AZ-204 Practice Test 45 — 15 Questions

Question 1

A developer needs to grant an Azure Function read access to secrets in Azure Key Vault without storing any credentials in the function code or configuration. Which approach should they use?

Accepted Answer

Managed identity. Managed identity (B) is the correct approach because it allows the Azure Function to authenticate to Azure Key Vault without storing any credentials in code or configuration. Azure automatically manages the identity, and the function can obtain an access token from Microsoft Entra ID to read secrets, eliminating the need for secrets, certificates, or keys in the application.

Answer

Service principal with a certificate

Answer

Access policy with a client secret

Answer

Shared access signature (SAS)

Question 2

You are developing an ASP.NET Core web API that uses Microsoft Entra ID for authentication via Microsoft.Identity.Web. The application needs to authorize actions based on custom roles such as "Editor" and "Reviewer". These roles are not defined in Microsoft Entra ID app roles or directory roles; instead, they are stored in an application database and can be assigned dynamically by administrators. You need to implement authorization with minimal impact on performance and without modifying the application's authentication flow. Which approach should you use?

Accepted Answer

Use a custom middleware to modify the User principal after authentication, adding role claims from the database. It allows you to add role claims from the application database to the User principal after authentication via custom middleware, without altering the authentication flow. This approach leverages the existing Microsoft.Identity.Web authentication pipeline and caches the role claims in the principal, minimizing performance impact by avoiding repeated database lookups on every request.

Answer

Add custom claims to the token via Microsoft Entra ID custom claims policies

Answer

Implement a custom authorization filter that reads the user's roles from the database on each request and caches them

Answer

Use Microsoft Entra ID app roles and assign them to users or groups

Question 3

You are developing a solution that uploads large files to Azure Blob Storage. Users report that uploads fail after 4 minutes. You need to ensure uploads can complete successfully. What should you do?

Accepted Answer

Increase the client-side timeout value in the upload request.. The default client-side timeout for Azure Blob Storage uploads is 4 minutes. When uploading large files, the operation may exceed this timeout, causing the upload to fail. Increasing the client-side timeout value in the upload request extends the allowed duration, ensuring the upload completes successfully.

Answer

Enable soft delete and versioning on the blob container.

Answer

Use premium block blob storage accounts.

Answer

Increase the storage account scale limit.

Question 4

You are designing a backup solution for a virtual machine. Monthly backups are large VHD files (up to 1 TB) that must be retained for 7 years. After creation, backups are accessed only rarely (once or twice per year). You need to minimize storage cost. Which storage tier should you use for the VHD files?

Accepted Answer

Archive tier. The Archive tier is the correct choice because it offers the lowest storage cost for data that is rarely accessed (once or twice per year) and has a long retention period (7 years). Azure Archive storage is optimized for data that can tolerate a retrieval latency of several hours, which is acceptable given the infrequent access pattern of these monthly backup VHD files.

Answer

Hot tier

Answer

Cool tier

Answer

Premium tier

Question 5

You have an Azure Logic App that processes orders. Occasionally, the Logic App fails due to a transient error from a downstream API. You want to automatically retry the failed action after 10 seconds, up to 3 times, with exponential backoff. Which configuration should you set on the action?

Accepted Answer

Set retry policy to default with interval of 10 seconds and count of 3. The default retry policy in Azure Logic Apps uses exponential backoff, which automatically increases the delay between retries. Setting the interval to 10 seconds and count to 3 configures the initial delay and maximum retry attempts, while the exponential backoff behavior is inherent to the default policy. This matches the requirement to retry after 10 seconds initially, up to 3 times, with exponential backoff.

Answer

Set retry policy to fixed interval with 10-second delay and 3 retries

Answer

Set retry policy to none and implement custom retry logic

Answer

Set retry policy to custom with exponential interval and 3 retries

Question 6

You are building an IoT solution that generates millions of small log entries (each less than 1 KB) per day. The logs are rarely read, and when they are read, they are always accessed in chronological order. You need to minimize storage costs and maximize write throughput. Which Azure Blob Storage type should you use?

Accepted Answer

Append Blob. Append Blob is optimized for append operations, making it ideal for scenarios like logging where data is continuously added and rarely modified. It supports high-throughput writes because each append operation is atomic and does not require reading or updating existing blocks, which minimizes overhead. Since the logs are accessed in chronological order, Append Blob's sequential block structure allows efficient streaming reads without random access overhead.

