AZ-204 Practice Test 48 — 15 Questions

Question 1

A company deploys an Azure Function app that processes orders. The function needs to scale out automatically when the queue length grows and be billed only for execution time. Which hosting plan should you use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Consumption Plan. The Consumption Plan is correct because it automatically scales out the function app based on the length of the Azure Storage queue trigger, and you are billed only for the execution time (per-second billing) and resources consumed. This plan is ideal for event-driven workloads like order processing, where scaling is demand-driven and idle time incurs no cost.

Answer

App Service Plan

Answer

Premium Plan

Answer

Dedicated Plan

Question 2

An app must store relational state and perform transactions across multiple tables with T-SQL support. Which Azure data service should the developer choose?

Accepted Answer

Azure SQL Database. Azure SQL Database is a fully managed relational database service that supports T-SQL and ACID transactions across multiple tables, making it the correct choice for storing relational state and performing transactional operations. It provides built-in high availability, automatic backups, and elastic scaling, which are essential for enterprise applications requiring consistent, multi-table transactions.

Answer

Azure Queue Storage

Answer

Azure Cache for Redis

Answer

Azure Blob Storage

Question 3

Your company uses Azure App Service to host a web application that requires periodic database maintenance. The maintenance tasks are time-consuming and must run outside of peak hours. You need to schedule these tasks to run automatically at 2:00 AM every Sunday. The tasks should be implemented as an Azure Function that runs in the same App Service plan to reduce costs. What should you do?

Accepted Answer

Create a separate Azure Function App in the same App Service plan and configure a timer trigger.. Creating a separate Azure Function App and hosting it on the *same existing dedicated App Service Plan* (e.g., Basic, Standard, Premium) allows the Azure Function to run using the existing compute resources. This directly meets the requirement to run in the 'same App Service plan to reduce costs' by leveraging existing infrastructure. A timer trigger is the appropriate mechanism to schedule the function to run automatically at 2:00 AM every Sunday. This option also fulfills the requirement that the tasks 'should be implemented as an Azure Function'.

Option A is incorrect because deploying to a Consumption plan would create a *separate* Function App resource with a serverless billing model, which does not align with the 'in the same App Service plan' requirement for cost reduction in the context of an existing dedicated App Service plan.

Option C is incorrect because, while WebJobs are suitable for background tasks and can share an App Service plan, they are not Azure Functions. The STEM explicitly requires the tasks to be implemented as an Azure Function.

Option D is incorrect because Azure Logic Apps are a separate service, incurring separate costs, and do not fulfill the requirement to implement the task 'as an Azure Function' and run it 'in the same App Service plan' for cost reduction.

Answer

Deploy the maintenance code as an Azure Function in the Consumption plan and configure a timer trigger.

Answer

Add a WebJob to the App Service that uses a scheduled trigger to run the maintenance code.

Answer

Use Azure Logic Apps with a recurrence trigger to call the web application's maintenance endpoint.

Question 4

Your Azure Function app needs to call a third-party REST API that requires OAuth 2.0 client credentials flow. The API expects a JWT token signed with a client certificate. You want to store the certificate securely and rotate it automatically. Which Azure service and feature should you use?

Accepted Answer

Store the certificate in Azure Key Vault with automatic rotation enabled, and use Managed Identity to access it from the Function app.. Azure Key Vault provides secure storage for client certificates with built-in automatic rotation capabilities, and using Managed Identity allows the Azure Function app to authenticate to Key Vault without storing any secrets in code or configuration. This combination satisfies the OAuth 2.0 client credentials flow requirement by enabling the Function app to retrieve the certificate dynamically and sign the JWT token.

Answer

Store the certificate in Azure Cosmos DB as a document, and retrieve it using the Cosmos DB SDK.

Answer

Store the certificate in Azure App Service as a TLS/SSL binding, and use the WEBSITE_LOAD_CERTIFICATES app setting.

