AZ-204 Practice Exam 52 — 20 Questions

Question 1

An API receives JWT access tokens from Microsoft Entra ID. Which two token properties should the API validate before accepting a request? The team wants the control to be enforceable during normal operations.

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Issuer and signature are valid for the trusted tenant. Validating the issuer and signature ensures the JWT was issued by the trusted Microsoft Entra ID tenant and has not been tampered with. The issuer claim (iss) must match the tenant-specific issuer URL (e.g., https://login.microsoftonline.com/{tenant-id}/v2.0), and the signature must be verified using the public keys from the OpenID Connect metadata endpoint. This is a fundamental security requirement for any API that accepts tokens from Entra ID.

Answer

The user's display name is present

Answer

The token was sent in a query string

Question 2

A developer exposes several backend APIs through Azure API Management. Clients must be throttled by subscription to protect the backend. What should be configured? The design must avoid adding custom operational scripts.

Accepted Answer

API Management rate-limit or quota policy. Azure API Management provides built-in rate-limit and quota policies that enforce throttling at the subscription level without requiring custom code. These policies allow you to define call rates (e.g., requests per second) or quotas (e.g., requests per month) per subscription key, directly protecting backend services from overuse.

Answer

Blob soft delete

Answer

Application Insights sampling

Answer

Private DNS zone only

Question 3

A company uses Azure Logic Apps to automate business processes. They need to call an external REST API that requires OAuth 2.0 client credentials grant. Which connector should they use with minimal configuration?

Accepted Answer

HTTP connector. The HTTP connector in Azure Logic Apps supports OAuth 2.0 client credentials grant natively with minimal configuration. You can directly set the authentication type to 'Active Directory OAuth' and provide the tenant ID, client ID, client secret, and audience/resource URI. This avoids the need for custom code or additional connectors.

Answer

HTTP + Swagger connector

Answer

Azure Functions connector

Answer

Custom connector

Question 4

You are implementing a serverless function in Azure Functions that processes messages from an Azure Storage Queue. The function must ensure that each message is processed at least once and that processing failures are retried up to 5 times. After 5 failed attempts, the message should be moved to a poison queue. What should you configure?

Accepted Answer

Use the default queue poison message handling with 'maxDequeueCount' set to 5.. Azure Functions' Storage Queue trigger automatically implements a poison queue mechanism. By setting the 'maxDequeueCount' property in the host.json file to 5, the runtime will dequeue a message up to 5 times; after the 5th failed attempt, the message is automatically moved to the associated poison queue (named {originalqueue}-poison). This ensures at-least-once processing and retry handling without custom code.

Answer

Set the message time-to-live (TTL) to 5.

Answer

Implement a custom retry policy in the function code with a maximum of 5 retries.

Answer

Set the visibility timeout to 5 minutes.

Question 5

You are a developer for a healthcare company that stores patient diagnostic images in Azure Blob Storage. The images are uploaded by medical devices and must be retained for 7 years due to regulatory requirements. After 7 years, the data must be permanently deleted. The images are accessed infrequently after the first month. You need to design a storage lifecycle management policy to minimize costs while meeting compliance. The storage account uses general-purpose v2 with LRS. The container is named 'diagnostics'. Which of the following policies should you implement?

Accepted Answer

Move blobs to Cool tier after 30 days, move to Archive tier after 90 days, and delete after 7 years.. It aligns with the access pattern: blobs are moved to the Cool tier after 30 days (when infrequent access begins), then to the Archive tier after 90 days for long-term, low-cost storage, and finally deleted after 7 years to meet regulatory retention and deletion requirements. This minimizes costs by using the most cost-effective tier for each stage of the data lifecycle.

Answer

Move blobs to Cool tier after 30 days, and delete after 30 days.

Answer

Move blobs to Archive tier immediately after upload, and delete after 7 years.

Answer

Move blobs to Cool tier after 1 year, and delete after 7 years.

Question 6

Which THREE of the following are true about Azure Blob Storage access tiers? (Choose THREE.)

Accepted Answer

You can change the access tier of a blob after it has been uploaded.. Azure Blob Storage allows you to change the access tier of a blob after it has been uploaded, either by directly setting the tier on the blob or using lifecycle management policies. This flexibility enables you to optimize storage costs based on changing access patterns without re-uploading data.

Answer

Hot tier has lower storage cost than Cool tier.

Answer

Archive tier allows immediate read access to blobs.

Question 7

You deploy an Azure Function app that uses the Premium plan. The function processes messages from an Azure Service Bus queue. Under heavy load, some messages are processed multiple times. You need to ensure exactly-once processing without losing messages. What should you do?

Accepted Answer

Enable duplicate detection on the Service Bus queue.. Enabling duplicate detection on the Service Bus queue ensures that the Service Bus broker itself discards duplicate messages based on a user-defined time window. This prevents the function from processing the same message multiple times, even if the function host restarts or the message is re-delivered due to transient failures. Duplicate detection works by tracking the MessageId of each message and ignoring any subsequent message with the same MessageId within the detection window.

