AZ-204 Practice Test 43 — 15 Questions

Question 1

Match each Azure DevOps component to its function.

Accepted Answer

Azure Boards: Manage work items, user stories, and bugs.. Correct matches: Azure Boards tracks work items, Azure Repos hosts source code, Azure Pipelines automates builds and deployments. Common confusions include mixing up Boards with Repos, or Repos with Pipelines.

Answer

Azure Boards: Store and version source code.

Answer

Azure Repos: Build, test, and deploy to any platform.

Question 2

You need to deploy a containerized application to Azure Container Instances (ACI) with a public IP address and a DNS name label. Which YAML property should you configure for the DNS name?

Accepted Answer

dnsNameLabel. The `dnsNameLabel` property in the Azure Container Instances YAML definition is used to assign a custom DNS prefix to the container group's public IP address. When combined with the Azure region's default domain suffix (e.g., `eastus.azurecontainer.io`), this creates a fully qualified domain name (FQDN) like `<dnsNameLabel>.eastus.azurecontainer.io`, allowing clients to resolve the container group via DNS without needing the raw IP address.

Answer

containerGroupName

Answer

ipAddress

Answer

ports

Question 3

You are deploying a function app that processes sensitive data. You need to ensure that all function app secrets (e.g., connection strings) are stored securely and automatically rotated. Which service should you use?

Accepted Answer

Azure Key Vault. Azure Key Vault is the correct service because it provides centralized, hardware-backed storage for secrets such as connection strings, API keys, and certificates. It supports automatic rotation policies via integration with Azure Event Grid and can be triggered by expiration events or custom logic, ensuring secrets are rotated without manual intervention. Function apps can securely reference Key Vault secrets using a managed identity, eliminating the need to store secrets in code or configuration files.

Answer

Azure Managed Identity

Answer

Azure App Configuration

Answer

Azure DevOps Variable Groups

Question 4

Which TWO methods can you use to authenticate an Azure App Service web app to Azure SQL Database without storing credentials in code? (Choose two.)

Accepted Answer

Store the SQL connection string in Azure Key Vault and use a Key Vault reference in the app settings.. Azure App Service supports Key Vault references in application settings, allowing you to reference secrets stored in Azure Key Vault without hardcoding credentials. This pattern uses the Managed Service Identity (MSI) of the App Service to authenticate to Key Vault at runtime, retrieving the SQL connection string securely. Option B is correct because enabling a system-assigned managed identity on the App Service and granting it access to the Azure SQL Database via an Azure AD user or contained database user eliminates the need for any stored credentials, as the app authenticates directly to SQL using the managed identity token.

Answer

Use a connection string with a SQL username and password.

Answer

Use a service principal with a client secret stored in app settings.

Answer

Use a client certificate installed on the App Service.

Question 5

Your company uses Microsoft Defender for Cloud. You need to receive alerts when a user modifies a Key Vault access policy. What should you configure?

Accepted Answer

Set up an activity log alert on the Key Vault. Activity log alerts in Azure Monitor can be configured to trigger on specific administrative operations, such as 'Microsoft.KeyVault/vaults/accessPolicies/write'. This allows you to receive near real-time notifications when a Key Vault access policy is modified, directly addressing the requirement without additional services or complex setups.

Answer

Create an Azure Policy to audit access policy changes

Answer

Configure Microsoft Sentinel to monitor Key Vault

Answer

Enable Key Vault logging and query logs

Question 6

A function consumes messages from Azure Service Bus. Which two settings help handle transient failures safely? The design must avoid adding custom operational scripts.

Accepted Answer

Configure max delivery count with a dead-letter queue. Configuring a max delivery count with a dead-letter queue allows the system to automatically move a message to the dead-letter queue after a specified number of failed delivery attempts. This prevents poison messages from being retried indefinitely, handling transient failures safely without custom scripts. Option B is correct because idempotent message processing ensures that if a message is processed more than once due to transient failures or retries, the system state remains consistent, avoiding duplicate side effects.

Answer

Disable lock renewal for long processing

Answer

Use anonymous sender access

Question 7

You are designing a solution that requires asynchronous processing of messages from an Azure Service Bus queue. The solution must guarantee at-least-once delivery and handle poison messages automatically. Which combination of Service Bus features should you use?

Accepted Answer

PeekLock mode with dead-letter queue. PeekLock mode is required for at-least-once delivery because it allows the consumer to process the message and then explicitly complete it, ensuring the message is not removed from the queue until processing succeeds. The dead-letter queue automatically handles poison messages by moving messages that exceed the maximum delivery count or fail processing, preventing them from blocking the queue.

Answer

ReceiveAndDelete mode with a separate dead-letter queue

Answer

ReceiveAndDelete mode with automatic forwarding

Answer

PeekLock mode with sessions

Question 8

You are developing a solution that uses Azure Table Storage to store time-series data. You need to query data for a specific device within a time range efficiently. Which two properties should you use as the PartitionKey and RowKey?

Accepted Answer

PartitionKey = deviceId, RowKey = timestamp. Using deviceId as the PartitionKey ensures all data for a specific device is stored in the same partition, enabling efficient point queries. Using timestamp as the RowKey allows range queries within a time range for that device, as RowKey is sorted lexicographically within a partition. Option A is incorrect because using timestamp as PartitionKey scatters data across partitions, requiring cross-partition queries. Option B is incorrect for the same reason, and also the RowKey is not optimized for range queries. Option D is incorrect because using reverse timestamp as RowKey does not improve range query efficiency over timestamp directly.

