AZ-204 Practice Test 49 — 15 Questions

Question 1

Avanade is developing a .NET Core console application that runs on an Azure VM. The application needs to read a secret from Azure Key Vault. The VM has a system-assigned managed identity enabled. The managed identity has been granted 'Get' and 'List' permissions on the Key Vault secrets. The code uses the Azure.Identity and Azure.Security.KeyVault.Secrets NuGet packages. Which code snippet should the developer use to authenticate to Key Vault?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

var client = new SecretClient(new Uri(keyVaultUrl), new DefaultAzureCredential());. DefaultAzureCredential attempts multiple authentication sources in order, including EnvironmentCredential, ManagedIdentityCredential, and others. Since the VM has a system-assigned managed identity enabled and the code runs in that environment, DefaultAzureCredential will automatically fall through to ManagedIdentityCredential and authenticate using the managed identity's token endpoint. This provides the most flexible and recommended approach for Azure SDK authentication.

Answer

var client = new SecretClient(new Uri(keyVaultUrl), new EnvironmentCredential());

Answer

var client = new SecretClient(new Uri(keyVaultUrl), new ManagedIdentityCredential());

Answer

var client = new SecretClient(new Uri(keyVaultUrl), new ClientSecretCredential(tenantId, clientId, clientSecret));

Question 2

A developer is building an app that uses Azure Cognitive Services Text Analytics. The app needs to detect the language of text input. Which Azure SDK method should be called?

Accepted Answer

DetectLanguage. The correct method is `DetectLanguage` because the Azure Cognitive Services Text Analytics API provides a dedicated operation for identifying the language of input text. This method returns the detected language along with a confidence score, making it the appropriate choice for the requirement of detecting language from text input.

Answer

ExtractKeyPhrases

Answer

AnalyzeSentiment

Answer

RecognizeEntities

Question 3

An API receives JWT access tokens from Microsoft Entra ID. Which two token properties should the API validate before accepting a request? The team wants the control to be enforceable during normal operations.

Accepted Answer

Issuer and signature are valid for the trusted tenant. Option A is correct because the API must verify that the JWT was issued by the trusted Microsoft Entra ID tenant (checking the iss claim against the tenant's issuer URL) and that its signature validates against Entra ID's published signing keys, which prevents forged or tampered tokens. Option C is correct because the API must confirm the aud claim matches its own expected audience — the Application ID URI or client ID — so that a token issued for a different resource cannot be replayed against this API. Option B is not a security control: a display name claim is optional, user-controlled in some flows, and does not prove the token's validity or intended recipient. Option D is incorrect because tokens should be sent in the Authorization header as a Bearer token, not in a query string, which would expose them in logs and URLs and is not a validation property.

Answer

The user's display name is present

Answer

The token was sent in a query string

Question 4

A Cosmos DB container for session records receives hot-partition throttling because the partition key has only five possible values. What should the developer change?

Accepted Answer

Choose a partition key with higher cardinality and even request distribution. A partition key with only five values leads to hot partitions, where one or a few partitions handle the majority of requests, causing throttling. By choosing a partition key with higher cardinality (many distinct values) and even request distribution, the load is spread evenly across physical partitions, eliminating hot spots and throttling.

Answer

Increase the default TTL

Answer

Enable analytical store only

Answer

Use a stored procedure for every write

Question 5

You are implementing an Azure Durable Functions orchestration. The orchestration calls several activity functions that may fail transiently. You need to retry an activity up to 3 times with a 5-second delay, doubling the delay each time (exponential backoff). Which method should you use to call the activity?

Accepted Answer

CallActivityWithRetryAsync with RetryOptions(maxAttempts: 3, firstRetryInterval: TimeSpan.FromSeconds(5), backoffCoefficient: 2). `CallActivityWithRetryAsync` is the built-in method in Durable Functions for calling activity functions with automatic retry policies, including exponential backoff. The `RetryOptions` object allows you to specify `maxAttempts` (3), `firstRetryInterval` (5 seconds), and `backoffCoefficient` (2) to double the delay each time, exactly matching the requirement without custom code.

