AZ-204 Practice Exam 51 — 20 Questions

Question 1

You are developing an ASP.NET Core application that needs to access Azure Key Vault to retrieve secrets. You have enabled a managed identity for the App Service. Which Azure SDK class should you use to authenticate to Key Vault?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

DefaultAzureCredential. DefaultAzureCredential is the recommended approach because it provides a chained authentication mechanism that attempts multiple credential types in order, including ManagedIdentityCredential, EnvironmentCredential, and others. When running in an Azure App Service with a managed identity enabled, DefaultAzureCredential will automatically use the managed identity to authenticate to Key Vault, making it the most flexible and future-proof choice for this scenario.

Answer

ClientSecretCredential

Answer

ManagedIdentityCredential

Answer

InteractiveBrowserCredential

Question 2

You are developing an application that stores user-uploaded profile pictures in Azure Blob Storage. Users frequently access these pictures for the first 7 days after upload, then rarely. To minimize costs, you need to automatically delete pictures that are older than 30 days. Which Azure Storage feature should you use to achieve this?

Accepted Answer

Lifecycle management policy. Azure Blob Storage lifecycle management policies allow you to automatically tier or expire blobs based on age. By defining a rule that deletes blobs after 30 days from creation, you can remove old profile pictures without manual intervention, directly minimizing storage costs.

Answer

Blob snapshots

Answer

Change feed

Answer

Soft delete

Question 3

You are developing a web application that relies on a third-party weather API. The API has a rate limit of 10 requests per second per API key. You need to ensure your application never exceeds this limit and also caches responses for 10 minutes to reduce call frequency. Which combination of Azure services should you implement?

Accepted Answer

Azure API Management with rate-limit and caching policies.. Azure API Management (APIM) provides built-in rate-limit and caching policies that directly address the requirements: the `rate-limit` policy enforces a per-key request quota (e.g., 10 calls/second), and the `cache-store`/`cache-lookup` policies cache responses for a configurable duration (e.g., 10 minutes). This eliminates the need for custom throttling logic or external caching services, making it the most straightforward and maintainable solution.

Answer

Azure Functions with Durable Functions to throttle calls and a static in-memory cache.

Answer

Azure Logic Apps with a retry policy and a cache using Azure Redis Cache.

Answer

Azure Traffic Manager to distribute requests and Azure Front Door for caching.

Question 4

You are building an Azure Logic App that processes orders. When an order is placed, the Logic App must send a message to an Azure Service Bus queue. The queue is secured using managed identity. Which connector action should you use?

Accepted Answer

Service Bus connector with managed identity authentication. The Service Bus connector with managed identity authentication is correct because it allows the Logic App to authenticate to the Azure Service Bus queue using an Microsoft Entra ID managed identity, eliminating the need for secrets or SAS tokens. This is the recommended approach for securing Service Bus resources when using Azure services, as it leverages Azure RBAC for fine-grained access control and aligns with the principle of least privilege.

Answer

HTTP action with SAS token

Answer

Azure Functions connector

Answer

Event Grid connector

Question 5

Your AKS cluster runs a microservices application. You need to expose an internal service only within the cluster virtual network. Which Service type should you use?

Accepted Answer

Internal LoadBalancer (with annotation). An Internal LoadBalancer with the `service.beta.kubernetes.io/azure-load-balancer-internal: "true"` annotation creates a load balancer with a private IP address from the cluster's virtual network, making the service accessible only within that VNet. This is the correct choice for exposing an internal service exclusively within the AKS cluster virtual network.

Answer

NodePort

Answer

LoadBalancer

Answer

ClusterIP

Question 6

You are developing a background job that runs every hour on Azure App Service. The job must be resilient to restarts and should not affect the web app's performance. Which technology should you use?

Accepted Answer

WebJobs (triggered). WebJobs (triggered) are designed specifically for running background tasks on Azure App Service. They run as separate processes from the web app, ensuring they do not affect the web app's performance, and they are resilient to restarts because the Azure WebJobs SDK automatically handles restart and retry logic. This makes them the ideal choice for a scheduled hourly job that must survive App Service restarts.