Answer

Block Blob

Answer

Page Blob

Answer

Archive Blob

Question 7

You are a developer at a financial services company. You need to design a solution for processing real-time stock trade data. The system receives thousands of trades per second from an on-premises system. Each trade must be validated, enriched with reference data, and then stored in a data lake for analytics. You have the following requirements:
- The processing must be serverless and scale automatically with high throughput.
- The enrichment step requires calling an external REST API that can handle up to 100 requests per second. If the API is overwhelmed, trades must be retried with exponential backoff.
- The solution must minimize cost and operational overhead.
- Trades must be processed in order per stock symbol.
You provision an Azure Event Hubs namespace with a single event hub. Trades are sent to the event hub with the stock symbol as the partition key. You configure an Azure Functions app with an Event Hubs trigger to process events. The function validates, enriches by calling the external API, and writes the enriched trade to Azure Data Lake Storage. During testing, you notice that some trades are processed out of order for the same stock symbol when the external API throttles requests. What should you do to ensure ordering per stock symbol?

Accepted Answer

Set the 'maxEventBatchSize' to 1 in the host.json file to process one event at a time per instance.. Setting 'maxEventBatchSize' to 1 ensures that each function instance processes only one event at a time. When the external API throttles and triggers retries with exponential backoff, processing of subsequent events for the same partition (stock symbol) is blocked until the current event completes. This preserves the per-partition ordering guarantee that Event Hubs provides, as events within a partition are processed sequentially by a single consumer.

Answer

Use Durable Functions to orchestrate the processing and enforce ordering.

Answer

Increase the 'maxEventBatchSize' setting to 100 in the host.json file to improve throughput.

Answer

Use a different partition key such as a unique trade ID to distribute load evenly.

Question 8

A company stores customer images in Azure Blob Storage. They need to reduce costs by automatically moving blobs that have not been accessed for 30 days to Cool tier, and after 90 days to Archive tier. They also need to delete blobs after one year. Which two Azure features should they implement? (Choose two.)

Accepted Answer

Azure Blob Storage lifecycle management policy. Azure Blob Storage lifecycle management policy allows you to define rules to automatically transition blobs to Cool and Archive tiers based on last access time and delete them after one year. Additionally, versioning with a retention policy automatically removes old blob versions after a specified period, preventing unnecessary storage costs from accumulating. Together, these features optimize storage costs by managing both current blobs and their versions.

Answer

Azure Blob Storage object replication

Answer

Azure Blob Storage soft delete

Answer

Azure Blob Storage immutability policy

Question 9

Your company uses Azure Blob Storage to store sensitive documents. You need to ensure that all access to the storage account is encrypted in transit and that clients must use TLS 1.2 or higher. Which configuration should you enforce?

Accepted Answer

Set the 'Minimum TLS version' to 1.2 in the storage account's configuration.. Setting the 'Minimum TLS version' to 1.2 in the storage account's configuration explicitly enforces that all client connections must use TLS 1.2 or higher, rejecting any requests using older, less secure TLS versions. This directly addresses the requirement to ensure encryption in transit with a specific minimum TLS version, as Azure Blob Storage supports TLS 1.0, 1.1, and 1.2 by default, and this setting overrides that default to enforce the higher standard.

Answer

Use a private endpoint for the storage account.

Answer

Configure network rules to allow only from trusted IPs.

Answer

Enable 'Secure transfer required' (HTTPS only).

Question 10

You have an Azure Function app that uses an Event Hubs trigger. The function processes events in batches. You notice that some events are being processed more than once. Which setting should you adjust to minimize duplicate processing?

Accepted Answer

Enable checkpointing in the function code. Checkpointing in Azure Event Hubs stores the offset of the last successfully processed event in a durable store (e.g., Azure Blob Storage). When the function restarts or scales, it resumes from that checkpoint, preventing reprocessing of already-handled events. Without checkpointing, the default behavior may start from the earliest offset or use the `latest` position, leading to duplicate processing.

