AZ-204 Practice Test 49 — 15 Questions

Question 1

You are monitoring an Azure Function app that processes messages from an Event Hub. You want to be alerted if the function is failing to process messages (e.g., exceptions) and automatically restart the function host. Which Azure service should you use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Azure Monitor alerts with a metric alert on exception count.. Azure Monitor metric alerts on exception count can trigger when the function app throws exceptions during message processing. By configuring an alert rule that fires on the 'Exceptions' metric, you can then set up an action group that includes an auto-remediation step, such as restarting the function app host via a webhook or Azure Automation runbook. This directly addresses the requirement to be alerted and automatically restart the host.

Answer

Application Insights availability tests.

Answer

Azure Service Health alerts.

Answer

Azure Advisor recommendations.

Question 2

You are developing a worker role that processes events from an Azure Event Hub. The worker runs on multiple virtual machines to ensure high availability. Each partition of the Event Hub should be processed by only one instance at a time, and events from the same partition must be processed in order. You need to manage partition leasing and checkpointing efficiently. Which Azure SDK class should you use?

Accepted Answer

EventProcessorHost. The EventProcessorHost (EPH) class is designed specifically for scenarios requiring distributed processing of Event Hub partitions across multiple instances. It manages partition leasing to ensure each partition is processed by only one instance at a time, handles checkpointing to track progress, and guarantees ordered processing within a partition. This makes it the correct choice for high-availability worker roles that must avoid duplicate processing and maintain event order.

Answer

EventHubClient

Answer

PartitionReceiver

Answer

EventHubConsumerClient

Question 3

Refer to the exhibit. You deploy this ARM template to a resource group. The template fails with a 'ResourceNotFound' error. What is the most likely cause?

Accepted Answer

The App Service plan 'myplan' does not exist in the resource group.. The ARM template references an App Service plan named 'myplan' in the 'serverFarmId' property of the Microsoft.Web/sites resource. If 'myplan' does not exist in the same resource group, the deployment fails with a 'ResourceNotFound' error because Azure Resource Manager cannot resolve the dependency on a non-existent resource. The template does not include a definition for the App Service plan, so it must already exist in the resource group.

Answer

The 'apiVersion' is incorrect.

Answer

The template is missing the 'dependsOn' property.

Answer

The 'type' property is incorrect for a web app.

Question 4

You are monitoring an Azure Web App with Application Insights. You notice a sudden spike in failed requests. You need to quickly identify which specific URL path is causing the most failures. Which blade in the Application Insights portal should you use?

Accepted Answer

Failures blade. The Failures blade in Application Insights is specifically designed to analyze failed requests, including HTTP 4xx and 5xx errors, and provides a breakdown by URL path, response code, and failure count. This allows you to quickly identify the specific URL path causing the most failures, which directly addresses the need to pinpoint the problematic endpoint.

Answer

Application Map

Answer

Performance blade

Answer

Live Metrics Stream

Question 5

You are deploying an Azure App Service that uses a Linux container to host a custom web application. You need to configure continuous deployment from a GitHub repository. Which TWO actions should you take?

Accepted Answer

Use the App Service built-in CI/CD feature to connect to GitHub.. Azure App Service provides a built-in CI/CD feature that directly integrates with GitHub, enabling automatic deployment of code changes without additional configuration. Option C is also correct because the Deployment Center in App Service allows you to configure GitHub Actions as the CI/CD pipeline, which builds and deploys the container to the App Service on each push.

Answer

Set up an FTP trigger to poll the GitHub repository for changes.

Answer

Use the Kudu service to sync with GitHub.

Answer

Push the container image to Docker Hub and configure webhook.

Question 6

Your company is building a microservices application on Azure Kubernetes Service (AKS). The application must securely access Azure Key Vault to retrieve secrets. Which identity type should you use for the pods?

Accepted Answer

Microsoft Entra Workload ID (formerly Azure AD Pod Identity). Microsoft Entra Workload ID (formerly Azure AD Pod Identity) is the recommended identity type for pods in AKS because it directly maps an Azure managed identity to a pod, allowing the pod to authenticate to Azure Key Vault without storing any credentials. It integrates with the Kubernetes native service account token projection and uses federated identity credentials, eliminating the need for manual secret management or node-level configuration.

Answer

Service principal with certificate stored in the pod

Answer

User-assigned managed identity on the node resource group

Answer

System-assigned managed identity on AKS cluster

Question 7

An application publishes order events that multiple independent subscribers must process. Subscribers may be added later without changing the publisher. Which Azure messaging service should be used? The design must avoid adding custom operational scripts.

Accepted Answer

Azure Service Bus topic. Azure Service Bus topics support a publish-subscribe pattern where multiple independent subscribers each receive a copy of every published message. This decouples the publisher from subscribers, allowing new subscribers to be added later without modifying the publisher. The built-in subscription entities eliminate the need for custom operational scripts.

Answer

Azure Blob Storage lifecycle policy

Answer

Azure Storage Queue

Answer

Azure Cache for Redis list only

Question 8

You are developing a serverless application using Azure Functions that processes orders. Each order must be validated by calling a third-party API. If the third-party API is unavailable, the function should retry with exponential backoff. How should you implement this?

Accepted Answer

Implement retry logic with exponential backoff and circuit breaker using Polly within the function. It uses the Polly library to implement retry logic with exponential backoff and circuit breaker, which is a lightweight and flexible approach. Option B is incorrect because the trigger binding's automatic retries are for infrastructure failures (e.g., message delivery), not for application-level errors like API unavailability. Option C is incorrect because a long timeout does not handle transient faults; it just waits. Option D is incorrect because, while Azure Durable Functions does support retry via CallActivityWithRetryAsync, it introduces unnecessary complexity (orchestration overhead) for a simple HTTP call that can be handled directly with a library like Polly.

