AZ-204 Practice Exam 52 — 20 Questions

Question 1

Refer to the exhibit. You run the Azure CLI command shown for an Azure Function app. What is the effect of this setting?

Accepted Answer

The function app runs from a deployment package in Azure Storage.. The `--run-from-package` flag in the Azure CLI command `az functionapp config appsettings set` sets the `WEBSITE_RUN_FROM_PACKAGE` app setting to `1`. This configures the function app to run from a deployment package (a .zip file) stored in Azure Blob Storage, which improves cold-start performance and ensures all files are consistent across instances. Option D correctly identifies this behavior.

Answer

The function app uses the latest runtime version.

Answer

Remote debugging is enabled for the function app.

Answer

The function app scales out to multiple instances.

Question 2

You are deploying a containerized application to Azure Container Instances. The application requires writing temporary files to a local filesystem. You need to ensure that the files persist if the container restarts. What should you do?

Accepted Answer

Mount an Azure Files share as a volume in the container group.. Azure Container Instances (ACI) supports mounting Azure Files shares as volumes. When a container restarts, its writable layer is ephemeral and lost, but an Azure Files share persists independently. By mounting the share, temporary files written to the mount point survive container restarts, meeting the persistence requirement.

Answer

Use the container's writable layer to store files.

Answer

Use Azure Blob Storage and mount it as a volume.

Answer

Configure a Docker volume in the container image.

Question 3

You have a multi-tenant application that uses Azure AD (Microsoft Entra ID) for authentication. You want to allow only specific tenants to access your app. What is the recommended approach?

Accepted Answer

In the application code, validate the 'tid' claim against a list of allowed tenant IDs.. The 'tid' claim in the Microsoft Entra ID-issued token uniquely identifies the tenant. By validating this claim against a hardcoded list of allowed tenant IDs in your application code, you can enforce multi-tenant access control without relying on Microsoft Entra ID tenant-level restrictions or issuer URL validation, which can be less precise.

Answer

Configure the app manifest to require user assignment and assign users from allowed tenants.

Answer

Validate the 'iss' claim to ensure it matches one of your allowed tenant issuer URLs.

Answer

Use Azure AD tenant restrictions to block all tenants except the allowed ones.

Question 4

A company stores secrets in Azure Key Vault. Developers need to retrieve secrets from a web app without storing connection strings in code. Which authentication method should the web app use?

Accepted Answer

Enable a managed identity for the web app. Managed identities for Azure resources provide an automatically managed identity in Microsoft Entra ID, allowing the web app to authenticate to Key Vault without any credentials in code. The web app obtains an Microsoft Entra ID access token directly from the Azure Instance Metadata Service (IMDS) endpoint, which Key Vault accepts. This eliminates the need to store connection strings, client secrets, or certificates in the application.

Answer

Register a service principal and use a client secret

Answer

Use a shared access signature (SAS) token

Answer

Use a certificate thumbprint in the app settings

Question 5

You develop an Azure Functions app that processes images triggered by blob uploads. You need to ensure the function can process images in parallel and handle high upload volumes without missing events. Which trigger and plan combination is recommended?

Accepted Answer

Event Grid trigger on Premium plan. The Event Grid trigger on a Premium plan is recommended because Event Grid provides reliable, high-throughput event delivery with built-in retry and dead-lettering, ensuring no blob upload events are missed. The Premium plan offers dedicated instances and VNET connectivity, which avoids cold starts and allows parallel processing of multiple images concurrently, unlike the Consumption plan which has scaling limitations and potential for event loss under high volume.

Answer

Blob Storage trigger on Consumption plan

Answer

Event Grid trigger on Consumption plan

Answer

Blob Storage trigger on Premium plan

Question 6

You are deploying a web application to Azure App Service. The application needs to read configuration settings that vary by deployment environment (development, staging, production). You want to minimize application changes and leverage Azure services. What should you use?

Accepted Answer

Use Azure App Service application settings.. Azure App Service application settings are the correct choice because they are natively supported by the App Service platform, allowing you to define key-value pairs that are injected as environment variables at runtime. This approach requires no application code changes, as the settings are automatically available via standard configuration APIs (e.g., `Environment.GetEnvironmentVariable` in .NET or `process.env` in Node.js), and you can configure different values per deployment slot (e.g., development, staging, production) without redeploying the application.

Answer

Use Azure Key Vault secrets for configuration values.

Answer

Use Azure DevOps variable groups and inject them at build time.

Answer

Use Azure App Configuration with feature flags.

Question 7

You need to monitor the performance of an Azure App Service web app. You want to track the number of HTTP 500 errors over the last hour. Which Azure Monitor metric should you use?

Accepted Answer

Http5xx. The Http5xx metric in Azure Monitor tracks the count of HTTP 500-level server error responses returned by your App Service. Since the question specifically asks for the number of HTTP 500 errors over the last hour, this metric directly provides that count without any aggregation or filtering needed.

