AZ-204 Practice Questions 2 — 50 Questions

Question 1

You need to emit a custom metric in Application Insights that tracks the number of page views per browser. You expect high volume (millions of events per day). Which API should you use to ensure efficient pre-aggregation and avoid performance issues?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

GetMetric. C is correct because the GetMetric API (previously known as Pre-Aggregated Metric API) is designed for high-volume telemetry scenarios. It pre-aggregates metrics on the client side before sending them to Application Insights, significantly reducing network traffic and storage costs while avoiding performance bottlenecks from millions of individual events.

Answer

TrackEvent

Answer

TrackMetric

Answer

TrackDependency

Question 2

You are developing a .NET Core application that uploads large files (up to 50 GB) to Azure Blob Storage. The application must support resuming uploads that are interrupted due to network failures. Which approach should you use?

Accepted Answer

Use a block blob and upload blocks in parallel, then commit the block list.. Block blobs are designed for large files and support uploading blocks in parallel, which improves throughput and reliability. By uploading individual blocks and then committing the block list, you can resume an interrupted upload by re-uploading only the missing blocks, as each block is identified by a unique block ID. This approach is ideal for files up to 50 GB and aligns with Azure's recommended pattern for resumable uploads.

Answer

Use an append blob and append blocks in sequence.

Answer

Use the Put Blob API to upload the entire file in a single request.

Answer

Use a page blob and upload pages in sequence.

Question 3

Your application uses Azure Queue Storage to process orders. Occasionally, messages are not processed and remain in the queue. You need to ensure that messages are automatically retried after a specified time if they are not deleted. What should you configure?

Accepted Answer

Set the message visibility timeout to a small value. Setting the message visibility timeout to a small value ensures that if a message is not deleted after processing (i.e., the worker fails or crashes), the message becomes visible again in the queue after the short timeout. This allows other queue consumers to retry processing the message automatically. The visibility timeout controls how long a message is hidden from other consumers after being dequeued, and a small value reduces the delay before a retry occurs.

Answer

Configure a dead-letter queue

Answer

Enable queue storage logging

Answer

Increase the message time-to-live (TTL)

Question 4

A image resize worker runs in Azure App Service and must call a private API hosted inside a virtual network. Which feature allows outbound access from the app to the VNet?

Accepted Answer

Regional VNet integration. Regional VNet integration enables an Azure App Service app to make outbound calls to resources in a virtual network (VNet) over the Microsoft backbone network. It uses a delegated subnet in the VNet to assign the app a network interface in the VNet, allowing it to reach private APIs without exposing them to the public internet.

Answer

Azure CDN custom domain

Answer

Application Gateway path routing

Answer

Private Endpoint for the web app only

Question 5

You are building a serverless application that processes images uploaded to an Azure Blob Storage container. When a new blob is added, an Azure Function (PowerShell) is triggered to generate a thumbnail and store it in a different container. The function must run with the least privilege necessary. The function uses a managed identity assigned to the function app. You need to grant the function access to read blobs from the source container and write blobs to the destination container. The storage account already has a private endpoint configured. What is the correct way to assign permissions?

Accepted Answer

Add the function app's managed identity to the source container's Access Control (IAM) with the 'Storage Blob Data Reader' role, and to the destination container with the 'Storage Blob Data Contributor' role.. It uses Azure RBAC roles scoped to individual containers, granting the function app's managed identity exactly the permissions needed: 'Storage Blob Data Reader' for reading from the source container and 'Storage Blob Data Contributor' for writing to the destination container. This follows the principle of least privilege, avoids over-permissioning, and works seamlessly with private endpoints since RBAC does not depend on network paths.

Answer

Generate a SAS token for the source container with read permission and for the destination container with write permission, and store them in Key Vault for the function to retrieve.

Answer

Add the function app's managed identity to the storage account's Access Control (IAM) with the 'Storage Blob Data Owner' role on the entire storage account.

Answer

Use the storage account connection string in the function app settings and access the blobs using the connection string.

Question 6

Contoso Ltd. is migrating a legacy on-premises application to Azure. The application processes customer orders and sends confirmation emails. The new solution must use Azure Functions with an HTTP trigger to receive orders, store order data in Azure Cosmos DB, and send emails via SendGrid. Security requirements: All connections must use managed identities where possible. No secrets should be stored in code or configuration files. Cosmos DB and SendGrid API keys must be retrieved at runtime from Azure Key Vault. The Azure Function app must be able to access Key Vault without storing any connection strings or secrets in application settings. The development team plans to use the Azure.Identity and Azure.Security.KeyVault.Secrets libraries. Which approach should the team use to authenticate to Key Vault?