Answer

A background thread in the web application

Answer

Azure Logic Apps

Answer

Azure Functions (Consumption plan)

Question 7

You are implementing an Azure Durable Functions application that processes orders. The function must call three external APIs (payment gateway, inventory system, and shipping calculator) in parallel, then aggregate the results once all three have completed. Which Durable Functions pattern should you use?

Accepted Answer

Fan-out/Fan-in. The Fan-out/Fan-in pattern is designed exactly for this scenario: it triggers multiple function tasks in parallel (fan-out) and then aggregates their results once all complete (fan-in). In Durable Functions, this is implemented using `CallActivityAsync` in a loop with `Task.WhenAll` to wait for all parallel activities to finish, allowing the orchestrator to collect and process the combined results.

Answer

Function chaining

Answer

Monitor

Answer

Human interaction

Question 8

You are monitoring an ASP.NET Core web API with Application Insights. You want to view the SQL queries being executed, including the command text and duration, in the Application Insights portal. Which actions must you take? (Select all that apply.) (Choose 2.)

Accepted Answer

Install the `Microsoft.ApplicationInsights.DependencyCollector` NuGet package.. The `Microsoft.ApplicationInsights.DependencyCollector` NuGet package is required to automatically collect dependency telemetry, including SQL Server calls. Without this package, Application Insights will not capture SQL dependency data at all. Option C is correct because even with the dependency collector installed, SQL command text is not collected by default for security reasons; you must explicitly set `EnableSqlCommandTextInstrumentation` to `true` in the `DependencyTrackingTelemetryModule` configuration to view the actual SQL queries and their duration in the portal.

Answer

Install the `Microsoft.ApplicationInsights.Profiler.AspNetCore` NuGet package.

Answer

Enable adaptive sampling to ensure all SQL queries are collected.

Question 9

You are developing a solution that requires multiple Azure virtual machines to access the same set of files concurrently. The files are updated frequently and must be accessible with low latency. You need to choose a shared storage solution that integrates with Microsoft Entra ID (Microsoft Entra ID) for authentication. Which Azure storage solution should you use?

Accepted Answer

Azure Files shares.. Azure Files shares provide fully managed SMB and NFS file shares that can be accessed concurrently by multiple Azure VMs with low latency. They support identity-based authentication using Microsoft Entra ID (formerly Azure AD) over SMB, enabling granular access control via RBAC and NTFS ACLs. This makes Azure Files the correct choice for a shared, frequently updated file store requiring Entra ID integration.

Answer

Azure Blob Storage with a private container.

Answer

Azure NetApp Files.

Answer

Azure Disk Storage with shared disks.

Question 10

You are developing a web app that runs on Azure App Service. The app needs to read a connection string from configuration. Which is the recommended approach to access the connection string in the app code?

Accepted Answer

Use Environment.GetEnvironmentVariable("SQLAZURECONNSTR_MyConn"). Azure App Service automatically injects connection strings defined in the 'Connection strings' blade as environment variables with a specific prefix. For SQL Azure, the prefix is 'SQLAZURECONNSTR_', so the environment variable name becomes 'SQLAZURECONNSTR_MyConn'. Using Environment.GetEnvironmentVariable is the recommended way to retrieve these values at runtime, as they are securely stored and managed by the platform.

Answer

Call an HTTP endpoint on the App Service instance

Answer

Use Azure.Identity.DefaultAzureCredential and Key Vault

Answer

Read from appsettings.json using IConfiguration

Question 11

A developer is implementing least-privilege storage access. The application runs on Azure App Service and must avoid stored credentials. Which design should be used?

