AZ-204 Practice Test 47 — 15 Questions

Question 1

An application publishes order events that multiple independent subscribers must process. Subscribers may be added later without changing the publisher. Which Azure messaging service should be used? The design must avoid adding custom operational scripts.

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Azure Service Bus topic. Azure Service Bus topics support a publish-subscribe pattern where multiple independent subscribers each receive a copy of every published message. This decouples the publisher from subscribers, allowing new subscribers to be added later without modifying the publisher. The built-in subscription entities eliminate the need for custom operational scripts.

Answer

Azure Blob Storage lifecycle policy

Answer

Azure Storage Queue

Answer

Azure Cache for Redis list only

Question 2

A developer is building a solution that sends emails via SendGrid from Azure. Which Azure service should they use to integrate with SendGrid?

Accepted Answer

Azure Logic Apps. Azure Logic Apps provides a managed connector for SendGrid that simplifies integration by offering pre-built triggers and actions for sending emails. This allows developers to create automated workflows without writing custom code, making it the ideal choice for integrating SendGrid with Azure services.

Answer

Azure API Management

Answer

Azure Functions

Answer

Azure Event Grid

Question 3

You have an Azure Storage account that contains a blob container with thousands of small files. You need to generate a URL that allows users to download a single file for a limited time without changing the storage account's firewall rules or requiring authentication. Which approach should you use?

Accepted Answer

Create a Shared Access Signature (SAS) for the specific blob with a time limit. A Shared Access Signature (SAS) for a specific blob provides delegated, time-limited access to that blob without requiring the storage account key or changing firewall rules. By generating a SAS token with a defined expiration time and attaching it to the blob URL, users can download the file directly via HTTPS while the storage account remains secured behind its firewall and authentication requirements.

Answer

Provide the storage account key to the user so they can authenticate

Answer

Assign the user an RBAC role (e.g., Storage Blob Data Reader) and have them authenticate via Microsoft Entra ID

Answer

Set the blob container's public access level to Blob (anonymous read access for blobs)

Question 4

You are developing a web application that will be deployed to Azure App Service. The application allows users to upload files, which are stored in Azure Blob Storage. You need to ensure that only authenticated users can upload files and that each user can only see their own files. You plan to use shared access signatures (SAS) for secure access. The application uses Microsoft Entra ID for authentication. You want to generate SAS tokens on the server after the user authenticates. Which approach should you use?

Accepted Answer

After user authentication, use the server-side code to generate a user delegation SAS for a specific blob container path that includes the user's identifier. Store the SAS in the user's session and return it to the client. The client then uses the SAS to upload the file directly to Blob Storage.. It uses a user delegation SAS, which is signed with the storage account's user delegation key derived from Microsoft Entra ID credentials. This ensures that the SAS token is scoped to the authenticated user's identity and can be restricted to a specific container path (e.g., a folder named after the user's identifier). The server generates the SAS after authentication, stores it in the session, and returns it to the client, allowing direct uploads to Blob Storage without exposing the storage account key.

Answer

After user authentication, have the client generate a SAS token using the storage account key retrieved from a secure endpoint.

Answer

After user authentication, use the server-side code to generate a service SAS for the entire blob container. Return the SAS to the client. The client uploads the file, and the server later moves the file to a user-specific folder.

Answer

After user authentication, use the server to upload the file to Blob Storage using the storage account key. Then return the URL of the uploaded blob to the client.

Question 5

You deploy a web application to Azure App Service. You need to deploy a new version of the application without downtime and have the ability to test the new version before switching traffic. Which feature should you use?

Accepted Answer

Deployment slots. Deployment slots are live, independently running app versions in Azure App Service that allow you to deploy a new build to a staging slot, validate it with zero impact on production, and then swap it into production with instant traffic redirection. This swap operation is atomic and warm-up aware, ensuring no downtime during the transition.

Answer

Auto-scaling

Answer

Backup

Answer

Custom domains

Question 6

You are optimizing an Azure API Management instance that handles 10,000 requests per second. You notice that caching is not effective. The cache hit ratio is below 10%. You need to increase the cache hit ratio. What should you do?

Accepted Answer

Configure cache key to include only relevant query parameters. The low cache hit ratio indicates that cache keys are too specific, causing each request to miss the cache. By configuring the cache key to include only relevant query parameters, you group similar requests under the same cache key, increasing the likelihood of cache hits. This directly addresses the root cause of poor cache utilization in Azure API Management.

Answer

Use external Azure Cache for Redis

Answer

Disable caching for low-traffic APIs

Answer

Increase the cache size to 5 GB

Question 7

You manage an API in Azure API Management. You need to cache API responses such that different responses are returned based on the product subscription key used by the caller. Which set of policies should you implement?

Accepted Answer

Set a 'cache-lookup' policy in the inbound section and a 'cache-store' policy in the outbound section, using the subscription key as a cache vary-by parameter.. Caching API responses based on the subscription key ensures that each caller receives a cached response unique to their subscription. The 'cache-lookup' policy in the inbound section checks the cache before forwarding the request, and the 'cache-store' policy in the outbound section stores the response after it is generated. By specifying the subscription key as a vary-by parameter, the cache key includes the subscription key, so different keys produce different cached entries.

Answer

Set a 'cache-store' policy in the inbound section and a 'cache-lookup' policy in the outbound section.

