AZ-204 Practice Test 46 — 15 Questions

Question 1

You develop an Azure Function app that processes orders. The function must write order status updates to a database. You need to ensure that if the function fails after writing to the database, the order is not lost and can be retried. Which pattern should you implement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use a Durable Functions orchestration. Durable Functions orchestrations provide built-in support for reliable execution and automatic retry on failure. By using an orchestration, you can write the order status to the database as an activity function, and if the function fails after the write, the orchestration can replay from the last checkpoint, ensuring the order is not lost and can be retried without duplicating the write.

Answer

Use a retry policy in the function code

Answer

Enable function-level exception handling

Answer

Use an Azure Storage Queue for the function input

Question 2

Your Azure App Service app must access Azure Key Vault secrets without storing credentials in code. Which service should you use to manage identities?

Accepted Answer

Managed identity. Managed identity (B) is correct because it provides an automatically managed Azure AD identity for your App Service app, allowing it to authenticate to Azure Key Vault without storing any credentials in code or configuration. The identity is tied to the app's lifecycle and can be used with Azure RBAC to grant access to secrets, eliminating the need for manual credential management.

Answer

Service principal with client secret

Answer

Storage account access key

Answer

Client certificate

Question 3

Your application uses Azure App Service and needs to authenticate users via Microsoft Entra ID. Which THREE components must be configured in the App Service authentication settings?

Accepted Answer

Client ID. The Client ID uniquely identifies your application registration in Microsoft Entra ID. App Service uses this ID to initiate the OAuth 2.0 authorization code flow, ensuring that tokens are issued specifically to your app. Without it, the authentication middleware cannot associate incoming tokens with your registered application.

Answer

Client secret

Answer

Tenant ID

Question 4

You are designing a serverless application using Azure Functions that needs to read from an Azure Storage Blob, process the data, and write to Azure Cosmos DB. Which THREE bindings are required?

Accepted Answer

HTTP trigger. The HTTP trigger is correct because the question describes a serverless application that needs to be invoked to read from Blob Storage, process data, and write to Cosmos DB. An HTTP trigger allows the function to be started via an HTTP request, which is the typical entry point for such event-driven processing. Without a trigger, the function cannot execute; the HTTP trigger provides the necessary invocation mechanism.

Answer

Cosmos DB input binding

Answer

Timer trigger

Question 5

Your Azure web app is running in a production environment. Users report that the app is slow. You need to identify the root cause without impacting production traffic. Which approach should you use?

Accepted Answer

Enable Application Insights Profiler. Application Insights Profiler provides detailed, per-request performance traces that pinpoint which code paths are consuming the most time, enabling root cause analysis of slow responses without altering production traffic. Unlike sampling or logs, Profiler captures execution data on-demand or automatically with minimal overhead, making it ideal for diagnosing latency issues in a live environment.

Answer

Enable Application Insights sampling at 100%

Answer

Run a load test in a staging slot

Answer

Review server logs in the web app

Question 6

Application Insights ingestion cost is rising because a high-traffic app emits large telemetry volume. The team needs statistically useful telemetry while reducing ingestion. What should be configured?

Accepted Answer

Adaptive sampling. Adaptive sampling is the correct solution because it automatically adjusts the volume of telemetry data sent to Application Insights, retaining only a representative subset that preserves statistical accuracy for analysis. This reduces ingestion costs while ensuring the sampled data remains statistically useful for detecting trends and anomalies in high-traffic applications.

Answer

Move the app to a larger App Service plan

Answer

Disable all exception telemetry

Answer

Increase log verbosity to debug

Question 7

An application writes millions of small log entries (500 bytes each) daily. The logs are rarely read, and when read, they are accessed sequentially. You need to minimize storage costs and maximize write throughput. Which Azure Blob Storage type should you use?

Accepted Answer

Append Blob. Append Blob is optimized for append operations, making it ideal for logging scenarios where new data is continuously added to the end of the blob. It provides high write throughput for small, sequential writes (like 500-byte log entries) and lower storage costs compared to Block Blob for this pattern, as it avoids the overhead of managing multiple blocks per append. Additionally, Append Blob supports sequential read access efficiently, matching the rare, sequential read requirement.

Answer

Block Blob

Answer

Page Blob

Answer

Archive Blob

Question 8

A background data pipeline runs on a schedule and must read user profile data from Microsoft Graph. No user is present during execution. The service authenticates to Microsoft Entra ID and calls the Graph API. Which permission type and OAuth 2.0 flow are correct for this scenario?

Accepted Answer

Application permissions with the client credentials flow, authenticating with the app's client ID and secret (or certificate). This scenario requires a background service to access Microsoft Graph without any user interaction. Application permissions are designed for such non-interactive, service-to-service calls, and the client credentials OAuth 2.0 flow (defined in RFC 6749 section 4.4) allows the app to authenticate using its own identity (client ID and secret or certificate) to obtain an access token. Delegated permissions would be incorrect because they require a signed-in user context, which is absent here.

Answer

Delegated permissions with the authorization code flow, initiating a browser redirect to collect user consent

Answer

Delegated permissions with the device code flow, prompting a user to authenticate on a separate device

Answer

Application permissions with the on-behalf-of flow, passing the calling user's token to the Graph API

Question 9

A Cosmos DB container for session records receives hot-partition throttling because the partition key has only five possible values. What should the developer change?

