AZ-204 Practice Exam 51 — 20 Questions

Question 1

You are developing a solution that stores user-uploaded profile pictures. Users upload pictures that are then displayed on their profile page. After 30 days, if the user hasn't logged in, the system moves the picture to cold storage. You need to choose the initial access tier for the container to optimize cost and performance for frequently accessed pictures. Which tier should you use?

Accepted Answer

Hot. The Hot tier is the correct initial access tier because the profile pictures are frequently accessed immediately after upload (e.g., displayed on profile pages). The Hot tier is optimized for high-frequency read/write operations with the lowest latency, making it cost-effective for data that is accessed often. After 30 days of inactivity, the system moves the picture to cold storage, so the initial tier should prioritize performance for active data, not long-term archival cost savings.

Answer

Cool

Answer

Archive

Answer

Premium

Question 5

You are developing a .NET Core application that stores session state data. The data is infrequently updated but must be read quickly for every user request. You need a serverless, globally distributed storage solution with low latency reads. Which Azure storage solution should you use?

Accepted Answer

Azure Cosmos DB with SQL API. Azure Cosmos DB with SQL API is the correct choice because it provides a globally distributed, serverless database service with single-digit millisecond read latency at any scale, making it ideal for infrequently updated session state that must be read quickly for every user request. Its multi-region replication ensures low-latency reads from any location, and the SQL API offers a familiar query interface for .NET Core applications.

Answer

Azure Table Storage

Answer

Azure Redis Cache

Answer

Azure Blob Storage

Question 6

An application needs to upload large thumbnail metadata to Blob Storage reliably over unstable networks. Which upload approach should be used?

Accepted Answer

Block blob staged block upload with commit. Block blob staged block upload with commit is the correct approach because it allows uploading large thumbnails in smaller, independent blocks that can be retried individually if a network failure occurs. This method uses the Put Block and Put Block List REST APIs, enabling reliable uploads over unstable networks by committing only successfully uploaded blocks. It is specifically designed for large files and provides fine-grained control over upload progress and error recovery.

Answer

Page blob only

Answer

Append blob only

Answer

Table Storage batch operation

Question 7

Arrange the steps to create and use a shared access signature (SAS) for an Azure Storage blob in the correct order.

Question 8

You are developing a solution that requires multiple Azure virtual machines to access the same set of files concurrently. The files are updated frequently and must be accessible with low latency. You need to choose a shared storage solution that integrates with Microsoft Entra ID (Microsoft Entra ID) for authentication. Which Azure storage solution should you use?

Accepted Answer

Azure Files shares.. Azure Files shares provide fully managed SMB and NFS file shares that can be accessed concurrently by multiple Azure VMs with low latency. They support identity-based authentication using Microsoft Entra ID (formerly Azure AD) over SMB, enabling granular access control via RBAC and NTFS ACLs. This makes Azure Files the correct choice for a shared, frequently updated file store requiring Entra ID integration.

Answer

Azure Blob Storage with a private container.

Answer

Azure NetApp Files.

Answer

Azure Disk Storage with shared disks.

Question 9

You need to store small binary blobs (average 50 KB) that are accessed very frequently for a short period, then never accessed again. The total volume is high. Which storage tier is most cost-effective for the initial upload?

Accepted Answer

Hot. The Hot tier is the most cost-effective for the initial upload because it is optimized for frequent access and low latency, and for small blobs (average 50 KB) that are accessed very frequently for a short period, the per-GB storage cost is higher than Cool or Cold, but the access cost (per-operation charges) is significantly lower. Since the blobs are never accessed again after the short period, the high access frequency during that period makes Hot the cheapest option when considering total cost (storage + access operations), as Cool/Cold tiers would incur much higher per-read operation costs that outweigh their lower storage costs.

Answer

Cool

Answer

Cold

Answer

Archive

Question 10

A .NET app performs point reads from Cosmos DB by id and partition key. The team wants the lowest latency and best throughput efficiency. Which API call pattern should be used?