Accepted Answer

Enable system-assigned managed identity on the Function app. Grant the identity 'Get' and 'List' permissions on Key Vault secrets. Use DefaultAzureCredential in code to authenticate to Key Vault.. It uses a system-assigned managed identity, which eliminates the need to store any secrets or connection strings. The DefaultAzureCredential class automatically attempts authentication via managed identity when running in Azure, and the code retrieves secrets from Key Vault using the Azure.Identity and Azure.Security.KeyVault.Secrets libraries. Granting 'Get' and 'List' permissions on Key Vault secrets allows the function to read the Cosmos DB and SendGrid API keys at runtime, meeting all security requirements.

Answer

Upload a client certificate to the Function app's certificate store. Use ClientCertificateCredential to authenticate to Key Vault.

Answer

Use Key Vault references in application settings. Store the Key Vault URI in app settings and let the Functions runtime resolve secrets.

Answer

Create a user-assigned managed identity, assign it to the Function app, and store its client ID in application settings. Grant the identity permissions to Key Vault. Use ClientSecretCredential with the client ID and a secret.

Question 7

Your company has a set of REST APIs that are exposed through Azure API Management (APIM). One of the backend APIs is secured and requires an OAuth 2.0 access token from Microsoft Entra ID. The APIM instance has a system-assigned managed identity with permissions to request tokens for the backend API's scope. You need to configure APIM to automatically obtain a token and pass it to the backend API when requests come in. What should you do?

Accepted Answer

Add a set-backend-service policy with the authentication-managed-identity attribute. The `set-backend-service` policy with the `authentication-managed-identity` attribute allows APIM to use its system-assigned managed identity to obtain an OAuth 2.0 access token from Microsoft Entra ID for the specified backend API scope. This token is automatically attached to the backend request as an Authorization header, enabling secure access without manual token management.

Answer

Configure the backend API's subscription key in policy

Answer

Use a validate-jwt policy to check incoming token

Answer

Create a named value with the token and reference it in policy

Question 8

You are developing a microservices application. Each microservice must authenticate to Azure SQL Database using its own identity. You need to minimize credential management overhead. What should you use?

Accepted Answer

System-assigned managed identities. System-assigned managed identities enable each microservice to authenticate to Azure SQL Database without storing credentials in code or configuration. Azure automatically rotates the identity's service principal certificate and handles token acquisition via the Azure Instance Metadata Service (IMDS) endpoint, eliminating manual credential management. This is the simplest approach when each microservice has a one-to-one relationship with its Azure resource (e.g., App Service or Azure Function).

Answer

User-assigned managed identities

Answer

Certificate-based authentication

Answer

Service principals with client secrets

Question 9

You are deploying a Node.js application to Azure Web Apps for Containers. The application needs to read configuration settings from Azure App Configuration. What is the recommended method to securely connect the app to the configuration store?

Accepted Answer

Use managed identity.. Using a managed identity allows the Node.js application running in Azure Web Apps for Containers to authenticate to Azure App Configuration without storing any secrets. Managed identities provide an automatically managed service principal in Azure AD, enabling secure, code-free access to the configuration store via Azure AD authentication, which is the recommended approach for production workloads.

Answer

Store connection string in environment variables.

Answer

Use Key Vault references in App Settings.

Answer

Hardcode the connection string.

Question 10

You are creating an Azure Container Instance using the Azure CLI command shown in the exhibit. The container needs to connect to a SQL database. After running the command, you notice that the DB_PASSWORD environment variable is visible in the container's logs. What is the most likely reason?

Accepted Answer

The container image logs environment variables at startup, exposing the secure variable.. The `--secure-environment-variables` flag in Azure CLI for Azure Container Instances does not prevent the values from being logged by the container itself. The flag only masks the values in the Azure portal and CLI output, but if the container image explicitly logs environment variables at startup (e.g., via a startup script or application code), the secure variable will be exposed in the container logs. The issue is not with Azure's handling but with the container image's behavior.

Answer

The --secure-environment-variables flag is misspelled.

Answer

The --secure-environment-variables flag is not supported for ACI.

Answer

The DB_PASSWORD value contains special characters that were not escaped.

Question 11

You are designing a solution that stores sensitive customer data in Azure Blob Storage. The data must be encrypted at rest using a customer-managed key (CMK) stored in Azure Key Vault. Additionally, the solution must support automatic key rotation every 90 days. You need to configure the encryption settings. Which combination of Azure services and features should you use?