Accepted Answer

Enable managed identity and grant least-privilege access to the target resource. Managed identity in Azure App Service allows the application to authenticate to Azure Storage without storing any credentials in code or configuration. By enabling a system-assigned or user-assigned managed identity, the app obtains an Microsoft Entra ID token automatically, which is used to access the storage resource. Granting the managed identity only the required permissions (e.g., 'Storage Blob Data Reader' for read-only access) enforces least-privilege access, eliminating the need for stored secrets.

Answer

Use a shared administrator account

Answer

Disable authentication for the target resource

Answer

Store a client secret in source control

Question 12

You are developing an application that uses Azure Queue Storage. The application processes messages and must ensure that a message is not lost if the processing fails. Which visibility timeout setting should you use?

Accepted Answer

Set a short visibility timeout like 30 seconds. Setting a short visibility timeout (e.g., 30 seconds) ensures that if message processing fails, the message becomes visible again quickly for retry, preventing permanent loss. Azure Queue Storage uses a visibility timeout to hide a dequeued message from other consumers; if the processing fails and the message is not deleted, it reappears after the timeout expires. A short timeout balances retry speed with processing time, avoiding indefinite hiding that could lead to message loss if the consumer crashes.

Answer

Set visibility timeout to 1 hour

Answer

Set visibility timeout to infinite

Answer

Set visibility timeout to 0 seconds

Question 13

Which TWO options are valid ways to scale an Azure Functions app running on the Premium plan?

Accepted Answer

Configure pre-warmed instances to reduce cold start.. Pre-warmed instances in the Premium plan reduce cold start latency by keeping a specified number of instances always loaded and ready to handle requests. Option C is correct because the Premium plan allows you to set both minimum and maximum instance counts, giving you control over baseline capacity and scaling limits. These settings are configured in the function app's scale settings and are not available in the Consumption plan.

Answer

Disable scale-to-zero to keep instances always warm.

Answer

Scale out based on the length of a storage queue.

Answer

Set the scale mode to 'Automatic' with no configuration.

Question 14

You need to monitor the CPU and memory usage of an Azure Virtual Machine (VM) over the last 30 days. Which Azure service should you use?

Accepted Answer

Azure Monitor Metrics. Azure Monitor Metrics is the correct service because it collects and stores numerical performance data (such as CPU and memory utilization) from Azure resources, including VMs, at near-real-time intervals and retains it for up to 93 days. This allows you to query and visualize metrics over the last 30 days using the Azure portal, REST API, or CLI, directly meeting the requirement without additional configuration.

Answer

Azure Service Health

Answer

Azure Advisor

Answer

Azure Log Analytics

Question 15

You are running a containerized application on Azure Container Instances. The application requires a custom DNS server. How should you configure this?

Accepted Answer

Use the 'dnsConfig' property in the container group configuration. Azure Container Instances (ACI) supports custom DNS server configuration at the container group level via the 'dnsConfig' property in the deployment JSON or ARM template. This property allows you to specify an array of DNS server IP addresses and optional search domains, which are applied to all containers within the group. Environment variables cannot override DNS resolution, and the Dockerfile's DNS settings are ignored by ACI because the container group's network stack is managed by the Azure platform.

Answer

Set the DNS server in the container's environment variables

Answer

Set the restart policy to 'Always'

Answer

Configure the DNS server in the Dockerfile

Question 16

You deploy a container to Azure Container Instances (ACI). The container runs a background job that should automatically restart only if it exits with a non-zero exit code (i.e., crashes). You want to minimize costs. Which restart policy should you configure?

Accepted Answer

Set restart policy to OnFailure and use a single container group. The OnFailure restart policy restarts the container only when it exits with a non-zero exit code, which matches the requirement to restart only on crashes. This policy minimizes costs because the container does not run continuously when it exits successfully, unlike the Always policy. Using a single container group is the simplest and most cost-effective deployment for a single background job.

Answer

Set restart policy to Always and use a private container registry

Answer

Set restart policy to Never and use a public container registry

Answer

Set restart policy to OnFailure and deploy in a virtual network

Question 17

An App Service application uses a staging deployment slot connected to a staging database and a production slot connected to a production database. Both use an app setting called 'DbConnectionString'. After a slot swap, the production slot starts using the staging database connection string. What configuration change prevents this?