Accepted Answer

ReadItemAsync with id and partition key. ReadItemAsync with id and partition key is the most efficient API call pattern for point reads in Cosmos DB because it directly accesses the document using the partition key and item ID, requiring only a single request to the exact partition and replica. This avoids the overhead of querying multiple partitions or scanning all items, resulting in the lowest latency and best throughput efficiency, as it consumes the minimum request units (RUs) possible for a read operation.

Answer

Stored procedure scanning all items

Answer

Change feed processor

Answer

SELECT * query without partition key

Question 11

A queue-processing application stores work items in Azure Queue Storage. A worker crashes after receiving a message. What determines when the message becomes available for another worker?

Accepted Answer

Visibility timeout. When a worker receives a message from Azure Queue Storage, the message becomes invisible to other workers for a period defined by the visibility timeout. If the worker crashes without deleting or updating the message, the visibility timeout expires and the message reappears in the queue, making it available for another worker to process. This mechanism ensures at-least-once processing and prevents message loss on worker failure.

Answer

Blob lease duration

Answer

Message TTL only

Answer

Poison queue threshold only

Question 12

You have an Azure Storage account that contains a blob container with thousands of small files. You need to generate a URL that allows users to download a single file for a limited time without changing the storage account's firewall rules or requiring authentication. Which approach should you use?

Accepted Answer

Create a Shared Access Signature (SAS) for the specific blob with a time limit. A Shared Access Signature (SAS) for a specific blob provides delegated, time-limited access to that blob without requiring the storage account key or changing firewall rules. By generating a SAS token with a defined expiration time and attaching it to the blob URL, users can download the file directly via HTTPS while the storage account remains secured behind its firewall and authentication requirements.

Answer

Provide the storage account key to the user so they can authenticate

Answer

Assign the user an RBAC role (e.g., Storage Blob Data Reader) and have them authenticate via Microsoft Entra ID

Answer

Set the blob container's public access level to Blob (anonymous read access for blobs)

Question 13

An application stores sensor readings in Azure Table Storage. Each sensor produces thousands of readings per hour. Queries always filter by sensor ID and time range. A developer needs to choose the partition key and row key. Which design best balances query performance and write throughput?

Accepted Answer

Partition key: sensor ID; row key: ISO timestamp of the reading. Option A is correct because it uses sensor ID as the partition key, which ensures all readings for a given sensor are stored in the same partition, enabling efficient range queries by row key (timestamp). This design avoids hot partitions by distributing writes across different sensors, while the row key allows fast point lookups and range scans within a time window, balancing query performance and write throughput.

Answer

Partition key: a single constant ('all-sensors'); row key: sensor ID + timestamp

Answer

Partition key: timestamp (rounded to the hour); row key: sensor ID

Answer

Partition key: random GUID per reading; row key: timestamp

Question 14

A background worker retrieves a message from Azure Queue Storage and begins processing. The processing logic takes longer than the configured visibility timeout. Before the worker finishes, the timeout expires. What happens to the message?

Accepted Answer

The message becomes visible again in the queue and another worker can dequeue it. When the visibility timeout expires, the message becomes visible again in the queue because Azure Queue Storage uses a lease-based mechanism. The worker that dequeued the message loses its exclusive visibility lease, allowing another worker to dequeue and process the same message. This ensures at-least-once delivery semantics, preventing message loss if a worker fails or takes too long.

Answer

The message is permanently deleted because the worker already dequeued it

Answer

The message moves to a dead-letter queue after the visibility timeout expires

Answer

Processing continues uninterrupted; the visibility timeout applies only to the initial retrieval window

Question 15

Match each Azure messaging pattern to its description.

Question 16

You are developing an ASP.NET Core web API that authenticates users via Microsoft Entra ID. The application needs to authorize access to resources based on custom roles (e.g., 'Admin', 'Editor') that are not present in Microsoft Entra ID. The role mappings are dynamic and stored in an application database. How should you implement authorization?