Accepted Answer

Choose a partition key with higher cardinality and even request distribution. A partition key with only five values leads to hot partitions, where one or a few partitions handle the majority of requests, causing throttling. By choosing a partition key with higher cardinality (many distinct values) and even request distribution, the load is spread evenly across physical partitions, eliminating hot spots and throttling.

Answer

Increase the default TTL

Answer

Enable analytical store only

Answer

Use a stored procedure for every write

Question 10

A developer needs to run a Kusto query against application request data to identify 95th percentile latency by operation. Where should the query be run? The design must avoid adding custom operational scripts.

Accepted Answer

Logs in Application Insights or the associated Log Analytics workspace. Application Insights and its associated Log Analytics workspace store application request data and support Kusto Query Language (KQL) queries. Running a Kusto query against the `requests` table in the Logs workspace allows you to calculate percentile latency (e.g., using the `percentiles()` function) without custom operational scripts, as this is a built-in capability.

Answer

Microsoft Entra audit logs

Answer

Azure Key Vault diagnostic settings

Answer

Azure Resource Graph only

Question 11

Refer to the exhibit. You executed the Azure CLI command to create a storage account. Later, you attempt to connect from an application that uses TLS 1.1. The connection fails. What is the most likely reason?

Accepted Answer

The minimum TLS version is set to 1.2, blocking TLS 1.1. The Azure CLI command used to create the storage account did not specify a minimum TLS version, so the default value of 1.2 applies. When the application attempts to connect using TLS 1.1, Azure Storage rejects the connection because the service enforces TLS 1.2 or higher. This is a security default in Azure Storage accounts created after a certain date, and it can be overridden by setting the `--min-tls-version` parameter to 1.0 during creation or by updating the account's properties.

Answer

The storage account uses Standard_GRS replication which is not accessible from all clients

Answer

The storage account is in a different location than the client

Answer

The storage account kind is StorageV2 which does not support blobs

Question 12

Refer to the exhibit. A developer deploys this ARM template to create a web app with a connection string to Azure Cosmos DB. The deployment succeeds but the web app cannot connect to Cosmos DB. What is the most likely cause?

Accepted Answer

The connection string should use a secret reference to Azure Key Vault. The ARM template exposes the Cosmos DB connection string with the master key in plaintext, which is insecure. The connection string should be stored as a secret in Azure Key Vault and referenced using a secret reference in the ARM template. Option B is incorrect because the listKeys function is used correctly to retrieve the keys. Option C is incorrect because the web app name parameter is present and used. Option D is incorrect because the API version is appropriate for the deployment.

Answer

The listKeys function is used incorrectly

Answer

The web app name parameter is missing

Answer

The listKeys function requires a different API version

Question 13

You are deploying a containerized application to Azure Container Instances. The application requires a custom domain name and SSL/TLS certificate. What should you do?

Accepted Answer

Place an Azure Application Gateway in front of the container group.. Azure Container Instances (ACI) does not natively support custom domain names or SSL/TLS termination. By placing an Azure Application Gateway in front of the container group, you can offload SSL/TLS termination at the gateway layer, map a custom domain via the gateway's frontend IP, and route traffic to the container group's private IP. This is the recommended pattern for adding HTTPS and custom domains to ACI workloads.

Answer

Configure the container to listen on port 443 and map a custom domain.

Answer

Upload the certificate to the container and configure the web server.

Answer

Use a private endpoint with a custom domain.

Question 14

A developer needs to grant an Azure Function read access to secrets in Azure Key Vault without storing any credentials in the function code or configuration. Which approach should they use?

Accepted Answer

Managed identity. Managed identity (B) is the correct approach because it allows the Azure Function to authenticate to Azure Key Vault without storing any credentials in code or configuration. Azure automatically manages the identity, and the function can obtain an access token from Azure AD to read secrets, eliminating the need for secrets, certificates, or keys in the application.

Answer

Service principal with a certificate

Answer

Access policy with a client secret

Answer

Shared access signature (SAS)

Question 15

You are developing an ASP.NET Core web API that uses Microsoft Entra ID for authentication via Microsoft.Identity.Web. The application needs to authorize actions based on custom roles such as "Editor" and "Reviewer". These roles are not defined in Microsoft Entra ID app roles or directory roles; instead, they are stored in an application database and can be assigned dynamically by administrators. You need to implement authorization with minimal impact on performance and without modifying the application's authentication flow. Which approach should you use?

Accepted Answer

Use a custom middleware to modify the User principal after authentication, adding role claims from the database. It allows you to add role claims from the application database to the User principal after authentication via custom middleware, without altering the authentication flow. This approach leverages the existing Microsoft.Identity.Web authentication pipeline and caches the role claims in the principal, minimizing performance impact by avoiding repeated database lookups on every request.

Answer

Add custom claims to the token via Microsoft Entra ID custom claims policies

Answer

Implement a custom authorization filter that reads the user's roles from the database on each request and caches them

Answer

Use Microsoft Entra ID app roles and assign them to users or groups