AZ-204 Practice Test 50 — 15 Questions

Question 1

A Blob-triggered function processing audit documents fires multiple times for the same blob after retries. What should the function design include?

Accepted Answer

Idempotent processing based on blob name/version or metadata. Azure Blob Storage triggers can cause multiple function invocations for the same blob due to retries, internal queue processing, or event-driven architecture guarantees. Designing the function to be idempotent—using the blob name, version, or metadata as a unique identifier—ensures that duplicate processing does not produce side effects like duplicate audit records or data corruption. This aligns with the at-least-once delivery semantics of Azure Blob Storage triggers.

Answer

Disable all logging

Answer

Assume each event is delivered exactly once

Answer

Use public blob access

Question 2

You are using Azure File Sync to sync on-premises file shares to Azure. You need to ensure that files are cached locally on the on-premises server for fast access, but only the most frequently accessed files should be cached. What should you configure?

Accepted Answer

Enable cloud tiering on the server endpoint and set a volume free space policy.. Cloud tiering on an Azure File Sync server endpoint allows you to keep only frequently accessed files cached locally while infrequently accessed files are tiered to Azure. By setting a volume free space policy, you control how much local disk space is reserved for frequently accessed files, ensuring that only the most accessed files remain cached. This directly meets the requirement of caching only the most frequently accessed files locally.

Answer

Configure a caching rule using Azure File Sync's built-in cache size limit.

Answer

Configure a sync group with a custom server endpoint that filters files by last access time.

Answer

Use the Invoke-AzStorageSyncFileRecall cmdlet to recall files on demand.

Question 3

You are designing a solution that reads messages from an Azure Service Bus queue and processes them using an Azure Function. The function must process messages in order and ensure no duplicate processing. Which configuration should you use?

Accepted Answer

Enable sessions on the queue and use peek-lock mode with automatic complete on success. Enabling sessions on a Service Bus queue guarantees message ordering within a session, and using peek-lock mode with automatic complete ensures exactly-once processing by locking the message during processing and only completing it upon success. This combination prevents duplicate processing and maintains order, which is essential for sequential message handling in Azure Functions.

Answer

Use auto-forwarding to a dead-letter queue on failure

Answer

Partition the queue and use multiple functions to process each partition in order

Answer

Use receive and delete mode to ensure each message is processed only once

Question 4

You deploy a containerized application on Azure Container Instances (ACI). The application writes data that must persist across container restarts and be accessible from multiple instances. Which volume mount should you configure?

Accepted Answer

Azure Files share. Azure Files shares provide a fully managed SMB file share in the cloud that can be mounted as a volume in Azure Container Instances. This allows data written by the container to persist across restarts and be accessed concurrently by multiple container instances, meeting the requirements for durability and shared access.

Answer

emptyDir volume

Answer

Azure Disk

Answer

ConfigMap

Question 5

You need to analyze all exceptions that occurred in the last 24 hours from an application monitored by Application Insights. You want to group them by exception type, and for each type show the URL where it occurred and the count. Which Log Analytics Kusto query should you use?

Accepted Answer

exceptions | where timestamp > ago(24h) | summarize count() by type, url. The query filters exceptions from the last 24 hours using `timestamp > ago(24h)`, groups them by `type` (exception type) and `url` (the URL where the exception occurred), and then counts occurrences per group with `summarize count()`. This directly matches the requirement to show, for each exception type, the URL and the count.

Answer

exceptions | where timestamp > ago(24h) | summarize count() by type, cloud_RoleInstance

Answer

exceptions | where timestamp > ago(24h) | summarize count() by type, operation_Name

Answer

exceptions | where timestamp > ago(24h) | summarize count() by type

Question 6

You are designing a background job processing solution using Azure Batch. The job runs a large number of tasks that are CPU-intensive and require access to large input files stored in Azure Blob Storage. You need to minimize the time to process all tasks while controlling costs. Which THREE actions should you take?

Accepted Answer

Mount Azure Blob Storage as a file system using blobfuse to allow tasks to access files directly.. Mounting Azure Blob Storage as a file system using blobfuse allows tasks to directly access large input files without downloading them first, reducing data transfer time and eliminating local disk bottlenecks. This is critical for CPU-intensive tasks that need fast, concurrent access to shared data, minimizing overall processing time.

Answer

Set the task slots per VM to 1 to avoid contention.

Answer

Use a pool of small-sized VMs (e.g., Standard_A1_v2) to minimize cost per node.

Question 7

Coho Vineyard has an Azure Logic App that processes orders. The workflow must call a third-party API that uses Basic authentication. The credentials (username and password) must be stored securely in Azure Key Vault. The Logic App uses a system-assigned managed identity. The managed identity has been granted 'Get' permission on the Key Vault secrets. Which approach should the team use to pass the credentials to the third-party API?

Accepted Answer

Add a Key Vault connector step to retrieve the secret containing the password. Then use an HTTP connector with 'Basic' authentication type. In the authentication parameters, reference the secret for the password.. The correct approach is to retrieve the secret from Key Vault using the Logic App's managed identity (which already has Get permission), then configure the HTTP connector with Basic authentication and reference the retrieved secret for the password. This keeps credentials out of the workflow definition and uses the managed identity for secure Key Vault access.

Answer

Use an HTTP connector with 'Active Directory OAuth' authentication. Provide the client ID and client secret.

Answer

Use managed identity authentication on the HTTP connector. The third-party API must support managed identity.

