Archive after 1 year.

Answer

Store directly in Archive tier and rehydrate to Cool when needed for access.

Answer

Store in Hot tier and move to Archive after 90 days.

Question 9

Which FOUR of the following are true regarding Microsoft Entra ID authentication for Azure Storage?

Accepted Answer

RBAC roles can be used to grant permissions to a user or service principal.. Microsoft Entra ID authentication for Azure Storage uses OAuth 2.0 access tokens. Users, service principals, and managed identities can be granted access through Azure RBAC roles. Managed identities authenticate without stored credentials. Shared Key authorization remains enabled by default even when Microsoft Entra ID authentication is enabled; it must be explicitly disabled by setting AllowSharedKeyAccess to false. SAS tokens are supported and are not incompatible with Microsoft Entra ID authentication, so option A is false.

Answer

SAS tokens are not supported when using Microsoft Entra ID authentication.

Question 10

You deploy an Azure App Service web app that uses a system-assigned managed identity. The app needs to read a secret stored in Azure Key Vault to connect to a third-party service. You want to grant the minimum required permissions to the managed identity. Which Azure RBAC role should you assign to the managed identity at the Key Vault scope?

Accepted Answer

Key Vault Secrets User. The 'Key Vault Secrets User' role grants the minimum required permission—'Microsoft.KeyVault/vaults/secrets/getSecret/action'—for a managed identity to read a secret from Azure Key Vault. This role is specifically designed for read-only access to secrets, aligning with the principle of least privilege for the app's need to retrieve a secret for third-party service authentication.

Answer

Key Vault Reader

Answer

Key Vault Secrets Officer

Answer

Key Vault Contributor

Question 11

You are deploying a web app to Azure App Service that must use a custom domain with TLS/SSL. You have purchased an SSL certificate from a third-party CA. How should you upload and bind the certificate to the custom domain?

Accepted Answer

Upload the .pfx file to the App Service TLS/SSL settings and bind it to the custom domain.. Azure App Service requires a .pfx file containing both the public certificate and the private key to bind a custom domain with TLS/SSL. The .pfx file is uploaded directly in the App Service's TLS/SSL settings, and then the certificate is bound to the custom domain, enabling HTTPS traffic.

Answer

Place the certificate files in the wwwroot folder of the app and configure the web.config.

Answer

Import the certificate into Azure Key Vault and reference it from App Service.

Answer

Upload the .cer file to the App Service and let Azure generate the private key.

Question 12

You need to securely transfer an on-premises database backup to Azure Blob Storage. The backup file is 500 GB. You have limited bandwidth (10 Mbps) and need the transfer to complete within 24 hours. What is the best solution?

Accepted Answer

Use Azure Data Box to physically ship the data to Azure.. Given the 500 GB backup file and a 10 Mbps bandwidth limit, the theoretical maximum transfer time over the internet is approximately 500 GB * 8 bits/byte / (10 Mbps) = 400,000 seconds ≈ 111 hours, far exceeding the 24-hour requirement. Azure Data Box is the best solution because it allows you to physically ship the data on a secure, ruggedized device, bypassing network constraints entirely and ensuring the transfer completes within the required timeframe.

Answer

Use Azure File Sync to replicate the backup to Azure Files.

Answer

Use AzCopy to copy the backup file directly to Blob Storage.

Answer

Set up an ExpressRoute connection and use AzCopy.

Question 13

A company uses Azure Cosmos DB for a global e-commerce platform. They need to query product inventory across multiple regions with low latency. The data is partitioned by product category. Some queries filter on category and price range. What indexing policy should be configured to optimize these queries?

Accepted Answer

Create a composite index with (category, price).. A composite index on (category, price) allows Cosmos DB to efficiently satisfy queries that filter on both fields in a single index seek, avoiding a full scan. Composite indexes are designed for multi-property filters and sort orders, which directly matches the requirement to query by category and price range with low latency.

Answer

Use a wildcard index for all properties.

Answer

Add a hash index on category and a range index on price.

Answer

Enable spatial index on price.

Question 14

A company uses Azure Service Bus for messaging between microservices. They need to ensure that messages are processed in order within a partition. Which feature should they enable?

Accepted Answer

Sessions. Sessions in Azure Service Bus provide strict message ordering and first-in-first-out (FIFO) guarantees within a session. By setting the SessionId property on messages, all messages with the same session ID are processed sequentially by a single receiver, ensuring order is preserved even across multiple partitions or competing consumers.

Answer

Duplicate detection

Answer

Partitioning

Answer

Dead-letter queue

Question 15

You are developing an application that needs to retrieve secrets from Azure Key Vault. The application will run as an Azure Functions app. Which authentication method should you use to access Key Vault?

Accepted Answer

Use a system-assigned managed identity. A system-assigned managed identity is the recommended authentication method for Azure Functions to access Key Vault because it eliminates the need to store credentials in code or configuration. When enabled, Azure automatically creates a service principal in Azure AD for the function app, and the function can authenticate to Key Vault using this identity via the Azure Identity SDK (e.g., DefaultAzureCredential). This approach is secure, fully managed, and aligns with the principle of least privilege.

Answer

Use a client certificate stored in the function app

Answer

Use the Key Vault connection string from app settings

Answer

Use the storage account access key from the function app