Answer

Store the certificate in Azure Storage as a blob, and reference it from the Function app using a SAS token.

Question 5

You are using Application Insights to monitor a web app. You want to automatically analyze and alert on sudden increases in request failure rates, without manually setting static thresholds. Which Application Insights feature should you use?

Accepted Answer

Smart Detection. Smart Detection in Application Insights automatically analyzes telemetry from your web app to detect anomalies, such as sudden increases in request failure rates, without requiring manual static thresholds. It uses machine learning models to adapt to your app's normal behavior and alert on deviations, making it ideal for dynamic monitoring scenarios.

Answer

Application Insights Profiler

Answer

Live Metrics Stream

Answer

Continuous Export

Question 6

You are deploying a containerized application to Azure Container Instances. The container image is stored in a private Azure Container Registry (ACR). You need to ensure that ACI can pull the image without storing credentials in the container group definition. What should you use?

Accepted Answer

Enable managed identity for the container group and assign the AcrPull role.. Enabling a managed identity for the container group and assigning the AcrPull role allows Azure Container Instances to authenticate to Azure Container Registry using Azure AD without storing any credentials in the container group definition. The managed identity is automatically authenticated by Azure, and ACR supports token exchange via Azure AD, so ACI can pull the image securely without embedding secrets.

Answer

Generate a SAS token for the ACR and use it in the image registry credential.

Answer

Create a service principal with AcrPull role and pass its credentials.

Answer

Use the ACR admin account and provide the credentials in the container group.

Question 7

You are configuring an Azure Event Grid subscription to trigger an Azure Function when a blob is created in a storage account. However, the function is not being triggered. You have verified that the function endpoint is reachable and the storage account is in the same region. What is the most likely cause?

Accepted Answer

The Event Grid subscription does not have the required RBAC role on the function.. If the Azure Function app is secured with Azure AD authentication, and the Event Grid subscription is configured to use a managed identity for delivery, then that managed identity requires an appropriate RBAC role (e.g., 'Azure Function Data Sender' or a custom role allowing `Microsoft.Web/sites/functions/invoke/action`) on the function app to successfully invoke the function. Without this role, Event Grid cannot authorize its call to the function, even if the endpoint is network reachable. This is a common misconfiguration when the function is protected by Azure AD authentication.

Answer

The storage account has public network access disabled.

Answer

The AzureWebJobsStorage connection string is missing from the function app settings.

Answer

Blob versioning is not enabled on the storage account.

Question 8

You need to restrict access to an Azure Storage account so that only a specific subnet of a virtual network can access the data. Additionally, you need to allow management access from the Azure portal (e.g., to view containers). Which configuration should you apply?

Accepted Answer

Configure a service endpoint for Microsoft.Storage on the subnet and add a firewall rule to allow the subnet, then enable 'Allow trusted Microsoft services'.. Configuring a service endpoint for Microsoft.Storage on the subnet ensures traffic from that subnet to the storage account stays within the Azure backbone, and the firewall rule restricts access to that subnet. Enabling 'Allow trusted Microsoft services' permits Azure portal management operations (e.g., listing containers) because the portal is a trusted service that bypasses the network rules for control-plane actions.

Answer

Configure IP firewall rules to allow the subnet IP range and add the Azure portal's public IP addresses.

Answer

Configure a private endpoint for the storage account and disable public network access.

Answer

Configure IP ACLs to allow the subnet and also allow all Azure services.

Question 9

You need to send email notifications from an Azure Function app when a new user registers in your application hosted on Azure App Service. Which Azure service should you use to send the emails?

Accepted Answer

SendGrid. SendGrid is a cloud-based email delivery service that integrates directly with Azure Functions via an output binding, making it the simplest and most cost-effective option for sending transactional emails like registration notifications. It handles SMTP relay, deliverability, and scaling without requiring a dedicated email server or complex configuration.

