AZ-204 Practice Exam 51 — 20 Questions

Question 1

An Azure Functions image resize worker must run for up to 30 minutes and uses a VNet integration feature. The team wants serverless scaling without managing virtual machines. Which hosting plan should be used? The design must avoid adding custom operational scripts.

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Premium plan. The Premium plan is correct because it supports VNet integration, allows execution durations up to 30 minutes (unlike the Consumption plan's 10-minute default), and provides serverless scaling without requiring you to manage virtual machines or add custom operational scripts. It is the only plan that combines these capabilities for a long-running, VNet-connected function.

Answer

App Service Free tier

Answer

Azure Batch pool

Answer

Consumption plan

Question 2

A developer needs to store session state for a web app that runs on multiple instances behind a load balancer. The state must be persisted across restarts. Which Azure service should they use?

Accepted Answer

Azure Cache for Redis. Azure Cache for Redis is the correct choice because it provides a high-performance, in-memory data store that supports session state persistence across multiple web app instances behind a load balancer. It offers built-in session state providers for ASP.NET and ASP.NET Core, ensuring state is preserved across restarts and scale-out scenarios with low-latency access.

Answer

Azure Table Storage

Answer

Azure SQL Database

Answer

Azure Blob Storage

Question 3

A production API needs proactive alerting for failed dependency calls. Which two elements are required for a useful Azure Monitor alert?

Accepted Answer

A signal or metric/log query that detects the condition. Azure Monitor alerts require a signal—either a metric, log query, or activity log event—to define the condition that triggers the alert. For failed dependency calls, you would use a log query (e.g., from Application Insights) or a custom metric to detect when the dependency failure rate exceeds a threshold. Without a signal, the alert has no basis to evaluate or fire.

Answer

A manually exported CSV report

Answer

A public IP address on the app

Question 4

Your team monitors Azure Functions with Application Insights. After a recent deployment, cold start latency increased. Which feature should you enable to mitigate this?

Accepted Answer

Migrate from Consumption plan to Premium plan. Cold start latency occurs when a function app is idle and needs to be loaded from scratch. The Consumption plan can cause cold starts because it scales to zero when idle. Migrating to the Premium plan eliminates cold starts by keeping instances warm, as it provides pre-warmed workers and always-on instances, reducing latency after deployment.

Answer

Set FUNCTIONS_WORKER_RUNTIME to 'dotnet-isolated'

Answer

Enable Azure Monitor alerts on function execution count

Answer

Enable Always On in the function app configuration

Question 5

You are developing an application that writes telemetry data to Azure Table Storage. Each telemetry event is about 5 KB in size, and the application writes up to 10,000 events per second. The data is queried by device ID and timestamp range. What is the most efficient partitioning strategy to maximize write throughput and query performance?

Accepted Answer

Use device ID as the partition key and timestamp as the row key.. Using device ID as the partition key distributes writes across multiple partitions, avoiding throttling from a single partition's scalability limit (up to 20,000 operations per second per partition). Using timestamp as the row key enables efficient range queries for a specific device within a time window, leveraging the table's natural sort order on row key.

Answer

Use timestamp as the partition key and device ID as the row key.

Answer

Use device type as the partition key and timestamp as the row key.

Answer

Use a single partition key for all events and use timestamp as the row key.

Question 6

A company uses Azure Functions with an HTTP trigger and Azure Cosmos DB. They need to securely store connection strings for Cosmos DB and rotate them automatically every 90 days. Which service should they use?

Accepted Answer

Azure Key Vault. Azure Key Vault is the correct service because it provides a centralized, secure store for secrets like connection strings and supports automatic rotation policies. By storing the Cosmos DB connection string in Key Vault and configuring a rotation policy (e.g., every 90 days), the Azure Function can retrieve the latest secret at runtime via a Key Vault reference in its application settings, ensuring the secret is rotated without code changes or downtime.

Answer

Managed Identity

Answer

Azure App Configuration

Answer

Microsoft Entra ID

Question 7

You are implementing a custom API that calls a downstream API secured with OAuth 2.0. The downstream API requires a client credentials grant flow. You need to securely store the client secret and obtain an access token. What should you use?

Accepted Answer

Azure Key Vault to store the secret and MSAL to obtain the token. Azure Key Vault provides secure, auditable storage for client secrets, and MSAL (Microsoft Authentication Library) is the recommended SDK for implementing OAuth 2.0 client credentials grant flows in Azure. MSAL handles token acquisition, caching, and renewal, while Key Vault ensures the secret is never exposed in code or configuration files.

Answer

Azure App Configuration to store the secret and the Azure Identity SDK to obtain the token

Answer

Managed identity to access the downstream API directly

Answer

Azure Certificate Manager to store the secret and the HttpClient to obtain the token

Question 8

Images are uploaded to a high-volume Blob Storage account. An Azure Function with a Blob Storage trigger processes each new image. The team has observed processing delays of up to 10 minutes on accounts with large numbers of containers and blobs. They need processing to start within seconds of upload. What should the developer change?

