AZ-204 Practice Test 46 — 15 Questions

Question 1

Your Azure Function app needs to call a third-party REST API that requires OAuth 2.0 client credentials flow. The API expects a JWT token signed with a client certificate. You want to store the certificate securely and rotate it automatically. Which Azure service and feature should you use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Store the certificate in Azure Key Vault with automatic rotation enabled, and use Managed Identity to access it from the Function app.. Azure Key Vault provides secure storage for client certificates with built-in automatic rotation capabilities, and using Managed Identity allows the Azure Function app to authenticate to Key Vault without storing any secrets in code or configuration. This combination satisfies the OAuth 2.0 client credentials flow requirement by enabling the Function app to retrieve the certificate dynamically and sign the JWT token.

Answer

Store the certificate in Azure Cosmos DB as a document, and retrieve it using the Cosmos DB SDK.

Answer

Store the certificate in Azure App Service as a TLS/SSL binding, and use the WEBSITE_LOAD_CERTIFICATES app setting.

Answer

Store the certificate in Azure Storage as a blob, and reference it from the Function app using a SAS token.

Question 2

You are using Application Insights to monitor a web app. You want to automatically analyze and alert on sudden increases in request failure rates, without manually setting static thresholds. Which Application Insights feature should you use?

Accepted Answer

Smart Detection. Smart Detection in Application Insights automatically analyzes telemetry from your web app to detect anomalies, such as sudden increases in request failure rates, without requiring manual static thresholds. It uses machine learning models to adapt to your app's normal behavior and alert on deviations, making it ideal for dynamic monitoring scenarios.

Answer

Application Insights Profiler

Answer

Live Metrics Stream

Answer

Continuous Export

Question 3

You are deploying a containerized application to Azure Container Instances. The container image is stored in a private Azure Container Registry (ACR). You need to ensure that ACI can pull the image without storing credentials in the container group definition. What should you use?

Accepted Answer

Enable managed identity for the container group and assign the AcrPull role.. Enabling a managed identity for the container group and assigning the AcrPull role allows Azure Container Instances to authenticate to Azure Container Registry using Microsoft Entra ID without storing any credentials in the container group definition. The managed identity is automatically authenticated by Azure, and ACR supports token exchange via Microsoft Entra ID, so ACI can pull the image securely without embedding secrets.

Answer

Generate a SAS token for the ACR and use it in the image registry credential.

Answer

Create a service principal with AcrPull role and pass its credentials.

Answer

Use the ACR admin account and provide the credentials in the container group.

Question 4

You are configuring an Azure Event Grid subscription to trigger an Azure Function when a blob is created in a storage account. However, the function is not being triggered. You have verified that the function endpoint is reachable and the storage account is in the same region. What is the most likely cause?

Accepted Answer

The Event Grid subscription does not have the required RBAC role on the function.. If the Azure Function app is secured with Microsoft Entra ID authentication, and the Event Grid subscription is configured to use a managed identity for delivery, then that managed identity requires an appropriate RBAC role (e.g., 'Azure Function Data Sender' or a custom role allowing `Microsoft.Web/sites/functions/invoke/action`) on the function app to successfully invoke the function. Without this role, Event Grid cannot authorize its call to the function, even if the endpoint is network reachable. This is a common misconfiguration when the function is protected by Microsoft Entra ID authentication.

Answer

The storage account has public network access disabled.

Answer

The AzureWebJobsStorage connection string is missing from the function app settings.

Answer

Blob versioning is not enabled on the storage account.

Question 5

An application publishes order events that multiple independent subscribers must process. Subscribers may be added later without changing the publisher. Which Azure messaging service should be used? The architecture review board prefers a managed Azure-native control.

Accepted Answer

Azure Service Bus topic. Azure Service Bus topics support a publish-subscribe pattern where multiple independent subscribers can process the same message. Subscribers can be added later without modifying the publisher, and each subscriber receives its own copy of the message through subscriptions. This matches the requirement for order events that must be processed by multiple independent subscribers.

Answer

Azure Blob Storage lifecycle policy

Answer

Azure Storage Queue

Answer

Azure Cache for Redis list only

Question 6

You are designing a solution that needs to react to changes in an Azure Cosmos DB container in real-time. Whenever a new document is inserted or updated, a downstream service must be triggered to process the change. You want to build a serverless solution that reliably captures each change exactly once. Which Azure Cosmos DB feature should you use?

Accepted Answer

Change feed. The Change feed in Azure Cosmos DB is designed to capture document-level changes (inserts and updates) in the order they occur and provides an event-driven, serverless mechanism to reliably process each change exactly once. It integrates natively with Azure Functions, enabling real-time reactions without polling or custom tracking.

Answer

Stored procedures

Answer

T-SQL queries

Answer

Triggers

Question 7

Which FOUR of the following are true regarding Microsoft Entra ID authentication for Azure Storage?

Accepted Answer

RBAC roles can be used to grant permissions to a user or service principal.. Option B is correct because Azure Storage supports Azure RBAC roles such as Storage Blob Data Reader, Storage Blob Data Contributor, and Storage Blob Data Owner, which can be assigned to users, groups, service principals, or managed identities to grant data-plane permissions. Option C is correct because enabling Microsoft Entra ID authentication does not disable Shared Key authorization; unless the storage account is explicitly configured to disallow Shared Key access (for example, by setting AllowSharedKeyAccess to false), Shared Key remains enabled by default. Option D is correct because managed identities for Azure resources let applications authenticate to Azure Storage without storing credentials in code or configuration, since the identity is managed by the Microsoft Entra ID and Azure platform. Option E is correct because Microsoft Entra ID authentication to Azure Storage uses OAuth 2.0 access tokens issued by Microsoft Entra ID, which are presented to the storage service to authorize data-plane requests. Option A is not correct because SAS tokens are still supported alongside Microsoft Entra ID authentication; SAS is a separate authorization mechanism, and user delegation SAS can even be secured with Microsoft Entra ID credentials.