Answer

CallActivityAsync with a try-catch loop that implements retry logic

Answer

Use a timer trigger to schedule retries after failure

Answer

Set the activity function's retry policy in the function.json file

Question 6

Your Azure Function app uses an Event Hub trigger. Under high load, some events are processed multiple times. You need to ensure exactly-once processing without losing events. What should you implement?

Accepted Answer

Make the function idempotent. Making the function idempotent ensures that even if the Event Hub trigger delivers the same event multiple times (which can happen under high load due to at-least-once delivery semantics), the function's side effects are safe to repeat. Idempotency is the only reliable way to achieve exactly-once processing in a distributed system where the trigger itself does not guarantee deduplication.

Answer

Use Azure Queue Storage instead

Answer

Enable checkpointing

Answer

Increase the batch size

Question 7

An application uses Azure Application Insights for monitoring. You need to write a query to analyze the number of failed requests and exceptions over the past hour. Which query language should you use?

Accepted Answer

Kusto Query Language (KQL). Azure Application Insights stores telemetry data in a Log Analytics workspace, which is queried using Kusto Query Language (KQL). KQL is the native query language for Azure Data Explorer and is specifically designed for time-series analysis, filtering, and aggregation of log data. To analyze failed requests and exceptions over the past hour, you would use KQL operators like `where`, `summarize`, and `bin` to filter by timestamp and count events.

Answer

SQL

Answer

PowerShell

Answer

Azure CLI

Question 8

A developer exposes several backend APIs through Azure API Management. Clients must be throttled by subscription to protect the backend. What should be configured? The design must avoid adding custom operational scripts.

Accepted Answer

API Management rate-limit or quota policy. Azure API Management provides built-in rate-limit and quota policies that enforce throttling at the subscription level without requiring custom code. These policies allow you to define call rates (e.g., requests per second) or quotas (e.g., requests per month) per subscription key, directly protecting backend services from overuse.

Answer

Blob soft delete

Answer

Application Insights sampling

Answer

Private DNS zone only

Question 9

A company uses Azure Logic Apps to automate business processes. They need to call an external REST API that requires OAuth 2.0 client credentials grant. Which connector should they use with minimal configuration?

Accepted Answer

HTTP connector. The HTTP connector in Azure Logic Apps supports OAuth 2.0 client credentials grant natively with minimal configuration. You can directly set the authentication type to 'Active Directory OAuth' and provide the tenant ID, client ID, client secret, and audience/resource URI. This avoids the need for custom code or additional connectors.

Answer

HTTP + Swagger connector

Answer

Azure Functions connector

Answer

Custom connector

Question 10

You are implementing a serverless function in Azure Functions that processes messages from an Azure Storage Queue. The function must ensure that each message is processed at least once and that processing failures are retried up to 5 times. After 5 failed attempts, the message should be moved to a poison queue. What should you configure?

Accepted Answer

Use the default queue poison message handling with 'maxDequeueCount' set to 5.. Azure Functions' Storage Queue trigger automatically implements a poison queue mechanism. By setting the 'maxDequeueCount' property in the host.json file to 5, the runtime will dequeue a message up to 5 times; after the 5th failed attempt, the message is automatically moved to the associated poison queue (named {originalqueue}-poison). This ensures at-least-once processing and retry handling without custom code.

Answer

Set the message time-to-live (TTL) to 5.

Answer

Implement a custom retry policy in the function code with a maximum of 5 retries.

Answer

Set the visibility timeout to 5 minutes.

Question 11

You are a developer for a healthcare company that stores patient diagnostic images in Azure Blob Storage. The images are uploaded by medical devices and must be retained for 7 years due to regulatory requirements. After 7 years, the data must be permanently deleted. The images are accessed infrequently after the first month. You need to design a storage lifecycle management policy to minimize costs while meeting compliance. The storage account uses general-purpose v2 with LRS. The container is named 'diagnostics'. Which of the following policies should you implement?