Accepted Answer

Replace the Blob Storage trigger with an Event Grid trigger and create a Blob Created event subscription that targets the Function's endpoint. Event Grid provides near-real-time event delivery (typically under 1 second) for Blob Created events, eliminating the polling latency inherent in the Blob Storage trigger. The Blob Storage trigger polls Azure Storage logs for new blobs, which can cause delays of up to 10 minutes in high-volume accounts with many containers and blobs. By switching to an Event Grid trigger, the function is invoked directly via HTTP webhook as soon as the blob is created, meeting the requirement for processing to start within seconds.

Answer

Switch to a Timer trigger that runs every 30 seconds and lists newly created blobs via the SDK

Answer

Use a Queue Storage trigger and write blob metadata to the queue from the upload client

Answer

Move the Function to a Premium plan, which uses a dedicated worker and eliminates Blob trigger polling delays

Question 9

Refer to the exhibit. You run the Azure CLI command shown. What is the result?

Accepted Answer

Stores a secret named MySecret with the value in the vault. The Azure CLI command `az keyvault secret set --vault-name MyVault --name MySecret --value 'MySecretValue'` is used to create or update a secret in an Azure Key Vault. The `--name` parameter specifies the secret's name, and `--value` provides the secret's value. Since the secret does not exist, it creates a new secret named MySecret with the specified value, making option C correct.

Answer

Creates a key named MySecret in the vault

Answer

Deletes the secret named MySecret from the vault

Answer

Creates a certificate named MySecret in the vault

Question 10

A system receives high-volume event notifications from Azure resources and routes them to serverless handlers. Events are lightweight and should use native event routing. Which service should be used? The design must avoid adding custom operational scripts.

Accepted Answer

Azure Event Grid. Azure Event Grid is a fully managed event routing service that uses a publish-subscribe model to deliver lightweight, high-volume events from Azure resources to registered handlers like Azure Functions or webhooks. It supports native event routing without requiring custom polling scripts or infrastructure, making it ideal for serverless event-driven architectures.

Answer

Azure DNS

Answer

Azure Files

Answer

Azure Service Bus queue

Question 11

Which TWO Azure services can be used to store and manage secrets, such as API keys and connection strings? (Choose 2)

Accepted Answer

Azure Key Vault. Azure Key Vault is the dedicated service for securely storing and managing secrets, keys, and certificates. Managed Identity, on the other hand, is an authentication mechanism that provides an identity for Azure resources to access secrets stored elsewhere, such as Key Vault. It does not store secrets itself. Therefore, only Azure Key Vault qualifies as a service for storing and managing secrets among the given options.

Answer

Azure App Configuration

Answer

Azure Storage

Answer

Azure SQL Database

Answer

Azure Managed Identity

Question 12

A developer needs to run a Kusto query against application request data to identify 95th percentile latency by operation. Where should the query be run?

Accepted Answer

Logs in Application Insights or the associated Log Analytics workspace. Application Insights stores application request data, including latency metrics, and supports Kusto queries via its Logs blade. The associated Log Analytics workspace also provides the same query capabilities, making it the correct location to run a Kusto query for 95th percentile latency by operation.

Answer

Microsoft Entra audit logs

Answer

Azure Key Vault diagnostic settings

Answer

Azure Resource Graph only

Question 13

A company has an Azure Storage account that stores sensitive data. They need to ensure that all access to the storage account is secured using Microsoft Entra ID authentication and that no storage account keys are used. Which configuration should be applied to enforce this?

Accepted Answer

Disable shared key access. Disabling shared key access (Option B) is the correct configuration because it explicitly blocks all authentication using storage account keys (both primary and secondary), forcing all requests to use Microsoft Entra ID (formerly Azure AD) for authorization. This ensures that only identities with appropriate RBAC roles (e.g., Storage Blob Data Owner) can access the storage account, meeting the requirement to eliminate key-based access entirely.

Answer

Enable firewall rules

Answer

Enable advanced threat protection

Answer

Enable soft delete

Question 14

Your company stores sensitive financial documents in Azure Blob Storage. You need to ensure that only authorized users can access the blobs, and you must avoid exposing storage account keys. You want to generate time-limited URLs that grant access to specific blobs. What should you use?

Accepted Answer

Shared Access Signatures (SAS). Shared Access Signatures (SAS) are the correct choice because they allow you to delegate access to specific blobs with granular permissions (read, write, delete) and enforce a time-limited validity period, all without exposing the storage account keys. This directly meets the requirement of generating time-limited URLs for authorized access while keeping the account keys secure.