Answer

Increase the maxRetries per event

Answer

Increase the event batch size

Answer

Decrease the prefetch count

Question 11

You are using Azure Blob Storage to store large media files. Clients upload files directly to the storage account using SAS tokens. You need to ensure that the SAS token expires 1 hour after creation. Which parameter should you set when generating the SAS token?

Accepted Answer

SignedExpiry (se). The SignedExpiry (se) parameter explicitly defines the expiration time of a SAS token. When generating a SAS token for Azure Blob Storage, setting 'se' to a UTC time 1 hour from creation ensures the token is valid only for that duration, meeting the requirement that clients can upload files directly using the SAS token for exactly 1 hour.

Answer

SignedProtocol (spr)

Answer

IP range (sip)

Answer

SignedStart (st)

Question 12

Which TWO Azure services can be used to trigger an Azure Function in response to a new blob being added to an Azure Storage account? (Choose two.)

Accepted Answer

Azure Blob Storage trigger. The Azure Blob Storage trigger is specifically designed to execute a function whenever a new or updated blob is detected in a storage container. It uses a polling mechanism to monitor the container and invokes the function with the blob's content and metadata as input. Option E is correct because an Azure Event Grid subscription can be configured to listen for the 'Microsoft.Storage.BlobCreated' event and route it to an Azure Function as an event-driven trigger, providing near-real-time, push-based notification without polling.

Answer

HTTP trigger

Answer

Queue trigger

Answer

Timer trigger

Question 13

A company deploys an Azure Function app that processes orders. The function needs to scale out automatically when the queue length grows and be billed only for execution time. Which hosting plan should you use?

Accepted Answer

Consumption Plan. The Consumption Plan is correct because it automatically scales out the function app based on the length of the Azure Storage queue trigger, and you are billed only for the execution time (per-second billing) and resources consumed. This plan is ideal for event-driven workloads like order processing, where scaling is demand-driven and idle time incurs no cost.

Answer

App Service Plan

Answer

Premium Plan

Answer

Dedicated Plan

Question 14

An app must store relational state and perform transactions across multiple tables with T-SQL support. Which Azure data service should the developer choose?

Accepted Answer

Azure SQL Database. Azure SQL Database is a fully managed relational database service that supports T-SQL and ACID transactions across multiple tables, making it the correct choice for storing relational state and performing transactional operations. It provides built-in high availability, automatic backups, and elastic scaling, which are essential for enterprise applications requiring consistent, multi-table transactions.

Answer

Azure Queue Storage

Answer

Azure Cache for Redis

Answer

Azure Blob Storage

Question 15

Your company uses Azure App Service to host a web application that requires periodic database maintenance. The maintenance tasks are time-consuming and must run outside of peak hours. You need to schedule these tasks to run automatically at 2:00 AM every Sunday. The tasks should be implemented as an Azure Function that runs in the same App Service plan to reduce costs. What should you do?

Accepted Answer

Create a separate Azure Function App in the same App Service plan and configure a timer trigger.. Creating a separate Azure Function App and hosting it on the *same existing dedicated App Service Plan* (e.g., Basic, Standard, Premium) allows the Azure Function to run using the existing compute resources. This directly meets the requirement to run in the 'same App Service plan to reduce costs' by leveraging existing infrastructure. A timer trigger is the appropriate mechanism to schedule the function to run automatically at 2:00 AM every Sunday. This option also fulfills the requirement that the tasks 'should be implemented as an Azure Function'.

Option A is incorrect because deploying to a Consumption plan would create a *separate* Function App resource with a serverless billing model, which does not align with the 'in the same App Service plan' requirement for cost reduction in the context of an existing dedicated App Service plan.

Option C is incorrect because, while WebJobs are suitable for background tasks and can share an App Service plan, they are not Azure Functions. The STEM explicitly requires the tasks to be implemented as an Azure Function.

Option D is incorrect because Azure Logic Apps are a separate service, incurring separate costs, and do not fulfill the requirement to implement the task 'as an Azure Function' and run it 'in the same App Service plan' for cost reduction.

Answer

Deploy the maintenance code as an Azure Function in the Consumption plan and configure a timer trigger.

Answer

Add a WebJob to the App Service that uses a scheduled trigger to run the maintenance code.

Answer

Use Azure Logic Apps with a recurrence trigger to call the web application's maintenance endpoint.