Accepted Answer

Mark the 'DbConnectionString' app setting as a deployment slot setting (sticky) so it remains bound to its slot across all swaps. Marking the 'DbConnectionString' app setting as a deployment slot setting (also called a sticky setting) ensures that the setting remains bound to its slot during a swap. When a slot swap occurs, Azure App Service automatically moves non-sticky app settings and connection strings to the target slot, but sticky settings are excluded from the swap and stay with their original slot. This prevents the production slot from accidentally picking up the staging database connection string after the swap.

Answer

Store the connection string in Azure Key Vault and reference it via a Key Vault reference in both slots

Answer

Use different app setting names for each slot (e.g., 'StagingDbConnectionString' and 'ProductionDbConnectionString') and swap code manually

Answer

Disable slot swaps and use a CI/CD pipeline to deploy directly to production instead

Question 18

Your company develops a REST API for a global e-commerce platform that stores product images in Azure Blob Storage. The API uses shared access signatures (SAS) to grant temporary read access to the images. The security team requires that SAS tokens be generated using a user delegation key derived from the application's Microsoft Entra ID credentials, not from the storage account key. Additionally, the SAS must be scoped to a specific container and have a maximum validity of 1 hour. You need to implement the SAS generation in the API using the Azure Storage SDK for .NET. The application authenticates with Microsoft Entra ID using a managed identity assigned to the Azure App Service hosting the API. Which approach should you use?

Accepted Answer

Use the managed identity credentials to create a BlobServiceClient, then call GetUserDelegationKeyAsync, then create a BlobSasBuilder with the key and call ToSasQueryParameters.. It follows the required pattern for generating a user delegation SAS: authenticate with managed identity via a BlobServiceClient, call GetUserDelegationKeyAsync to obtain a key derived from Microsoft Entra ID (not the storage account key), then use BlobSasBuilder with that key to call ToSasQueryParameters, which produces a SAS token query string scoped to a specific container with a 1-hour validity. This meets the security team's requirement of using Entra ID credentials and avoids exposing the storage account key.

Answer

Use the managed identity credentials to create a BlobServiceClient, then call GetUserDelegationKeyAsync to get a key, and then call BlobSasBuilder.GenerateSas using the key.

Answer

Use the StorageSharedKeyCredential with the storage account key to create a BlobSasBuilder and generate a SAS token.

Answer

Use DefaultAzureCredential to authenticate, then call GenerateUserDelegationSas on the BlobContainerClient.

Question 19

Your company uses Azure File Sync to sync on-premises file shares to Azure Files. You notice that some files are not syncing to Azure. You need to diagnose the issue with minimal administrative effort. Which Azure service should you use?

Accepted Answer

Azure Monitor. Azure Monitor provides the Azure File Sync monitoring blade, which offers pre-built metrics and alerts for sync health, file-level errors, and sync session status. This allows you to diagnose sync failures with minimal administrative effort by directly viewing sync group health, per-server sync status, and error codes without needing to configure additional log queries or workbooks.

Answer

Microsoft Sentinel

Answer

Azure Storage Insights

Answer

Azure Log Analytics

Question 20

You are developing a solution that must encrypt data before it is sent to Azure Blob Storage. You need to manage encryption keys yourself using Azure Key Vault. Which approach should you use?

Accepted Answer

Implement client-side encryption using the Azure Storage SDK and store the encryption keys in Azure Key Vault.. Client-side encryption with the Azure Storage SDK allows you to encrypt data before it leaves your application, ensuring it is never transmitted or stored in plaintext. By storing the encryption keys in Azure Key Vault, you maintain full control over key management, which aligns with the requirement to manage encryption keys yourself.

Answer

Use Azure Information Protection to encrypt the files.

Answer

Use Azure Disk Encryption for the storage account.

Answer

Enable Azure Storage Service Encryption (SSE) with customer-managed keys.