Accepted Answer

Use Azure Storage encryption with a customer-managed key stored in Azure Key Vault. Configure a key rotation policy in Key Vault to rotate the key every 90 days.. Azure Storage Service Encryption (SSE) supports customer-managed keys (CMK) stored in Azure Key Vault for encrypting blob data at rest. Automatic key rotation every 90 days can be achieved by configuring a key rotation policy in Azure Key Vault, which allows you to define a rotation frequency (e.g., 90 days) and automatically generate a new key version. This meets both the CMK and automatic rotation requirements without additional services.

Answer

Use Azure Information Protection to encrypt the blobs with a customer-managed key.

Answer

Use Azure Disk Encryption with Azure Key Vault to encrypt the storage account.

Answer

Use Azure Storage Service Encryption (SSE) with Microsoft-managed keys and enable automatic key rotation.

Question 12

You are developing an API using Azure API Management (APIM). The API is backed by an Azure Function that processes requests. You need to implement caching for responses that are expensive to compute. The cache should expire after 10 minutes. What should you configure in APIM?

Accepted Answer

Add a cache-lookup and cache-store policy to the API operation.. Azure API Management (APIM) provides built-in caching policies—`cache-lookup` and `cache-store`—that can be applied directly to an API operation. These policies cache the response from the backend (the Azure Function) and respect the `cache-control` header or a specified duration, such as 10 minutes, without requiring an external cache. This is the simplest and most direct way to implement response caching for expensive-to-compute operations within APIM.

Answer

Configure Azure Redis Cache as an external cache in APIM.

Answer

Implement response caching in the Azure Function code.

Answer

Use Azure Front Door to cache responses.

Question 13

You are a developer for a startup that is building a real-time chat application on Azure. The application uses Azure Web PubSub to broadcast messages to clients. The security team requires that only authenticated users can connect to the Web PubSub service. You plan to use Microsoft Entra ID for authentication. The application backend is an Azure Function that generates access tokens. What is the correct course of action to secure the Web PubSub service?

Accepted Answer

Enable managed identity for the Azure Function, assign it the 'Web PubSub Service Owner' role, and use the Web PubSub SDK to generate a client access token after authenticating the user.. It uses managed identity to securely authenticate the Azure Function to the Web PubSub service without exposing any secrets. The Function then generates a client access token only after the user is authenticated via Microsoft Entra ID, ensuring that only authenticated users can connect to the Web PubSub service. This approach follows the principle of least privilege and avoids distributing shared access keys or connection strings to clients.

Answer

Configure the Web PubSub service to use a shared access key and distribute it to clients via the Function.

Answer

Set the Web PubSub service's 'Anonymous mode' to 'Allow anonymous connections' and authenticate users at the application level.

Answer

Use the Web PubSub connection string (access key) in the Function to generate a client token, and store the connection string in Azure Key Vault.

Question 14

A retail company uses Azure Logic Apps to integrate with third-party APIs. One Logic App sends purchase orders to a supplier's HTTP endpoint. The supplier requires that the request include an OAuth 2.0 access token obtained from their authorization server. The company wants to manage the client credentials (client ID and client secret) securely and rotate them automatically. The Logic App must also log all requests for auditing. What should you do?

Accepted Answer

Use the 'HTTP + Swagger' connector, define the OAuth2 security scheme, store the client secret in Key Vault, and configure the Logic App to use a system-assigned managed identity to access Key Vault.. It combines the HTTP + Swagger connector to define the OAuth2 security scheme inline, stores the client secret in Azure Key Vault for secure management and automatic rotation, and uses a system-assigned managed identity to access Key Vault without hardcoding credentials. This approach ensures the Logic App can securely retrieve the client secret, request an OAuth 2.0 token from the supplier's authorization server, and log all HTTP requests via the connector's built-in logging capabilities.

Answer

Use the built-in HTTP action with a system-assigned managed identity and request a token from the supplier's authorization server using the managed identity.

Answer

Use the built-in HTTP action in the Logic App, store the client secret in Azure Key Vault, and retrieve it using the Key Vault connector. Then request a token from the supplier's authorization server.

Answer

Use the 'Managed API' connector for the supplier, configure it with client ID and secret in the connection parameters, and enable 'Azure AD Integration' on the Logic App.

Question 15

Refer to the exhibit. You have an HTTP-triggered Azure Function that writes the request body to a blob in the 'samples-workitems' container. The function runs successfully but does not create a blob. What is the most likely cause?

