AZ-204 Practice Test 48 — 15 Questions

Question 1

You need to allow a client application to read a specific blob from Azure Blob Storage for one hour, without exposing your storage account key. Which approach should you use?

Accepted Answer

Generate a shared access signature (SAS) URI with read permission and expiry of one hour. A shared access signature (SAS) URI allows you to delegate limited access (read permission) to a specific blob for a defined time period (one hour) without exposing your storage account key. The SAS token is generated using the account key but does not reveal it, ensuring secure, time-bound access.

Answer

Provide the storage account access key to the client

Answer

Use Azure RBAC to grant the client the Storage Blob Data Reader role for one hour

Answer

Make the blob publicly accessible for one hour using a stored access policy

Question 2

You are building an Azure Logic App that must send email notifications via Office 365 when a new order is placed. You need to securely store the Office 365 credentials and reference them in the Logic App. Which approach should you use?

Accepted Answer

Use an Azure Key Vault connector with a managed identity assigned to the Logic App. Using an Azure Key Vault connector with a managed identity assigned to the Logic App allows you to securely store Office 365 credentials in Key Vault and authenticate to it without hardcoding secrets or managing credentials. The managed identity provides an Microsoft Entra ID-backed identity for the Logic App, eliminating the need for username/password in connection strings and enabling secure, auditable access to secrets.

Answer

Store the credentials in a variable within the Logic App designer

Answer

Use an Azure Key Vault action with a connection that uses a username and password

Answer

Store the credentials in an Azure Storage table and fetch them in the Logic App

Question 3

Refer to the exhibit. You are analyzing the Azure Blob Storage service properties configured for a storage account. A web application hosted at https://www.contoso.com attempts to make a PUT request to a blob. The request fails with a CORS error. What is the most likely cause?

Accepted Answer

The request's Origin header does not match the allowed origin.. The CORS error occurs because the request's Origin header (https://www.contoso.com) does not match any allowed origin in the CORS rule. Azure Blob Storage enforces exact string matching for the Origin header against the allowed origins list; a mismatch causes the browser to block the PUT request. Since the question states the request fails with a CORS error and the exhibit shows allowed origins that do not include https://www.contoso.com, this is the most likely cause.

Answer

The request includes a header that is not in the allowed headers list.

Answer

The CORS rule does not include the DELETE method.

Answer

The exposedHeaders list does not include a required response header.

Question 4

A developer is implementing Key Vault certificate retrieval. The application runs on Azure App Service and must avoid stored credentials. Which design should be used?

Accepted Answer

Enable managed identity and grant least-privilege access to the target resource. Azure App Service supports Managed Identity, which allows the application to authenticate to Key Vault without storing any credentials in code or configuration. By enabling a system-assigned or user-assigned managed identity and granting it least-privilege access (e.g., via an access policy with `Get` permission for secrets), the app can securely retrieve certificates using the Azure Identity SDK's `DefaultAzureCredential` class, which automatically obtains an access token from Microsoft Entra ID.

Answer

Use a shared administrator account

Answer

Store a client secret in source control

Answer

Disable authentication for the target resource

Question 5

You are developing a web API that must authenticate requests using Microsoft Entra ID (Microsoft Entra ID) and OAuth 2.0 bearer tokens. You want to validate the token in your API code. Which library should you use?

Accepted Answer

Microsoft.Identity.Web. Microsoft.Identity.Web is the recommended library for integrating ASP.NET Core web APIs with Microsoft Entra ID. It provides built-in token validation, policy enforcement, and handles the OAuth 2.0 bearer token flow, including JWT validation, issuer signing keys, and audience checks, without requiring manual configuration of middleware.

Answer

Microsoft Authentication Library (MSAL)

Answer

ADAL.NET

Answer

Azure.Identity

Question 6

An Azure Functions image resize worker must run for up to 30 minutes and uses a VNet integration feature. The team wants serverless scaling without managing virtual machines. Which hosting plan should be used? The design must avoid adding custom operational scripts.

Accepted Answer

Premium plan. The Premium plan is correct because it supports VNet integration, allows execution durations up to 30 minutes (unlike the Consumption plan's 10-minute default), and provides serverless scaling without requiring you to manage virtual machines or add custom operational scripts. It is the only plan that combines these capabilities for a long-running, VNet-connected function.

Answer

App Service Free tier

Answer

Azure Batch pool

Answer

Consumption plan

Question 7

A developer needs to store session state for a web app that runs on multiple instances behind a load balancer. The state must be persisted across restarts. Which Azure service should they use?

Accepted Answer

Azure Cache for Redis. Azure Cache for Redis is the correct choice because it provides a high-performance, in-memory data store that supports session state persistence across multiple web app instances behind a load balancer. It offers built-in session state providers for ASP.NET and ASP.NET Core, ensuring state is preserved across restarts and scale-out scenarios with low-latency access.

Answer

Azure Table Storage

Answer

Azure SQL Database

Answer

Azure Blob Storage

Question 8

Your team monitors Azure Functions with Application Insights. After a recent deployment, cold start latency increased. Which feature should you enable to mitigate this?

Accepted Answer

Migrate from Consumption plan to Premium plan. Cold start latency occurs when a function app is idle and needs to be loaded from scratch. The Consumption plan can cause cold starts because it scales to zero when idle. Migrating to the Premium plan eliminates cold starts by keeping instances warm, as it provides pre-warmed workers and always-on instances, reducing latency after deployment.