Accepted Answer

Move blobs to Cool tier after 30 days, move to Archive tier after 90 days, and delete after 7 years.. It aligns with the access pattern: blobs are moved to the Cool tier after 30 days (when infrequent access begins), then to the Archive tier after 90 days for long-term, low-cost storage, and finally deleted after 7 years to meet regulatory retention and deletion requirements. This minimizes costs by using the most cost-effective tier for each stage of the data lifecycle.

Answer

Move blobs to Cool tier after 30 days, and delete after 30 days.

Answer

Move blobs to Archive tier immediately after upload, and delete after 7 years.

Answer

Move blobs to Cool tier after 1 year, and delete after 7 years.

Question 12

Which THREE of the following are true about Azure Blob Storage access tiers? (Choose THREE.)

Accepted Answer

You can change the access tier of a blob after it has been uploaded.. Azure Blob Storage allows you to change the access tier of a blob after it has been uploaded, either by directly setting the tier on the blob or using lifecycle management policies. This flexibility enables you to optimize storage costs based on changing access patterns without re-uploading data.

Answer

Hot tier has lower storage cost than Cool tier.

Answer

Archive tier allows immediate read access to blobs.

Question 13

You deploy an Azure Function app that uses the Premium plan. The function processes messages from an Azure Service Bus queue. Under heavy load, some messages are processed multiple times. You need to ensure exactly-once processing without losing messages. What should you do?

Accepted Answer

Enable duplicate detection on the Service Bus queue.. Enabling duplicate detection on the Service Bus queue ensures that the Service Bus broker itself discards duplicate messages based on a user-defined time window. This prevents the function from processing the same message multiple times, even if the function host restarts or the message is re-delivered due to transient failures. Duplicate detection works by tracking the MessageId of each message and ignoring any subsequent message with the same MessageId within the detection window.

Answer

Use Peek-Lock mode instead of Receive and Delete.

Answer

Set the maxDeliveryCount to 1 on the queue.

Answer

Reduce the batch size in the function host.json.

Question 14

You develop an application that stores large binary files (up to 1 GB) in Azure Blob Storage. The application must minimize latency when reading these files from different geographic regions. The files are updated infrequently (once per month) and must be read-only for the application. You need to configure the storage account for optimal read performance and cost. What should you use?

Accepted Answer

Use Azure Blob Storage with read-access geo-redundant storage (RA-GRS) and serve reads from the secondary region.. Read-access geo-redundant storage (RA-GRS) provides a secondary read-only endpoint in a paired region, allowing the application to read from the closest region to minimize latency. Since files are updated infrequently (once per month) and are read-only, RA-GRS offers cost-effective geo-distributed read performance without the premium cost of CDN or Premium Blob Storage.

Answer

Use Azure Blob Storage with Premium Block Blob Storage and enable geo-replication.

Answer

Use Azure Blob Storage with a Content Delivery Network (CDN) endpoint.

Answer

Use Azure Files with a Premium tier and geo-redundant storage.

Question 15

You have an Azure App Service web app that uses a system-assigned managed identity. The web app needs to authenticate to an Azure SQL Database to read and write data. You want to use the managed identity to avoid storing credentials in connection strings. Which steps are required to configure this access?

Accepted Answer

Create a contained database user in the SQL database mapped to the managed identity, grant required database roles, and use Microsoft Entra ID token-based authentication from the app.. To use a system-assigned managed identity with Azure SQL Database, you must create a contained database user mapped to the managed identity in the SQL database, grant it the necessary database roles (e.g., db_datareader, db_datawriter), and then acquire an access token for Microsoft Entra ID (formerly Azure AD) from the managed identity endpoint to authenticate. This token-based approach avoids storing credentials and leverages the managed identity's automatic credential rotation.

Answer

Assign the managed identity the 'SQL DB Contributor' RBAC role on the database, then use SQL authentication with the identity's client ID.

Answer

Enable Microsoft Entra ID authentication on the SQL server, add the managed identity as an Microsoft Entra ID admin, and use integrated security in the connection string.

Answer

Configure the connection string with the managed identity's principal ID as the user ID and leave the password empty.