AZ-204 Practice Test 45 — 15 Questions

Question 1

Refer to the exhibit. You run this Azure CLI command to configure an Azure Web App for Containers. The web app fails to start, and the logs show 'unauthorized: authentication required'. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The command did not include admin credentials or managed identity configuration. The Azure CLI command `az webapp config container set` without specifying `--docker-registry-server-user` and `--docker-registry-server-password` (or a managed identity configuration) means the web app cannot authenticate with a private container registry. The 'unauthorized: authentication required' error indicates the registry requires credentials, and the web app has none configured, so it fails to pull the image.

Answer

The image tag 'latest' does not exist

Answer

The web app is configured to use a deployment slot, but the slot is not specified

Answer

The --docker-registry-server-url is incorrect

Question 2

Match each Azure container service to its primary use case.

Accepted Answer

AKS: Orchestrates containerized applications at scale using Kubernetes.. The correct matches are: AKS → orchestration with Kubernetes; ACI → on-demand containers; ACR → image registry; Container Apps → serverless containers with autoscaling. Common confusions include swapping AKS with ACI or mixing orchestration with simple container execution.

Answer

AKS: Runs isolated containers on demand without managing underlying infrastructure.

Answer

ACI: Orchestrates containerized applications at scale using Kubernetes.

Question 3

You have an Azure App Service web app with a system-assigned managed identity. You need to grant it permission to read secrets from an Azure Key Vault. Which RBAC role should you assign to the managed identity at the Key Vault scope?

Accepted Answer

Key Vault Secrets User. The system-assigned managed identity needs to read secrets from Key Vault. The 'Key Vault Secrets User' role grants exactly that permission — it allows the identity to perform secret read operations (Get, List) on the secrets in the vault. This is the correct RBAC role for read-only access to secrets, as opposed to keys or certificates.

Answer

Key Vault Reader

Answer

Key Vault Crypto User

Answer

Contributor

Question 4

You have an Azure App Service web app that uses a custom domain with TLS/SSL binding. You need to migrate the app to a new App Service plan in a different region. What is the correct order of steps?

Accepted Answer

Export the current plan, create the new plan, deploy the app, bind the domain and certificate. The proper sequence for migrating an Azure App Service web app with a custom domain and TLS/SSL binding to a new plan in a different region is: first, capture the existing web app's configuration (e.g., by exporting its ARM template, which includes custom domain and certificate binding details), then create the new App Service plan in the target region, deploy the app (which involves creating the new web app resource and deploying its code, potentially using the captured configuration), and finally bind the custom domain and certificate to the new web app. This ensures the custom domain and TLS/SSL binding are correctly associated with the new web app after it's deployed, avoiding downtime or misconfiguration.

Answer

Create the new plan, deploy the app, export the current plan, bind the domain

Answer

Export the current plan, create the new plan, bind the domain, deploy the app

Answer

Bind the domain to the new plan, export the current plan, create the new plan, deploy the app

Question 5

Your application uses Azure App Configuration with Microsoft Entra ID authentication. You want to ensure that only authorized services can read configuration values. What is the recommended approach?

Accepted Answer

Assign the App Configuration Data Reader role to the managed identity of the consuming service. The recommended approach for authorizing access to Azure App Configuration with Microsoft Entra ID is to use role-based access control (RBAC). By assigning the 'App Configuration Data Reader' role to a managed identity, you grant that specific service identity read-only access to configuration values without exposing keys or connection strings. This aligns with the principle of least privilege and eliminates the security risks associated with shared access keys.

Answer

Enable public network access only from trusted IPs

Answer

Use access keys and rotate them frequently

Answer

Store connection strings in Azure Key Vault and retrieve them at runtime

Question 6

Which TWO actions should you take to ensure high availability for a stateful ASP.NET application deployed on Azure App Service?

Accepted Answer

Enable ARR Affinity (client affinity) to maintain session state.. Enabling ARR Affinity (client affinity) ensures that all requests from a given client session are routed to the same instance, preserving in-memory session state. Without this, a stateful ASP.NET application would lose session data if subsequent requests are load-balanced to different instances, causing session state errors.

Answer

Scale up the App Service plan to a higher tier.

Answer

Store session state in Azure Files share.

Answer

Disable session state to allow any instance to handle requests.

Question 7

You are developing a solution that needs to run a background task every 10 minutes to clean up temporary files in Azure Blob Storage. You want to use Azure Functions with the Consumption Plan to minimize cost. Which trigger type should you use?

Accepted Answer

TimerTrigger. B is correct because TimerTrigger is designed for scheduled execution of background tasks at fixed intervals, such as every 10 minutes. It uses a cron expression to define the schedule and runs on the Consumption Plan, which scales to zero when idle, minimizing cost. This makes it the ideal choice for periodic cleanup of temporary files in Azure Blob Storage.

Answer

HTTPTrigger

Answer

BlobTrigger

Answer

ServiceBusTrigger

Question 8

You are building a serverless application that needs to store user profile data. The data includes simple fields like name, email, and preferences. The data is frequently accessed by user ID. You need a schema-less, low-latency storage solution that is cost-effective for millions of small records. Which Azure Storage solution should you use?

Accepted Answer

Azure Table Storage. Azure Table Storage is a NoSQL key-value store that is schema-less, making it ideal for storing user profile data with varying fields like name, email, and preferences. It offers low-latency access by user ID via the PartitionKey and RowKey, and it is cost-effective for millions of small records because you pay only for the storage consumed, with no minimum charge per record.