Answer

Data In

Answer

Average Response Time

Answer

Requests

Question 8

You are deploying an Azure Functions app using ARM template. The exhibit shows a portion of the template. You notice that the AzureWebJobsStorage connection string includes the account key directly. What is the MOST important security concern?

Accepted Answer

The storage account key is exposed in the template, which could be compromised.. Embedding the storage account key directly in an ARM template exposes a long-lived secret in plaintext. If the template is stored in source control, shared, or logged, the key can be compromised, granting an attacker full access to the storage account. This violates the principle of least privilege and security best practices for infrastructure as code.

Answer

The FUNCTIONS_WORKER_RUNTIME is set to dotnet-isolated, which is outdated.

Answer

The storage account name is hardcoded in the connection string.

Answer

The connection string does not use HTTPS.

Question 9

A company uses Azure Functions to process messages from Azure Service Bus. The function currently uses the Consumption plan. They notice that during high load, messages are processed slowly due to scaling latency. Which change would improve throughput most?

Accepted Answer

Switch to the Premium plan. The Premium plan for Azure Functions provides pre-warmed instances and faster scaling, eliminating the cold start and scaling latency inherent in the Consumption plan. This directly addresses the bottleneck during high load by ensuring that new instances are allocated instantly, thereby improving message processing throughput from Service Bus.

Answer

Set the maximum instance count to 20

Answer

Increase the function's batch size to 100

Answer

Enable Service Bus sessions

Question 10

Twenty Azure Functions across different teams all need read access to the same Azure Cosmos DB account. The security team wants to revoke or modify this access for all twenty functions at once without visiting each Function App individually. What managed identity design satisfies this requirement?

Accepted Answer

Create one user-assigned managed identity, attach it to all twenty Function Apps, and grant it the Cosmos DB Built-in Data Reader role. A single user-assigned managed identity can be created once and then attached to all twenty Function Apps. Granting that identity the Cosmos DB Built-in Data Reader role at the Cosmos DB account scope means that revoking or modifying the role assignment centrally affects all functions simultaneously, without needing to visit each app individually.

Answer

Enable a system-assigned managed identity on each Function App and grant each identity the Cosmos DB Built-in Data Reader role

Answer

Create a service principal, store its client secret in Key Vault, and reference the secret from all twenty Function Apps via Key Vault references

Answer

Store the Cosmos DB connection string in Azure App Configuration and reference it from all twenty Function Apps

Question 11

Your Azure Functions app (running on the Consumption plan) processes messages from an Azure Storage queue. Occasionally, the function fails due to a timeout after 5 minutes. You need to increase the maximum execution time without changing the plan. What should you do?

Accepted Answer

Set the functionTimeout property in host.json to 10 minutes. On the Consumption plan, the default function timeout is 5 minutes, but it can be extended up to 10 minutes by setting the functionTimeout property in host.json. This is the only way to increase the timeout without changing the hosting plan. The setting applies to all functions in the app.

Answer

Migrate the function app to the Premium or Dedicated plan

Answer

Use Durable Functions to split the work

Answer

Increase the visibility timeout of the queue message

Question 12

You are building a solution that uploads large files (up to 100 GB) to Azure Blob Storage. Users frequently experience timeout errors when uploading files over slow network connections. Which approach should you use to maximize reliability?

Accepted Answer

Use the Azure Storage SDK to upload the file as a block blob with multiple parallel blocks and implement retry logic with exponential backoff.. Uploading a large file as a block blob with multiple parallel blocks maximizes throughput and reliability over slow networks. The Azure Storage SDK automatically splits the file into blocks (up to 100 MB each), uploads them concurrently, and implements retry logic with exponential backoff to handle transient failures. This approach is specifically designed for large file uploads and mitigates timeout errors by keeping individual block transfers small and resumable.

Answer

Upload the file as a page blob in 512-byte chunks.

Answer

Increase the client-side timeout value to 10 minutes.

Answer

Use AzCopy with the /Z parameter to enable checkpointing.

Question 13

You need to run a batch job every night that processes data from Azure Blob Storage and writes results to Azure SQL Database. The job may run for up to 2 hours. Which Azure service should you use?

Accepted Answer

Azure Container Instances.. Azure Container Instances (ACI) is the correct choice because it allows you to run a containerized batch job on-demand without managing underlying infrastructure. The job's duration of up to 2 hours fits well within ACI's default timeout of 60 minutes (configurable up to 24 hours), and you can trigger it nightly via a scheduler like Azure Logic Apps or a timer-triggered Azure Function. ACI provides fast startup, per-second billing, and direct access to Azure Blob Storage and SQL Database via connection strings or managed identities.

Answer

Azure Logic Apps.

Answer

Azure Batch.