Answer

Store the username and password directly in the Logic App's connection settings for the HTTP connector.

Question 8

You have an App Service web app with Application Insights configured. You want to create an alert that fires when the server response time exceeds 2 seconds for a rolling 10-minute window. Which type of alert rule should you create?

Accepted Answer

Metric alert. Metric alerts in Azure Monitor evaluate resource-level performance counters at regular intervals, making them ideal for threshold-based conditions like server response time. Application Insights automatically collects server response time as a pre-aggregated metric, so a metric alert can check whether the average exceeds 2 seconds over a rolling 10-minute window without needing to query raw log data.

Answer

Log alert

Answer

Activity log alert

Answer

Smart detection alert

Question 9

Refer to the exhibit. An administrator runs this Azure CLI command. What is the result?

Accepted Answer

Assigns the Reader role to a service principal at the resource group scope. The Azure CLI command `az role assignment create --assignee --role Reader --resource-group ` assigns the Reader role to a service principal (identified by its object ID) at the specified resource group scope. The Reader role grants read-only access to resources within that resource group, which matches the command's parameters and the expected outcome.

Answer

Assigns the Contributor role to a service principal at the resource group scope

Answer

Assigns a managed identity to the resource group

Answer

Assigns the Reader role to a user at the subscription scope

Question 10

Your Azure Logic App needs to send emails using Microsoft Graph API on behalf of the signed-in user. The user is authenticated with Microsoft Entra ID. Which authentication method should you use in the Logic App?

Accepted Answer

Use OAuth 2.0 authorization code flow with delegated permissions. The OAuth 2.0 authorization code flow with delegated permissions is correct because the Logic App needs to act on behalf of the signed-in user, not as an application itself. This flow allows the user to authenticate via Microsoft Entra ID and grant the Logic App delegated permissions to call Microsoft Graph API (e.g., to send emails as the user). The authorization code is exchanged for an access token that includes the user's context, enabling the API to enforce user-level permissions.

Answer

Use a system-assigned managed identity

Answer

Use client credentials flow with an app registration

Answer

Use Basic authentication with user credentials

Question 11

Refer to the exhibit. You are reviewing a role assignment for a managed identity. The JSON shows the role and scope. What access does this assignment grant?

Accepted Answer

Read, write, and delete access to blobs in container c1.. The role assignment grants the 'Storage Blob Data Contributor' role at the scope of container 'c1'. This role provides read, write, and delete access to blob data within that specific container, but not management operations on the storage account itself. Option C correctly identifies this level of access.

Answer

Full management access to the storage account.

Answer

Read access to all containers in the storage account.

Answer

Read-only access to blobs in container c1.

Question 12

You have an Azure Function app that needs to retrieve a secret from Azure Key Vault at runtime. You want to avoid storing any credentials in code or configuration. Which mechanism should you use?

Accepted Answer

Managed identity. Managed identity (B) is the correct mechanism because it allows the Azure Function app to authenticate to Azure Key Vault without storing any credentials in code or configuration. Azure automatically manages the identity and provides a token from Microsoft Entra ID that the function can use to access the vault, eliminating the need for secrets or keys in the application.

Answer

Service principal with client secret

Answer

Access key

Answer

Shared access signature (SAS)

Question 13

You need to deploy a containerized application to Azure that must be restarted automatically if it crashes. The solution should minimize management overhead. Which compute service should you use?

Accepted Answer

Azure Container Instances. Azure Container Instances (ACI) is the correct choice because it provides a serverless container platform that automatically restarts containers if they crash when configured with a restart policy of 'Always' or 'OnFailure'. This minimizes management overhead by eliminating the need to manage underlying infrastructure, orchestration, or virtual machines, making it ideal for simple, stateless containerized applications that require automatic recovery.

Answer

Azure Functions

Answer

Azure Kubernetes Service (AKS)

Answer

Azure Virtual Machines

Question 14

A developer is configuring a web app to authenticate users with Microsoft Entra ID. The web app needs to call a downstream API that also uses Microsoft Entra ID for authentication. The developer must ensure that the web app can securely obtain access tokens for the downstream API. Which authentication flow should the developer implement?

Accepted Answer

OAuth 2.0 On-Behalf-Of flow. The OAuth 2.0 On-Behalf-Of (OBO) flow is the correct choice because the web app has already authenticated the user via Microsoft Entra ID and needs to exchange the user's access token for a new token to call the downstream API. This flow allows the web app to act on behalf of the authenticated user, maintaining the user's identity and consent context for the downstream API call.

Answer

OAuth 2.0 Client Credentials flow

Answer

OAuth 2.0 Implicit flow

Answer

OAuth 2.0 Authorization Code flow

Question 15

Refer to the exhibit. The exhibit shows an Azure Event Grid subscription configuration. You notice that the webhook endpoint is not receiving events when a .png file is uploaded to the 'images' container. What is the most likely reason?

Accepted Answer

The subject filter excludes .png files. The exhibit shows an Event Grid subscription with a subject filter configured to only include events where the subject ends with '.jpg'. Since a .png file upload would have a subject ending in '.png', the filter excludes it, preventing the event from being sent to the webhook endpoint. Therefore, the subject filter is the most likely reason the webhook is not receiving .png file events.

Answer

The subscription is disabled

Answer

The destination endpoint type is incorrect

Answer

The webhook endpoint requires authentication