Answer

Use Peek-Lock mode instead of Receive and Delete.

Answer

Set the maxDeliveryCount to 1 on the queue.

Answer

Reduce the batch size in the function host.json.

Question 8

You develop an application that stores large binary files (up to 1 GB) in Azure Blob Storage. The application must minimize latency when reading these files from different geographic regions. The files are updated infrequently (once per month) and must be read-only for the application. You need to configure the storage account for optimal read performance and cost. What should you use?

Accepted Answer

Use Azure Blob Storage with read-access geo-redundant storage (RA-GRS) and serve reads from the secondary region.. Read-access geo-redundant storage (RA-GRS) provides a secondary read-only endpoint in a paired region, allowing the application to read from the closest region to minimize latency. Since files are updated infrequently (once per month) and are read-only, RA-GRS offers cost-effective geo-distributed read performance without the premium cost of CDN or Premium Blob Storage.

Answer

Use Azure Blob Storage with Premium Block Blob Storage and enable geo-replication.

Answer

Use Azure Blob Storage with a Content Delivery Network (CDN) endpoint.

Answer

Use Azure Files with a Premium tier and geo-redundant storage.

Question 9

A Blob-triggered function processing audit documents fires multiple times for the same blob after retries. What should the function design include?

Accepted Answer

Idempotent processing based on blob name/version or metadata. Azure Blob Storage triggers can cause multiple function invocations for the same blob due to retries, internal queue processing, or event-driven architecture guarantees. Designing the function to be idempotent—using the blob name, version, or metadata as a unique identifier—ensures that duplicate processing does not produce side effects like duplicate audit records or data corruption. This aligns with the at-least-once delivery semantics of Azure Blob Storage triggers.

Answer

Disable all logging

Answer

Assume each event is delivered exactly once

Answer

Use public blob access

Question 10

You are building an API that needs to send notifications to multiple subscribers. Each subscriber has a different callback URL, and you need to ensure each notification is sent exactly once and retried on failure. Which Azure service should you use?

Accepted Answer

Azure Service Bus.. Azure Service Bus is the correct choice because it supports exactly-once delivery through duplicate detection and can fan out notifications to multiple subscribers using topics and subscriptions. It also provides built-in retry logic on failures. While Event Grid offers at-least-once delivery, only Service Bus can guarantee exactly-once when properly configured.

Answer

Azure Event Grid.

Answer

Azure Notification Hubs.

Answer

Azure Queue Storage.

Question 11

You are using Azure File Sync to sync on-premises file shares to Azure. You need to ensure that files are cached locally on the on-premises server for fast access, but only the most frequently accessed files should be cached. What should you configure?

Accepted Answer

Enable cloud tiering on the server endpoint and set a volume free space policy.. Cloud tiering on an Azure File Sync server endpoint allows you to keep only frequently accessed files cached locally while infrequently accessed files are tiered to Azure. By setting a volume free space policy, you control how much local disk space is reserved for frequently accessed files, ensuring that only the most accessed files remain cached. This directly meets the requirement of caching only the most frequently accessed files locally.

Answer

Configure a caching rule using Azure File Sync's built-in cache size limit.

Answer

Configure a sync group with a custom server endpoint that filters files by last access time.

Answer

Use the Invoke-AzStorageSyncFileRecall cmdlet to recall files on demand.

Question 12

You are monitoring an e-commerce application with Application Insights. You need to analyze all exceptions that occurred in the last 24 hours, grouped by the exception type. You also need to include the URL where each exception was triggered and the number of times each type occurred. Which Log Analytics Kusto query should you use?

Accepted Answer

exceptions | where timestamp > ago(24h) | join kind=inner requests on operation_Id | extend exceptionType = tostring(innermostType) | summarize Count=count() by exceptionType, url. It uses the `exceptions` table to filter exceptions from the last 24 hours, joins with the `requests` table on `operation_Id` to correlate each exception with the request URL, and then summarizes the count by exception type (extracted from `innermostType`) and URL. This meets all requirements: grouping by exception type, including the URL, and counting occurrences.

Answer

exceptions | where timestamp > ago(24h) | extend exceptionType = tostring(customDimensions.['ExceptionType']) | summarize Count=count() by exceptionType, url = tostring(customDimensions.['Url'])

Answer

requests | where timestamp > ago(24h) and success == false | extend exceptionType = tostring(resultCode) | summarize Count=count() by exceptionType, url

Answer

exceptions | where timestamp > ago(24h) | extend exceptionType = tostring(innermostType) | summarize Count=count() by exceptionType

Question 13

You are designing a solution that reads messages from an Azure Service Bus queue and processes them using an Azure Function. The function must process messages in order and ensure no duplicate processing. Which configuration should you use?

Accepted Answer

Enable sessions on the queue and use peek-lock mode with automatic complete on success. Enabling sessions on a Service Bus queue guarantees message ordering within a session, and using peek-lock mode with automatic complete ensures exactly-once processing by locking the message during processing and only completing it upon success. This combination prevents duplicate processing and maintains order, which is essential for sequential message handling in Azure Functions.