Answer

Set both 'cache-lookup' and 'cache-store' policies in the inbound section.

Answer

Set only a 'cache-store' policy in the backend section.

Question 8

You develop an Azure Durable Functions application that orchestrates a series of activities. The orchestrator function calls activity functions that perform long-running tasks. You need to ensure that the orchestrator function can handle transient errors and retry failed activity functions. Which feature should you use?

Accepted Answer

Built-in retry policies in Durable Functions. Durable Functions provides built-in retry policies that can be configured directly on activity function calls within orchestrator functions. This allows you to specify parameters such as max retry count, backoff interval, and retry timeout, enabling the orchestrator to automatically retry failed activities without custom code or external dependencies.

Answer

Polly library for retry logic

Answer

Application Insights alerts

Answer

Azure Storage queue message retries

Question 9

You are developing an API that processes sensitive personal data. The API is exposed via Azure API Management (APIM). You need to ensure that only authorized applications can call the API, and you want to validate the token at the APIM gateway without modifying the backend code. What is the most efficient approach?

Accepted Answer

Configure a validate-jwt policy in APIM inbound processing. The validate-jwt policy in APIM's inbound processing validates the OAuth 2.0 token at the gateway level, ensuring only authorized applications can call the API without modifying backend code. This is the most efficient approach because it offloads token validation to APIM, reducing backend complexity and centralizing security enforcement.

Answer

Implement token validation in the backend API code

Answer

Use APIM's OAuth 2.0 authorization server

Answer

Use subscription keys in APIM

Question 10

You are troubleshooting an Azure Function that intermittently throws exceptions. You have enabled Application Insights. You need to capture the exact line of code that caused the exception, even for exceptions that occur during high load. Which feature should you use?

Accepted Answer

Snapshot Debugger. Snapshot Debugger is the correct choice because it captures a point-in-time snapshot of the call stack and local variables at the exact line where an exception occurs, even under high load. This allows you to see the precise line of code and state that caused the failure, which is essential for diagnosing intermittent exceptions. Application Insights integrates Snapshot Debugger to automatically collect these snapshots for thrown exceptions without requiring manual instrumentation.

Answer

Application Insights Profiler

Answer

Live Metrics Stream

Answer

SQL Insights

Question 11

Which THREE Azure Storage features can be used to enforce immutability for compliance requirements?

Accepted Answer

Blob versioning with delete lock policy. Blob versioning with a delete lock policy prevents deletion of blob versions, effectively enforcing immutability by ensuring that once a version is created, it cannot be deleted or overwritten. This satisfies compliance requirements such as SEC 17a-4(f) or FINRA rules that mandate data preservation.

Answer

Soft delete for blobs

Answer

Storage account firewall rules

Question 12

You are building a serverless application that needs to react to insertions and updates in an Azure Cosmos DB container. You want to process these changes using an Azure Function. Which trigger should you configure for the function?

Accepted Answer

Cosmos DB trigger. A Cosmos DB trigger is the correct choice because it is specifically designed to react to changes in a Cosmos DB container by leveraging the change feed. The Azure Function runtime polls the change feed for inserts and updates, invoking the function with batches of documents as they occur. This provides a native, serverless integration without needing additional services.

Answer

Blob trigger

Answer

Event Grid trigger

Answer

Service Bus trigger

Question 13

You are designing a solution that runs background jobs to process images. The jobs can run up to 10 minutes each. You need to ensure the jobs are resilient to failures and can be retried automatically. Which Azure service should you use?

Accepted Answer

Azure Queue Storage with an Azure Function trigger. Azure Queue Storage with an Azure Function trigger is the correct choice because it provides a reliable, message-based architecture for background job processing. Queue messages persist until processed, and the Azure Function trigger automatically retries on failure (up to 5 times by default, with configurable policies). This handles the 10-minute job duration via the queue's visibility timeout, which can be set to match the job's maximum runtime, ensuring messages are not prematurely reprocessed.

Answer

Azure Logic Apps with a recurrence trigger

Answer

Azure Service Bus with a WebJob

Answer

Azure Event Grid with a Logic App

Question 14

You are designing a serverless application using Azure Functions. The function must process messages from an Azure Service Bus queue. The processing time for each message can vary from a few seconds to several minutes. You need to minimize costs while ensuring that messages are processed in a timely manner. Which hosting plan should you recommend?

Accepted Answer

Premium plan. The Premium plan is correct because it supports long execution times (up to 60 minutes by default, configurable to unlimited), always-warm instances to avoid cold starts, and virtual network integration—all while providing predictable pricing and scaling. This meets the requirement of processing messages that can take several minutes without incurring the cold-start penalties or execution-time limits of the Consumption plan.

Answer

Container Instances plan

Answer

App Service plan

Answer

Consumption plan

Question 15

You need to store millions of small JSON documents (each less than 1 KB) that are accessed by key. The data is read-heavy and requires low-latency access. Which Azure storage solution should you use?

Accepted Answer

Azure Cosmos DB. Azure Cosmos DB is the correct choice because it provides single-digit millisecond latency for point reads by key, supports automatic indexing of JSON documents, and offers a globally distributed, multi-model database service. For millions of small JSON documents accessed by key in a read-heavy workload, Cosmos DB's throughput-provisioned model and consistency levels optimize for low-latency access at scale.

Answer

Azure Files

Answer

Azure Table Storage

Answer

Azure Blob Storage