Answer

Azure Functions (Consumption plan).

Question 14

You need to upload a large file (10 GB) to Azure Blob Storage with the ability to pause and resume the upload. Which approach should you use?

Accepted Answer

Use the Azure Storage SDK to upload block blobs in parallel. Uploading a large file (10 GB) to Azure Blob Storage with pause/resume capability requires breaking the file into blocks and uploading them in parallel using the Azure Storage SDK. The SDK supports block blob operations, allowing you to track progress, retry failed blocks, and resume from the last committed block. A single Put Blob operation cannot handle files larger than 5 GB, and neither the Azure Portal nor AzCopy with /SyncCopy provides programmatic pause/resume control.

Answer

Use a single Put Blob operation

Answer

Use the Azure Portal to upload the file

Answer

Use AzCopy with the /SyncCopy parameter

Question 15

You are debugging a performance issue in a live web application monitored by Application Insights. You need to see real-time metrics such as request rate, response times, and any exceptions as they occur, without waiting for the usual telemetry pipeline. Which Application Insights feature should you use?

Accepted Answer

Live Metrics Stream. Live Metrics Stream (option B) is the correct feature because it provides real-time, low-latency telemetry directly from the Application Insights SDK, bypassing the usual ingestion pipeline. This allows you to monitor request rate, response times, and exceptions as they occur, which is exactly what the scenario requires for debugging a live performance issue without waiting for data to be processed.

Answer

Application Insights Analytics (Log Analytics)

Answer

Metrics Explorer

Answer

Application Insights Profiler

Question 16

You are using Azure CLI to upload a blob using your Azure AD credentials (--auth-mode login). The command fails with an authorization error. What is the most likely cause?

Accepted Answer

The user does not have the 'Storage Blob Data Contributor' role on the storage account. When using `--auth-mode login` with Azure CLI, the operation relies on Microsoft Entra ID role-based access control (RBAC). The user must be assigned a built-in role like 'Storage Blob Data Contributor' or 'Storage Blob Data Owner' on the storage account to authorize blob uploads. Without this role, the request fails with an authorization error because Microsoft Entra ID has no permissions to grant access to the blob data plane.

Answer

The Azure CLI version is outdated

Answer

The storage account key is not provided

Answer

The container name does not exist

Question 17

A company uses Azure Logic Apps to integrate with a third-party SaaS application. The Logic App must send an HTTP request to the SaaS API and handle pagination. Which connector should be used?

Accepted Answer

HTTP. The HTTP connector is the correct choice because it allows the Logic App to send a raw HTTP request to any REST API and handle pagination manually by inspecting response headers (e.g., 'nextLink') or body properties. Unlike other connectors, it provides full control over request/response cycles, enabling custom pagination logic without relying on a predefined API schema.

Answer

API Connection

Answer

HTTP + Swagger

Answer

HTTP Webhook

Question 18

You are using Azure API Management to expose a legacy SOAP API as a RESTful API. The SOAP API has complex XML schemas. You need to transform the SOAP response to JSON. Which policy should you use?

Accepted Answer

set-body. The `set-body` policy is correct because it allows you to replace the body of the SOAP response with a JSON representation. In Azure API Management, you can use the `set-body` policy with a Liquid template or a .NET expression to transform the incoming XML SOAP response into JSON, effectively converting the complex XML schemas to a RESTful JSON output.

Answer

transform-body

Answer

return-response

Answer

convert-to-json

Question 19

You are using Azure Cognitive Search to index documents stored in Azure Blob Storage. The indexer is failing with the error 'Data source credentials are invalid.' You have verified that the connection string for the storage account is correct. What is the most likely cause?

Accepted Answer

The storage account is behind a firewall and the Cognitive Search service IP is not allowed.. When a storage account is protected by a firewall, Azure Cognitive Search's indexer must be granted explicit network access. Even if the connection string is correct, the indexer's outbound requests will be blocked unless the storage account's firewall rules include the IP address or subnet of the Cognitive Search service. This is a common misconfiguration that results in 'Data source credentials are invalid' errors despite valid credentials.

Answer

The Cognitive Search service is in a different region than the storage account.

Answer

The Cognitive Search service's admin key is missing.

Answer

The indexer configuration is missing the storage account key.

Question 20

You need to call a third-party REST API from your Azure Function app. The API requires an API key in the header. Where should you store the API key to keep it secure?

Accepted Answer

Azure Key Vault. Azure Key Vault is the correct choice because it provides a centralized, secure store for secrets like API keys, with access control via Microsoft Entra ID and automatic rotation capabilities. The Function app can securely retrieve the key at runtime using a managed identity, avoiding hardcoding or exposing the secret in configuration files or environment variables.

Answer

Environment variable in the hosting plan

Answer

Connection string in the Function app

Answer

App settings in the Function app configuration