Answer

Storage account access keys

Answer

Azure role-based access control (RBAC)

Answer

Managed identities for Azure resources

Question 15

You are using Azure Logic Apps to orchestrate a workflow that calls a third-party API. The API occasionally returns HTTP 429 (Too Many Requests). How should you handle this to ensure the workflow completes successfully without manual intervention?

Accepted Answer

Configure a retry policy on the HTTP action with exponential backoff.. Azure Logic Apps supports configuring a retry policy on HTTP actions, and using exponential backoff is the standard approach to handle HTTP 429 responses. The retry policy automatically waits for increasing intervals between attempts, respecting the 'Retry-After' header if present, which allows the third-party API to recover from rate limiting without manual intervention.

Answer

Increase the timeout value for the HTTP request.

Answer

Change the concurrency setting to 1 to avoid multiple requests.

Answer

Use a webhook action instead of HTTP.

Question 16

Avanade is developing a .NET Core console application that runs on an Azure VM. The application needs to read a secret from Azure Key Vault. The VM has a system-assigned managed identity enabled. The managed identity has been granted 'Get' and 'List' permissions on the Key Vault secrets. The code uses the Azure.Identity and Azure.Security.KeyVault.Secrets NuGet packages. Which code snippet should the developer use to authenticate to Key Vault?

Accepted Answer

var client = new SecretClient(new Uri(keyVaultUrl), new DefaultAzureCredential());. DefaultAzureCredential attempts multiple authentication sources in order, including EnvironmentCredential, ManagedIdentityCredential, and others. Since the VM has a system-assigned managed identity enabled and the code runs in that environment, DefaultAzureCredential will automatically fall through to ManagedIdentityCredential and authenticate using the managed identity's token endpoint. This provides the most flexible and recommended approach for Azure SDK authentication.

Answer

var client = new SecretClient(new Uri(keyVaultUrl), new EnvironmentCredential());

Answer

var client = new SecretClient(new Uri(keyVaultUrl), new ManagedIdentityCredential());

Answer

var client = new SecretClient(new Uri(keyVaultUrl), new ClientSecretCredential(tenantId, clientId, clientSecret));

Question 17

A developer is building an app that uses Azure Cognitive Services Text Analytics. The app needs to detect the language of text input. Which Azure SDK method should be called?

Accepted Answer

DetectLanguage. The correct method is `DetectLanguage` because the Azure Cognitive Services Text Analytics API provides a dedicated operation for identifying the language of input text. This method returns the detected language along with a confidence score, making it the appropriate choice for the requirement of detecting language from text input.

Answer

ExtractKeyPhrases

Answer

AnalyzeSentiment

Answer

RecognizeEntities

Question 18

You are implementing an Azure Durable Functions orchestration. The orchestration calls several activity functions that may fail transiently. You need to retry an activity up to 3 times with a 5-second delay, doubling the delay each time (exponential backoff). Which method should you use to call the activity?

Accepted Answer

CallActivityWithRetryAsync with RetryOptions(maxAttempts: 3, firstRetryInterval: TimeSpan.FromSeconds(5), backoffCoefficient: 2). `CallActivityWithRetryAsync` is the built-in method in Durable Functions for calling activity functions with automatic retry policies, including exponential backoff. The `RetryOptions` object allows you to specify `maxAttempts` (3), `firstRetryInterval` (5 seconds), and `backoffCoefficient` (2) to double the delay each time, exactly matching the requirement without custom code.

Answer

CallActivityAsync with a try-catch loop that implements retry logic

Answer

Use a timer trigger to schedule retries after failure

Answer

Set the activity function's retry policy in the function.json file

Question 19

Your Azure Function app uses an Event Hub trigger. Under high load, some events are processed multiple times. You need to ensure exactly-once processing without losing events. What should you implement?

Accepted Answer

Make the function idempotent. Making the function idempotent ensures that even if the Event Hub trigger delivers the same event multiple times (which can happen under high load due to at-least-once delivery semantics), the function's side effects are safe to repeat. Idempotency is the only reliable way to achieve exactly-once processing in a distributed system where the trigger itself does not guarantee deduplication.

Answer

Use Azure Queue Storage instead

Answer

Enable checkpointing

Answer

Increase the batch size

Question 20

An application uses Azure Application Insights for monitoring. You need to write a query to analyze the number of failed requests and exceptions over the past hour. Which query language should you use?

Accepted Answer

Kusto Query Language (KQL). Azure Application Insights stores telemetry data in a Log Analytics workspace, which is queried using Kusto Query Language (KQL). KQL is the native query language for Azure Data Explorer and is specifically designed for time-series analysis, filtering, and aggregation of log data. To analyze failed requests and exceptions over the past hour, you would use KQL operators like `where`, `summarize`, and `bin` to filter by timestamp and count events.

Answer

SQL

Answer

PowerShell

Answer

Azure CLI