Answer

Use auto-forwarding to a dead-letter queue on failure

Answer

Partition the queue and use multiple functions to process each partition in order

Answer

Use receive and delete mode to ensure each message is processed only once

Question 14

A single-page app signs in users with Microsoft Entra ID and calls a protected API. The app cannot safely keep a client secret. Which OAuth flow should be used?

Accepted Answer

Authorization code flow with PKCE. The authorization code flow with PKCE (Proof Key for Code Exchange) is the recommended OAuth flow for single-page apps that cannot securely store a client secret. PKCE ensures that even if the authorization code is intercepted, it cannot be exchanged for tokens without the original code verifier, mitigating the risk of code injection attacks. This flow aligns with Microsoft's best practices for native and browser-based applications using Microsoft Entra ID.

Answer

Implicit flow

Answer

Client credentials flow

Answer

Resource owner password credentials flow

Question 15

You need to analyze all exceptions that occurred in the last 24 hours from an application monitored by Application Insights. You want to group them by exception type, and for each type show the URL where it occurred and the count. Which Log Analytics Kusto query should you use?

Accepted Answer

exceptions | where timestamp > ago(24h) | summarize count() by type, url. The query filters exceptions from the last 24 hours using `timestamp > ago(24h)`, groups them by `type` (exception type) and `url` (the URL where the exception occurred), and then counts occurrences per group with `summarize count()`. This directly matches the requirement to show, for each exception type, the URL and the count.

Answer

exceptions | where timestamp > ago(24h) | summarize count() by type, cloud_RoleInstance

Answer

exceptions | where timestamp > ago(24h) | summarize count() by type, operation_Name

Answer

exceptions | where timestamp > ago(24h) | summarize count() by type

Question 16

An application calls a Service Bus topic through HTTP. The developer must implement retries without overwhelming the remote system during partial outages. Which retry pattern is best?

Accepted Answer

Exponential backoff with jitter and a maximum retry limit. Exponential backoff with jitter and a maximum retry limit is the best pattern because it progressively increases the delay between retries, preventing the client from overwhelming the Service Bus topic during partial outages. The jitter randomizes the delay to avoid thundering herd problems, while the maximum retry limit ensures the system doesn't retry indefinitely, aligning with Azure's recommended retry guidance for HTTP-based calls to Service Bus.

Answer

Disable all timeout settings

Answer

Immediate infinite retries

Answer

Retry only after restarting the application

Question 17

You are designing a background job processing solution using Azure Batch. The job runs a large number of tasks that are CPU-intensive and require access to large input files stored in Azure Blob Storage. You need to minimize the time to process all tasks while controlling costs. Which THREE actions should you take?

Accepted Answer

Mount Azure Blob Storage as a file system using blobfuse to allow tasks to access files directly.. Mounting Azure Blob Storage as a file system using blobfuse allows tasks to directly access large input files without downloading them first, reducing data transfer time and eliminating local disk bottlenecks. This is critical for CPU-intensive tasks that need fast, concurrent access to shared data, minimizing overall processing time.

Answer

Set the task slots per VM to 1 to avoid contention.

Answer

Use a pool of small-sized VMs (e.g., Standard_A1_v2) to minimize cost per node.

Question 18

You have an App Service web app with Application Insights configured. You want to create an alert that fires when the server response time exceeds 2 seconds for a rolling 10-minute window. Which type of alert rule should you create?

Accepted Answer

Metric alert. Metric alerts in Azure Monitor evaluate resource-level performance counters at regular intervals, making them ideal for threshold-based conditions like server response time. Application Insights automatically collects server response time as a pre-aggregated metric, so a metric alert can check whether the average exceeds 2 seconds over a rolling 10-minute window without needing to query raw log data.

Answer

Log alert

Answer

Activity log alert

Answer

Smart detection alert

Question 19

An Azure Container Instance running a webhook processor requires a password at startup. The password must not be visible in the portal or container logs. What should be used?

Accepted Answer

Secure environment variable. Secure environment variables in Azure Container Instances are encrypted at rest and in transit, and they are not visible in the Azure portal or container logs. This ensures the password is available to the container at startup without exposing it through the portal interface or log output, meeting the security requirement.

Answer

Container command-line argument

Answer

Public blob containing the password

Answer

Plain environment variable

Question 20

Refer to the exhibit. An administrator runs this Azure CLI command. What is the result?

Accepted Answer

Assigns the Reader role to a service principal at the resource group scope. The Azure CLI command `az role assignment create --assignee --role Reader --resource-group ` assigns the Reader role to a service principal (identified by its object ID) at the specified resource group scope. The Reader role grants read-only access to resources within that resource group, which matches the command's parameters and the expected outcome.

Answer

Assigns the Contributor role to a service principal at the resource group scope

Answer

Assigns a managed identity to the resource group

Answer

Assigns the Reader role to a user at the subscription scope