Answer

Azure Blob Storage

Answer

Azure Queue Storage

Answer

Azure File Storage

Question 9

You are developing a serverless application using Azure Functions that processes order messages from an Azure Service Bus queue. Each order message is approximately 64 KB in size. The function must process messages in order and exactly once. The current implementation uses a Service Bus trigger with batch processing enabled. You notice that occasionally duplicate messages are processed. You need to ensure exactly-once processing while maintaining message ordering. What should you do?

Accepted Answer

Enable sessions on the Service Bus queue and update the function trigger to use sessions.. Enabling sessions on the Service Bus queue and using a session-enabled trigger guarantees message ordering and exactly-once processing. Sessions group related messages into a logical sequence, and the Service Bus trigger locks the entire session, ensuring that messages within a session are processed in order and that no other consumer can process the same session concurrently. This prevents duplicate processing while maintaining the required ordering.

Answer

Disable batch processing in the function trigger and process messages one at a time.

Answer

Increase the lock duration on the Service Bus queue to 5 minutes.

Answer

Set the maxDeliveryCount property on the queue to 1.

Question 10

A company stores sensitive data in Azure Blob Storage. They require that all access to the storage account be authenticated via Microsoft Entra ID and that users must have the 'Storage Blob Data Reader' role assigned. A developer reports being unable to read blobs using the Azure portal despite having the role assigned. What is the most likely cause?

Accepted Answer

The user does not have the Azure RBAC Reader role on the storage account's resource group to view the storage account in the portal.. The Azure portal requires the 'Reader' role on the storage account's resource group (or subscription) to list and navigate to the storage account in the portal UI. Even if a user has 'Storage Blob Data Reader' at the storage account scope, without the Azure RBAC 'Reader' role on the resource group, the portal cannot enumerate the storage account resource, preventing access via the portal. The 'Storage Blob Data Reader' role only grants data-plane permissions (read blobs), not control-plane permissions needed to see the resource in the portal.

Answer

The storage account firewall is blocking the user's IP address.

Answer

The storage account is using a system-assigned managed identity for authentication.

Answer

The role is assigned at the storage account scope but the user is trying to access a different storage account.

Question 11

You have a blob as shown in the exhibit. You need to read the content of this blob. What must you do first?

Accepted Answer

Set the access tier of the blob to Hot or Cool using Set-AzStorageBlobTier.. The blob in the exhibit is an archived blob, which is offline and cannot be read directly. You must first rehydrate it by setting its access tier to Hot or Cool using Set-AzStorageBlobTier, which initiates an asynchronous copy from the archive tier to an online tier. Only after rehydration completes can you read the blob content.

Answer

Convert the blob to an AppendBlob type.

Answer

Use the Get-AzStorageBlobContent cmdlet to download the blob directly.

Answer

Use the storage account key to access the blob.

Question 12

You deploy a containerized application on Azure Container Instances (ACI). The application writes data that must persist across container restarts and be accessible from multiple instances. Which volume mount should you configure?

Accepted Answer

Azure Files share. Azure Files shares provide a fully managed SMB file share in the cloud that can be mounted as a volume in Azure Container Instances. This allows data written by the container to persist across restarts and be accessed concurrently by multiple container instances, meeting the requirements for durability and shared access.

Answer

emptyDir volume

Answer

Azure Disk

Answer

ConfigMap

Question 13

You are developing a containerized application that will be deployed to Azure Container Instances (ACI). The application consists of a web front-end and a background worker that processes messages from an Azure Storage Queue. You need to ensure that the worker container runs continuously and processes messages as they arrive. The solution must minimize cost and management overhead. What should you do?

Accepted Answer

Deploy the worker as a container group in ACI with the restart policy set to Always.. ACI with a restart policy of Always ensures the worker container restarts immediately after it finishes processing a message, allowing it to continuously poll the Azure Storage Queue for new messages. This minimizes cost by using a serverless container model without provisioning VMs or managing orchestration, and it reduces management overhead compared to alternatives like Azure virtual machines.

Answer

Use Azure Container Apps with a scale rule that triggers on queue length.

Answer

Run the worker inside an Azure virtual machine with a container runtime.

Answer

Deploy the worker as a container in ACI with the restart policy set to OnFailure.

Question 14

You are building a compliance solution that stores terabytes of data in Azure Blob Storage. Data is appended frequently and never modified. Regulatory requirements mandate that no data can be overwritten or deleted for 7 years. Which storage configuration should you enable?

Accepted Answer

Enable immutability policy (time-based retention). A is correct because a time-based retention policy under Azure Blob Storage immutability policy ensures that blobs cannot be overwritten or deleted for a specified duration (here, 7 years). This meets the regulatory requirement of write-once-read-many (WORM) compliance, and the policy is enforced at the storage container level, preventing any modifications or deletions even by the storage account owner.

Answer

Enable blob soft delete

Answer

Enable blob versioning

Answer

Enable change feed

Question 15

You are using Azure Event Grid to respond to blob storage events (blob created). You need to ensure that only JPEG image files trigger a function for processing, while other files are ignored. The number of files is high, and you want to minimize cost and latency. How should you filter events?

Accepted Answer

Configure Advanced Filters on the Event Grid subscription with a 'subjectEndsWith' condition set to '.jpg' or '.jpeg'.. Azure Event Grid supports advanced filtering on event properties, including 'subjectEndsWith', which allows you to filter events at the service level before they are delivered to the endpoint. This ensures that only blob creation events for files ending with '.jpg' or '.jpeg' trigger the function, reducing unnecessary invocations, cost, and latency. By filtering at the Event Grid level, you avoid processing unwanted events entirely, which is more efficient than filtering within the function code.

Answer

Create the function to check the blob extension at the start of the function code and return early if it's not a JPEG.

Answer

Create separate event subscriptions for each file extension and point them to different functions.

Answer

Use Event Hubs capture to filter files before sending events.