Answer

PartitionKey = timestamp, RowKey = reverse deviceId

Answer

PartitionKey = timestamp, RowKey = deviceId

Answer

PartitionKey = deviceId, RowKey = reverse timestamp

Question 9

Which THREE Azure services can be used to send email notifications from an application?

Accepted Answer

Azure Logic Apps. Azure Logic Apps is correct because it provides built-in connectors (e.g., Office 365 Outlook, SMTP, SendGrid) that allow you to design workflows to send email notifications without writing custom code. You can trigger these workflows from various sources (HTTP requests, timers, Azure services) and include conditional logic, making it a serverless, low-code solution for email notifications.

Answer

Azure Event Grid

Answer

Azure Service Bus

Question 10

You are building an application that subscribes to an Azure Event Grid topic using a custom webhook endpoint. The endpoint is a web API hosted on Azure App Service. You need to ensure that only Event Grid can invoke your webhook endpoint, preventing unauthorized requests. What should you implement in your webhook endpoint?

Accepted Answer

Validate the Aeg-SasKey header against a shared secret known to Event Grid. Event Grid sends an Aeg-SasKey header with each request to a custom webhook endpoint. By validating this header against a pre-configured shared secret (the same key used when creating the event subscription), the endpoint can confirm that the request originated from Event Grid. This prevents unauthorized actors from invoking the webhook, as they would not possess the shared secret.

Answer

IP address filtering to allow only the Azure Event Grid service tag

Answer

Require a client certificate that you upload to Event Grid

Answer

Use an OAuth 2.0 token from Microsoft Entra ID

Question 11

Configuration values that control whether a new checkout experience is enabled must be changeable without redeploying the App Service application. The team uses ASP.NET Core. Which Azure service provides the correct combination of runtime configuration reload and feature flag management?

Accepted Answer

Azure App Configuration with the feature management library enabled for ASP.NET Core. Azure App Configuration with the feature management library for ASP.NET Core provides a centralized, managed service that supports dynamic configuration reload without restarting the application and built-in feature flag management. The feature management library integrates with the .NET Core configuration system, allowing feature flags to be evaluated and toggled at runtime via the `IFeatureManager` interface, with automatic refresh based on a configurable cache expiration. This meets the requirement of changing the checkout experience without redeploying the App Service.

Answer

App Service Application Settings with the flag stored as an environment variable

Answer

An ARM template parameter file stored in the application's repository

Answer

An Azure DevOps pipeline variable referenced during the build stage

Question 12

You are deploying a containerized application to Azure Container Instances. The application requires a custom domain name and SSL/TLS termination. You need to configure these features. Which resource should you create alongside the container group?

Accepted Answer

Azure Application Gateway. Azure Application Gateway provides Layer 7 load balancing with SSL/TLS termination and custom domain support. By associating a custom domain with the Application Gateway's frontend IP and uploading an SSL certificate, you can terminate HTTPS connections at the gateway and forward traffic to the container group over HTTP. This meets the requirement without exposing the container group directly.

Answer

Azure Front Door

Answer

Azure Container Registry

Answer

Azure DNS zone

Question 13

An application stores customer invoices in Azure Blob Storage. Deleted blobs must be recoverable for 14 days. What should be enabled? The design must avoid adding custom operational scripts.

Accepted Answer

Blob soft delete with a 14-day retention period. Blob soft delete protects against accidental deletion by retaining deleted blobs for a specified retention period. Enabling it with a 14-day retention period allows recovery of deleted invoices within that window without custom scripts, meeting the requirement exactly.

Answer

Archive access tier

Answer

Static website hosting

Answer

Immutable blob legal hold

Question 14

A web app running on Azure App Service must integrate with Microsoft Graph API to read user profiles. The app is registered in Microsoft Entra ID and uses the OAuth 2.0 authorization code flow. However, after deployment, the app fails to acquire tokens. What is the most likely cause?

Accepted Answer

The redirect URI is not configured in the app registration. The OAuth 2.0 authorization code flow requires a redirect URI to be registered in the app registration in Microsoft Entra ID. This URI is where the authorization server sends the authorization code after user consent. If the redirect URI is missing or mismatched, the token acquisition fails because the authorization server cannot validate the callback endpoint, causing the authentication request to be rejected.

Answer

The API permission for User.Read is not granted

Answer

The app is using the client credentials flow instead of authorization code flow

Answer

The client secret is expired

Question 15

Which TWO Azure services can be used to monitor and diagnose performance issues in an Azure Kubernetes Service (AKS) cluster?

Accepted Answer

Application Insights for AKS. Application Insights for AKS (option C) is correct because it provides application-level monitoring, including distributed tracing, dependency tracking, and performance diagnostics for microservices running in AKS. It integrates with the AKS cluster to collect telemetry from pods and containers, enabling detection of slow requests, exceptions, and dependency failures that impact application performance.

Answer

Microsoft Defender for Cloud

Answer

Azure Network Watcher

Answer

Azure SQL Analytics