Answer

SAS tokens are not supported when using Microsoft Entra ID authentication.

Question 8

A table stores session records in Azure Table Storage. Queries frequently retrieve all records for one customer in a time range. What key design is best?

Accepted Answer

PartitionKey as customer ID and RowKey based on sortable timestamp. Azure Table Storage queries are most efficient when they target a single partition key. Using the customer ID as the PartitionKey ensures all records for a customer are in the same partition, and using a sortable timestamp (e.g., inverted ticks) as the RowKey allows efficient range queries within that partition, leveraging the table's natural index order.

Answer

RowKey as a constant value

Answer

PartitionKey as a random GUID for every record

Answer

PartitionKey as the full JSON payload

Question 9

You need to send notifications to mobile devices when a new file is uploaded to Azure Blob Storage. Which Azure service should you use to route the event to a notification hub?

Accepted Answer

Azure Event Grid. Azure Event Grid is the correct choice because it provides a fully managed event routing service that can react to Blob Storage events (such as 'BlobCreated') and deliver them directly to Azure Notification Hubs. This enables push notifications to mobile devices without polling or custom middleware, using a publish-subscribe model with low latency.

Answer

Azure Service Bus

Answer

Azure Queue Storage

Answer

Azure Event Hubs

Question 10

A web app needs to access Azure Key Vault secrets for database credentials. The app runs as a managed identity in Azure App Service. Which authentication method should be used to retrieve secrets without storing credentials in the app code?

Accepted Answer

Managed identity. Managed identity is the correct authentication method because it allows the Azure App Service web app to authenticate to Azure Key Vault without storing any credentials in code or configuration. Azure automatically manages the identity, and the app uses a token from the Azure Instance Metadata Service (IMDS) endpoint to access Key Vault secrets. This aligns with the principle of zero-trust and eliminates the security risk of hardcoded secrets.

Answer

Access key

Answer

Client certificate

Answer

Shared access signature (SAS) token

Question 11

A background service must call Microsoft Graph without a signed-in user. Which Microsoft identity platform permission model is required? The team wants the control to be enforceable during normal operations.

Accepted Answer

Application permissions with client credentials flow. The scenario requires an unattended background service to call Microsoft Graph without a signed-in user. Application permissions, combined with the client credentials flow (OAuth 2.0 grant type), allow the service to authenticate as itself using a client ID and client secret or certificate, obtaining an access token with pre-authorized application-level permissions. This model enforces control during normal operations because the permissions are granted directly to the application and cannot be delegated by a user, ensuring consistent access regardless of user presence.

Answer

Password hash synchronization

Answer

Delegated permissions only

Answer

Device code flow

Question 12

You are monitoring an Azure Function app that processes messages from an Event Hub. You want to be alerted if the function is failing to process messages (e.g., exceptions) and automatically restart the function host. Which Azure service should you use?

Accepted Answer

Azure Monitor alerts with a metric alert on exception count.. Azure Monitor metric alerts on exception count can trigger when the function app throws exceptions during message processing. By configuring an alert rule that fires on the 'Exceptions' metric, you can then set up an action group that includes an auto-remediation step, such as restarting the function app host via a webhook or Azure Automation runbook. This directly addresses the requirement to be alerted and automatically restart the host.

Answer

Application Insights availability tests.

Answer

Azure Service Health alerts.

Answer

Azure Advisor recommendations.

Question 13

Refer to the exhibit. You deploy this ARM template to a resource group. The template fails with a 'ResourceNotFound' error. What is the most likely cause?

Accepted Answer

The App Service plan 'myplan' does not exist in the resource group.. The ARM template references an App Service plan named 'myplan' in the 'serverFarmId' property of the Microsoft.Web/sites resource. If 'myplan' does not exist in the same resource group, the deployment fails with a 'ResourceNotFound' error because Azure Resource Manager cannot resolve the dependency on a non-existent resource. The template does not include a definition for the App Service plan, so it must already exist in the resource group.

Answer

The 'apiVersion' is incorrect.

Answer

The template is missing the 'dependsOn' property.

Answer

The 'type' property is incorrect for a web app.

Question 14

You are monitoring an Azure Web App with Application Insights. You notice a sudden spike in failed requests. You need to quickly identify which specific URL path is causing the most failures. Which blade in the Application Insights portal should you use?

Accepted Answer

Failures blade. The Failures blade in Application Insights is specifically designed to analyze failed requests, including HTTP 4xx and 5xx errors, and provides a breakdown by URL path, response code, and failure count. This allows you to quickly identify the specific URL path causing the most failures, which directly addresses the need to pinpoint the problematic endpoint.

Answer

Application Map

Answer

Performance blade

Answer

Live Metrics Stream

Question 15

Your company is building a microservices application on Azure Kubernetes Service (AKS). The application must securely access Azure Key Vault to retrieve secrets. Which identity type should you use for the pods?

Accepted Answer

Microsoft Entra Workload ID (formerly Azure AD Pod Identity). Microsoft Entra Workload ID (formerly Azure AD Pod Identity) is the recommended identity type for pods in AKS because it directly maps an Azure managed identity to a pod, allowing the pod to authenticate to Azure Key Vault without storing any credentials. It integrates with the Kubernetes native service account token projection and uses federated identity credentials, eliminating the need for manual secret management or node-level configuration.

Answer

Service principal with certificate stored in the pod

Answer

User-assigned managed identity on the node resource group

Answer

System-assigned managed identity on AKS cluster