Accepted Answer

The storage account connection string is not set in the function app settings. The most likely cause is that the storage account connection string is not set in the function app settings. Azure Functions require the connection string for the storage account to be configured via the `AzureWebJobsStorage` app setting (or a custom connection setting referenced in the binding). Without it, the runtime cannot authenticate or communicate with Blob Storage, so the output binding silently fails to write the blob, even though the function executes successfully.

Answer

The container name 'samples-workitems' is invalid

Answer

The blob name pattern {rand-guid} is not supported

Answer

The blob output binding syntax is incorrect

Question 16

You are developing an application that stores user secrets. You need to ensure that the secrets are encrypted at rest and rotated automatically. Which Azure service should you integrate?

Accepted Answer

Azure Key Vault.. Azure Key Vault is the correct choice because it provides centralized management of secrets, keys, and certificates with built-in encryption at rest using FIPS 140-2 Level 2 validated hardware security modules (HSMs). It also supports automatic rotation of secrets through integration with Azure Event Grid and Azure Functions, enabling you to schedule or trigger key rotation policies without manual intervention.

Answer

Azure Storage.

Answer

Azure Security Center.

Answer

Microsoft Entra ID.

Question 17

You are deploying a web app to Azure App Service. The app uses environment-specific configuration (e.g., connection strings). You need to manage these settings without redeploying the app. Which feature should you use?

Accepted Answer

App Service application settings. App Service application settings (option B) are the correct feature because they allow you to store environment-specific configuration (e.g., connection strings, app settings) as key-value pairs that are injected into the app at runtime. These settings can be changed in the Azure portal, CLI, or PowerShell without redeploying the application code, making them ideal for managing configuration across different environments (development, staging, production). The settings are automatically encrypted at rest and overridden for the specific App Service slot when using deployment slots.

Answer

Azure App Configuration service

Answer

ARM template parameters

Answer

Azure Key Vault references in App Service

Question 18

You are developing a mobile app backend using Azure Functions. The app allows users to upload profile pictures. The pictures are stored in Azure Blob Storage and the metadata (user ID, blob URL, upload timestamp) is stored in Azure SQL Database. You need to implement a process that automatically generates a thumbnail for each uploaded picture and updates the metadata with the thumbnail URL. The thumbnail generation is CPU-intensive and may take up to 30 seconds per image. The solution should be serverless and cost-effective. Which combination of Azure services should you use?

Accepted Answer

Use an Azure Blob Storage trigger to invoke an Azure Function that generates the thumbnail and updates Azure SQL Database.. Azure Blob Storage triggers are designed to invoke an Azure Function automatically when a new blob is created, which is ideal for this serverless, event-driven workflow. The function can generate the thumbnail (even with a 30-second CPU-intensive task, as Azure Functions support up to 10-minute execution on the Premium plan) and then update the Azure SQL Database with the thumbnail URL, all without managing infrastructure.

Answer

Use an Azure VM with a scheduled task to poll for new blobs and generate thumbnails.

Answer

Use an Azure Queue Storage trigger to invoke an Azure Function that processes the image and updates Azure SQL Database.

Answer

Use Azure Event Grid to trigger an Azure Logic App that generates the thumbnail and updates Azure SQL Database.

Question 19

You deploy a containerized background job to Azure Container Instances (ACI). The job should automatically restart only if it exits with a non-zero exit code (i.e., crashes). You want to minimize costs. Which restart policy should you configure?

Accepted Answer

OnFailure. The OnFailure restart policy is correct because it restarts the container only when it exits with a non-zero exit code, indicating a crash or error. This matches the requirement to automatically restart only on failure while minimizing costs, as it avoids unnecessary restarts on successful completions.

Answer

Always

Answer

Never

Answer

Retry

Question 20

You are migrating an on-premises .NET Framework app to Azure. The app uses Windows authentication and requires persistent storage. You want to minimize rework. Which Azure compute service should you choose?

Accepted Answer

Azure App Service on Windows. Azure App Service on Windows (D) supports Windows authentication natively via its built-in integration with Azure Active Directory and on-premises Active Directory through Azure AD Domain Services or hybrid identity setups. It also provides persistent storage options like Azure Files or blob storage attached to the web app, minimizing rework by allowing the existing .NET Framework app to run with minimal code changes in a Platform-as-a-Service (PaaS) environment.

Answer

Azure Spring Apps

Answer

Azure Functions

Answer

Azure Container Instances