Answer

Set FUNCTIONS_WORKER_RUNTIME to 'dotnet-isolated'

Answer

Enable Azure Monitor alerts on function execution count

Answer

Enable Always On in the function app configuration

Question 9

You are developing an application that writes telemetry data to Azure Table Storage. Each telemetry event is about 5 KB in size, and the application writes up to 10,000 events per second. The data is queried by device ID and timestamp range. What is the most efficient partitioning strategy to maximize write throughput and query performance?

Accepted Answer

Use device ID as the partition key and timestamp as the row key.. Using device ID as the partition key distributes writes across multiple partitions, avoiding throttling from a single partition's scalability limit (up to 20,000 operations per second per partition). Using timestamp as the row key enables efficient range queries for a specific device within a time window, leveraging the table's natural sort order on row key.

Answer

Use timestamp as the partition key and device ID as the row key.

Answer

Use device type as the partition key and timestamp as the row key.

Answer

Use a single partition key for all events and use timestamp as the row key.

Question 10

A company uses Azure Functions with an HTTP trigger and Azure Cosmos DB. They need to securely store connection strings for Cosmos DB and rotate them automatically every 90 days. Which service should they use?

Accepted Answer

Azure Key Vault. Azure Key Vault is the correct service because it provides a centralized, secure store for secrets like connection strings and supports automatic rotation policies. By storing the Cosmos DB connection string in Key Vault and configuring a rotation policy (e.g., every 90 days), the Azure Function can retrieve the latest secret at runtime via a Key Vault reference in its application settings, ensuring the secret is rotated without code changes or downtime.

Answer

Managed Identity

Answer

Azure App Configuration

Answer

Microsoft Entra ID

Question 11

You are implementing a custom API that calls a downstream API secured with OAuth 2.0. The downstream API requires a client credentials grant flow. You need to securely store the client secret and obtain an access token. What should you use?

Accepted Answer

Azure Key Vault to store the secret and MSAL to obtain the token. Azure Key Vault provides secure, auditable storage for client secrets, and MSAL (Microsoft Authentication Library) is the recommended SDK for implementing OAuth 2.0 client credentials grant flows in Azure. MSAL handles token acquisition, caching, and renewal, while Key Vault ensures the secret is never exposed in code or configuration files.

Answer

Azure App Configuration to store the secret and the Azure Identity SDK to obtain the token

Answer

Managed identity to access the downstream API directly

Answer

Azure Certificate Manager to store the secret and the HttpClient to obtain the token

Question 12

Images are uploaded to a high-volume Blob Storage account. An Azure Function with a Blob Storage trigger processes each new image. The team has observed processing delays of up to 10 minutes on accounts with large numbers of containers and blobs. They need processing to start within seconds of upload. What should the developer change?

Accepted Answer

Replace the Blob Storage trigger with an Event Grid trigger and create a Blob Created event subscription that targets the Function's endpoint. Event Grid provides near-real-time event delivery (typically under 1 second) for Blob Created events, eliminating the polling latency inherent in the Blob Storage trigger. The Blob Storage trigger polls Azure Storage logs for new blobs, which can cause delays of up to 10 minutes in high-volume accounts with many containers and blobs. By switching to an Event Grid trigger, the function is invoked directly via HTTP webhook as soon as the blob is created, meeting the requirement for processing to start within seconds.

Answer

Switch to a Timer trigger that runs every 30 seconds and lists newly created blobs via the SDK

Answer

Use a Queue Storage trigger and write blob metadata to the queue from the upload client

Answer

Move the Function to a Premium plan, which uses a dedicated worker and eliminates Blob trigger polling delays

Question 13

A system receives high-volume event notifications from Azure resources and routes them to serverless handlers. Events are lightweight and should use native event routing. Which service should be used? The design must avoid adding custom operational scripts.

Accepted Answer

Azure Event Grid. Azure Event Grid is a fully managed event routing service that uses a publish-subscribe model to deliver lightweight, high-volume events from Azure resources to registered handlers like Azure Functions or webhooks. It supports native event routing without requiring custom polling scripts or infrastructure, making it ideal for serverless event-driven architectures.

Answer

Azure DNS

Answer

Azure Files

Answer

Azure Service Bus queue

Question 14

A company has an Azure Storage account that stores sensitive data. They need to ensure that all access to the storage account is secured using Microsoft Entra ID authentication and that no storage account keys are used. Which configuration should be applied to enforce this?

Accepted Answer

Disable shared key access. Disabling shared key access (Option B) is the correct configuration because it explicitly blocks all authentication using storage account keys (both primary and secondary), forcing all requests to use Microsoft Entra ID (formerly Azure AD) for authorization. This ensures that only identities with appropriate RBAC roles (e.g., Storage Blob Data Owner) can access the storage account, meeting the requirement to eliminate key-based access entirely.

Answer

Enable firewall rules

Answer

Enable advanced threat protection

Answer

Enable soft delete

Question 15

You are using Azure Logic Apps to orchestrate a workflow that calls a third-party API. The API occasionally returns HTTP 429 (Too Many Requests). How should you handle this to ensure the workflow completes successfully without manual intervention?

Accepted Answer

Configure a retry policy on the HTTP action with exponential backoff.. Azure Logic Apps supports configuring a retry policy on HTTP actions, and using exponential backoff is the standard approach to handle HTTP 429 responses. The retry policy automatically waits for increasing intervals between attempts, respecting the 'Retry-After' header if present, which allows the third-party API to recover from rate limiting without manual intervention.

Answer

Increase the timeout value for the HTTP request.

Answer

Change the concurrency setting to 1 to avoid multiple requests.

Answer

Use a webhook action instead of HTTP.