Accepted Answer

Store the role mappings in an Azure SQL Database and use a custom authorization policy that queries the database after authentication.. Option B is correct because the custom roles are dynamic and stored in an application database, not in Microsoft Entra ID. After authentication, a custom authorization policy can query the database to retrieve the role mappings for the authenticated user and enforce access control. This approach decouples role management from the identity provider and supports dynamic role assignments.

Answer

Define the roles as Microsoft Entra ID app roles and include them in the token claims.

Answer

Include the roles as claims in the Microsoft Entra ID token by using a custom claim mapping policy.

Answer

Store the role mappings in the web.config file and read them at runtime.

Question 17

You are developing an ASP.NET Core web API that is hosted on Azure App Service. The API needs to read secrets from Azure Key Vault at startup. You want to avoid storing any credentials in the application code or configuration. Which approach should you use?

Accepted Answer

Enable the system-assigned managed identity for the App Service and configure Key Vault access policies to allow that identity.. Option B is correct because enabling a system-assigned managed identity for the App Service allows it to authenticate to Azure Key Vault without any credentials stored in code or configuration. The managed identity is automatically managed by Azure AD (now Microsoft Entra ID) and can be granted access to Key Vault secrets via access policies, eliminating the need for client IDs, client secrets, or connection strings.

Answer

Use the Key Vault SDK with a client ID and client secret stored in App Service application settings.

Answer

Use Microsoft Entra ID application roles to assign the App Service a role that allows reading secrets.

Answer

Store the Key Vault URL and a connection string with the secret in the application's app.config file.

Question 18

You are developing a web API hosted on Azure App Service. The API must authenticate requests using Microsoft Entra ID OAuth 2.0 bearer tokens. You want to validate the token in your ASP.NET Core API code with minimal custom validation logic. Which library should you use?

Accepted Answer

Microsoft.Identity.Web. Microsoft.Identity.Web is the correct choice because it provides a high-level, opinionated library that integrates directly with ASP.NET Core's authentication pipeline, handling token validation, scopes, and app roles with minimal custom code. It abstracts away the complexity of JWT bearer token validation against Microsoft Entra ID, including automatic OpenID Connect discovery and token signature verification.

Answer

Microsoft Authentication Library (MSAL)

Answer

Azure Identity client library

Answer

Azure Management Libraries for .NET

Question 19

A developer deleted a secret from Azure Key Vault with soft-delete and purge protection enabled (retention 90 days). After 50 days, the secret is needed again. What is the correct recovery method?

Accepted Answer

Recover the secret using Azure CLI 'az keyvault secret recover'. Option B is correct because Azure Key Vault with soft-delete and purge protection enabled retains deleted secrets for the specified retention period (90 days in this case). Since only 50 days have passed, the secret is still in a soft-deleted state and can be recovered using the 'az keyvault secret recover' command, which restores the secret to its original state without data loss.

Answer

Purge the secret and then restore from a backup

Answer

Recreate the secret with the same name

Answer

Use an Azure Resource Manager template to undelete the secret

Question 20

A developer accidentally deleted a secret from Azure Key Vault. Soft-delete is enabled with a retention period of 90 days. After 60 days, you attempt to recover the secret. What should you do?

Accepted Answer

Run the Azure CLI command: az keyvault secret recover. Option A is correct because when soft-delete is enabled on Azure Key Vault, deleted secrets are retained for the specified retention period (90 days in this case). Since only 60 days have passed, the secret is still in a soft-deleted state and can be recovered using the `az keyvault secret recover` command, which restores the secret to an active state.

Answer

Enable purge protection on the Key Vault first, then recover the secret.

Answer

Recover is not possible because the retention period of 90 days has not elapsed.

Answer

Run the Azure CLI command: az keyvault secret undelete