Answer

Microsoft 365 SMTP relay

Answer

Azure Communication Services

Answer

Azure Logic Apps

Question 10

You are designing a solution that needs to react to changes in an Azure Cosmos DB container in real-time. Whenever a new document is inserted or updated, a downstream service must be triggered to process the change. You want to build a serverless solution that reliably captures each change exactly once. Which Azure Cosmos DB feature should you use?

Accepted Answer

Change feed. The Change feed in Azure Cosmos DB is designed to capture document-level changes (inserts and updates) in the order they occur and provides an event-driven, serverless mechanism to reliably process each change exactly once. It integrates natively with Azure Functions, enabling real-time reactions without polling or custom tracking.

Answer

Stored procedures

Answer

T-SQL queries

Answer

Triggers

Question 11

A table stores session records in Azure Table Storage. Queries frequently retrieve all records for one customer in a time range. What key design is best?

Accepted Answer

PartitionKey as customer ID and RowKey based on sortable timestamp. Azure Table Storage queries are most efficient when they target a single partition key. Using the customer ID as the PartitionKey ensures all records for a customer are in the same partition, and using a sortable timestamp (e.g., inverted ticks) as the RowKey allows efficient range queries within that partition, leveraging the table's natural index order.

Answer

RowKey as a constant value

Answer

PartitionKey as a random GUID for every record

Answer

PartitionKey as the full JSON payload

Question 12

You need to send notifications to mobile devices when a new file is uploaded to Azure Blob Storage. Which Azure service should you use to route the event to a notification hub?

Accepted Answer

Azure Event Grid. Azure Event Grid is the correct choice because it provides a fully managed event routing service that can react to Blob Storage events (such as 'BlobCreated') and deliver them directly to Azure Notification Hubs. This enables push notifications to mobile devices without polling or custom middleware, using a publish-subscribe model with low latency.

Answer

Azure Service Bus

Answer

Azure Queue Storage

Answer

Azure Event Hubs

Question 13

A web app needs to access Azure Key Vault secrets for database credentials. The app runs as a managed identity in Azure App Service. Which authentication method should be used to retrieve secrets without storing credentials in the app code?

Accepted Answer

Managed identity. Managed identity is the correct authentication method because it allows the Azure App Service web app to authenticate to Azure Key Vault without storing any credentials in code or configuration. Azure automatically manages the identity, and the app uses a token from the Azure Instance Metadata Service (IMDS) endpoint to access Key Vault secrets. This aligns with the principle of zero-trust and eliminates the security risk of hardcoded secrets.

Answer

Access key

Answer

Client certificate

Answer

Shared access signature (SAS) token

Question 14

A containerized booking backend deployed to Azure Container Apps must scale to zero when idle and scale out based on queue length. What should the developer configure?

Accepted Answer

A KEDA-based scale rule for the queue trigger. KEDA (Kubernetes Event-Driven Autoscaling) is natively integrated with Azure Container Apps to enable event-driven scaling. By configuring a KEDA-based scale rule with an Azure Queue Storage trigger, the container app can scale to zero replicas when the queue is empty and scale out based on the queue length, meeting the requirement for idle scaling and queue-driven scaling.

Answer

A manual replica count only

Answer

An Availability Set

Answer

An Azure Front Door health probe

Question 15

A background service must call Microsoft Graph without a signed-in user. Which Microsoft identity platform permission model is required? The team wants the control to be enforceable during normal operations.

Accepted Answer

Application permissions with client credentials flow. The scenario requires an unattended background service to call Microsoft Graph without a signed-in user. Application permissions, combined with the client credentials flow (OAuth 2.0 grant type), allow the service to authenticate as itself using a client ID and client secret or certificate, obtaining an access token with pre-authorized application-level permissions. This model enforces control during normal operations because the permissions are granted directly to the application and cannot be delegated by a user, ensuring consistent access regardless of user presence.

Answer

Password hash synchronization

Answer

Delegated permissions only

Answer

Device code flow