Answer

Enable automatic retries on the function's trigger binding

Answer

Configure the function to have a long timeout and hope the API responds

Answer

Use Azure Durable Functions to orchestrate the retry

Question 9

A developer is building a solution that sends emails via SendGrid from Azure. Which Azure service should they use to integrate with SendGrid?

Accepted Answer

Azure Logic Apps. Azure Logic Apps provides a managed connector for SendGrid that simplifies integration by offering pre-built triggers and actions for sending emails. This allows developers to create automated workflows without writing custom code, making it the ideal choice for integrating SendGrid with Azure services.

Answer

Azure API Management

Answer

Azure Functions

Answer

Azure Event Grid

Question 10

You have an Azure Storage account that contains a blob container with thousands of small files. You need to generate a URL that allows users to download a single file for a limited time without changing the storage account's firewall rules or requiring authentication. Which approach should you use?

Accepted Answer

Create a Shared Access Signature (SAS) for the specific blob with a time limit. A Shared Access Signature (SAS) for a specific blob provides delegated, time-limited access to that blob without requiring the storage account key or changing firewall rules. By generating a SAS token with a defined expiration time and attaching it to the blob URL, users can download the file directly via HTTPS while the storage account remains secured behind its firewall and authentication requirements.

Answer

Provide the storage account key to the user so they can authenticate

Answer

Assign the user an RBAC role (e.g., Storage Blob Data Reader) and have them authenticate via Microsoft Entra ID

Answer

Set the blob container's public access level to Blob (anonymous read access for blobs)

Question 11

You are developing a web application that will be deployed to Azure App Service. The application allows users to upload files, which are stored in Azure Blob Storage. You need to ensure that only authenticated users can upload files and that each user can only see their own files. You plan to use shared access signatures (SAS) for secure access. The application uses Microsoft Entra ID for authentication. You want to generate SAS tokens on the server after the user authenticates. Which approach should you use?

Accepted Answer

After user authentication, use the server-side code to generate a user delegation SAS for a specific blob container path that includes the user's identifier. Store the SAS in the user's session and return it to the client. The client then uses the SAS to upload the file directly to Blob Storage.. It uses a user delegation SAS, which is signed with the storage account's user delegation key derived from Microsoft Entra ID credentials. This ensures that the SAS token is scoped to the authenticated user's identity and can be restricted to a specific container path (e.g., a folder named after the user's identifier). The server generates the SAS after authentication, stores it in the session, and returns it to the client, allowing direct uploads to Blob Storage without exposing the storage account key.

Answer

After user authentication, have the client generate a SAS token using the storage account key retrieved from a secure endpoint.

Answer

After user authentication, use the server-side code to generate a service SAS for the entire blob container. Return the SAS to the client. The client uploads the file, and the server later moves the file to a user-specific folder.

Answer

After user authentication, use the server to upload the file to Blob Storage using the storage account key. Then return the URL of the uploaded blob to the client.

Question 12

A IoT command API runs in Azure App Service and must call a private API hosted inside a virtual network. Which feature allows outbound access from the app to the VNet?

Accepted Answer

Regional VNet integration. Regional VNet integration enables an Azure App Service app to make outbound calls to resources in a virtual network (VNet) using the app's outbound IP addresses. It works by injecting the app's outbound traffic into the VNet via a delegated subnet, allowing the app to reach private APIs hosted inside the VNet without exposing them to the public internet.

Answer

Azure CDN custom domain

Answer

Application Gateway path routing

Answer

Private Endpoint for the web app only

Question 13

You deploy a web application to Azure App Service. You need to deploy a new version of the application without downtime and have the ability to test the new version before switching traffic. Which feature should you use?

Accepted Answer

Deployment slots. Deployment slots are live, independently running app versions in Azure App Service that allow you to deploy a new build to a staging slot, validate it with zero impact on production, and then swap it into production with instant traffic redirection. This swap operation is atomic and warm-up aware, ensuring no downtime during the transition.

Answer

Auto-scaling

Answer

Backup

Answer

Custom domains

Question 14

You design an application that writes millions of small sensor readings (each ~100 bytes) to Azure Blob Storage. The data is appended to files every minute and after 7 days it is archived for compliance. You need to minimize write costs and storage costs. Which blob type and tier strategy should you use?

Accepted Answer

Append blobs with Hot tier and a lifecycle rule to move to Archive after 7 days.. Append blobs are optimized for append operations, making them ideal for continuously adding small sensor readings without rewriting existing data, which minimizes write costs. Moving the blobs to the Archive tier after 7 days via a lifecycle rule reduces storage costs for compliance data, as Archive is the lowest-cost tier for infrequently accessed data.

Answer

Block blobs with Hot tier and a lifecycle rule to move to Cool after 7 days.

Answer

Page blobs with Premium tier.

Answer

Append blobs with Cool tier and no lifecycle rule.

Question 15

You are optimizing an Azure API Management instance that handles 10,000 requests per second. You notice that caching is not effective. The cache hit ratio is below 10%. You need to increase the cache hit ratio. What should you do?

Accepted Answer

Configure cache key to include only relevant query parameters. The low cache hit ratio indicates that cache keys are too specific, causing each request to miss the cache. By configuring the cache key to include only relevant query parameters, you group similar requests under the same cache key, increasing the likelihood of cache hits. This directly addresses the root cause of poor cache utilization in Azure API Management.

Answer

Use external Azure Cache for Redis

Answer

Disable caching for low-traffic APIs

Answer

Increase the cache size to 5 GB