AZ-204 Practice Exam 53 — 20 Questions

Question 1

Your Azure Logic App needs to send emails using Microsoft Graph API on behalf of the signed-in user. The user is authenticated with Microsoft Entra ID. Which authentication method should you use in the Logic App?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use OAuth 2.0 authorization code flow with delegated permissions. The OAuth 2.0 authorization code flow with delegated permissions is correct because the Logic App needs to act on behalf of the signed-in user, not as an application itself. This flow allows the user to authenticate via Microsoft Entra ID and grant the Logic App delegated permissions to call Microsoft Graph API (e.g., to send emails as the user). The authorization code is exchanged for an access token that includes the user's context, enabling the API to enforce user-level permissions.

Answer

Use a system-assigned managed identity

Answer

Use client credentials flow with an app registration

Answer

Use Basic authentication with user credentials

Question 2

Refer to the exhibit. You are reviewing a role assignment for a managed identity. The JSON shows the role and scope. What access does this assignment grant?

Accepted Answer

Read, write, and delete access to blobs in container c1.. The role assignment grants the 'Storage Blob Data Contributor' role at the scope of container 'c1'. This role provides read, write, and delete access to blob data within that specific container, but not management operations on the storage account itself. Option C correctly identifies this level of access.

Answer

Full management access to the storage account.

Answer

Read access to all containers in the storage account.

Answer

Read-only access to blobs in container c1.

Question 3

You have an Azure Function app that needs to retrieve a secret from Azure Key Vault at runtime. You want to avoid storing any credentials in code or configuration. Which mechanism should you use?

Accepted Answer

Managed identity. Managed identity (B) is the correct mechanism because it allows the Azure Function app to authenticate to Azure Key Vault without storing any credentials in code or configuration. Azure automatically manages the identity and provides a token from Azure AD that the function can use to access the vault, eliminating the need for secrets or keys in the application.

Answer

Service principal with client secret

Answer

Access key

Answer

Shared access signature (SAS)

Question 4

You need to deploy a containerized application to Azure that must be restarted automatically if it crashes. The solution should minimize management overhead. Which compute service should you use?

Accepted Answer

Azure Container Instances. Azure Container Instances (ACI) is the correct choice because it provides a serverless container platform that automatically restarts containers if they crash when configured with a restart policy of 'Always' or 'OnFailure'. This minimizes management overhead by eliminating the need to manage underlying infrastructure, orchestration, or virtual machines, making it ideal for simple, stateless containerized applications that require automatic recovery.

Answer

Azure Functions

Answer

Azure Kubernetes Service (AKS)

Answer

Azure Virtual Machines

Question 5

A developer is configuring a web app to authenticate users with Microsoft Entra ID. The web app needs to call a downstream API that also uses Microsoft Entra ID for authentication. The developer must ensure that the web app can securely obtain access tokens for the downstream API. Which authentication flow should the developer implement?

Accepted Answer

OAuth 2.0 On-Behalf-Of flow. The OAuth 2.0 On-Behalf-Of (OBO) flow is the correct choice because the web app has already authenticated the user via Microsoft Entra ID and needs to exchange the user's access token for a new token to call the downstream API. This flow allows the web app to act on behalf of the authenticated user, maintaining the user's identity and consent context for the downstream API call.

Answer

OAuth 2.0 Client Credentials flow

Answer

OAuth 2.0 Implicit flow

Answer

OAuth 2.0 Authorization Code flow

Question 6

You are developing an ASP.NET Core application that needs to access Azure Key Vault to retrieve secrets. You have enabled a managed identity for the App Service. Which Azure SDK class should you use to authenticate to Key Vault?

Accepted Answer

DefaultAzureCredential. DefaultAzureCredential is the recommended approach because it provides a chained authentication mechanism that attempts multiple credential types in order, including ManagedIdentityCredential, EnvironmentCredential, and others. When running in an Azure App Service with a managed identity enabled, DefaultAzureCredential will automatically use the managed identity to authenticate to Key Vault, making it the most flexible and future-proof choice for this scenario.

Answer

ClientSecretCredential

Answer

ManagedIdentityCredential

Answer

InteractiveBrowserCredential

Question 7

A developer needs to deploy a web app that uses Azure SQL Database. They want to connect to the database using a connection string without storing it in code. Which feature of Azure App Service should they use?

Accepted Answer

Key Vault references. Key Vault references in Azure App Service allow the web app to securely retrieve secrets, such as connection strings, from Azure Key Vault. This is considered a best practice for managing sensitive information, as Key Vault provides centralized secret management, access control, auditing, and secret rotation capabilities. The App Service can resolve these references at runtime, injecting the secret into the application as an environment variable without storing it directly in the App Service configuration or code. Option C (Application settings) can store connection strings and are encrypted at rest, but Key Vault offers superior security and management features specifically for secrets. Option B (Environment variables) are not a persistent or managed solution for configuration in App Service. Option D (Azure App Configuration) is a centralized configuration service, but Key Vault is specifically designed for secrets and is more directly integrated for this purpose with App Service via references.

Answer

Environment variables

Answer

Application settings

Answer

Azure App Configuration

Question 8

You are building a solution that processes orders and needs to send order confirmation emails reliably. You choose Azure Logic Apps with a Gmail connector. However, you are concerned about hitting Gmail's sending limits. What should you do to handle this?

Accepted Answer

Configure a retry policy in the Logic App action to retry on failure with exponential backoff.. To handle Gmail's sending limits in Azure Logic Apps, you should configure a retry policy with exponential backoff on the Gmail connector action. This automatically retries failed sends due to rate limiting, spacing out retries to avoid further limits. Option A (Azure Queue Storage) is unnecessary because Logic Apps can handle retries natively. Option B (webhook) bypasses the connector but doesn't address limits inherently. Option C (increasing quota) is possible but not a built-in solution and may not be available. Thus, D is correct.

Answer

Use Azure Queue Storage to buffer messages and process them asynchronously.

Answer

Use a webhook instead of a connector to send emails directly via Gmail API.

Answer

Increase the Gmail API quota by contacting Google support.

Question 9

A company has an Azure App Service web app that reads from Azure Blob Storage. The app uses a connection string stored in app settings. Recently, the storage account key was rotated, and the app started throwing authentication errors. What should the developer do to resolve this issue without redeploying the app?

Accepted Answer

Update the connection string in the app settings to use the new key. Updating the connection string in the App Service app settings (e.g., via Azure portal or Azure CLI) automatically restarts the app, applying the new key without requiring a redeployment. Option A (managed identity) would require code changes and is not necessary if connection strings are acceptable. Option B (rotating the key again) does not fix the mismatch if the app retains the old key. Option D (restarting the app) alone does not update the stored connection string.

Answer

Change the app to use managed identity

Answer

Rotate the storage account key again

Answer

Restart the app service

Question 10

Which TWO are best practices for securing an Azure API Management instance?

Accepted Answer

Require subscription keys for all APIs. Correct answers: B and D. Requiring subscription keys helps secure APIs by enforcing a per-call authentication mechanism. OAuth 2.0 with Azure AD provides robust, token‑based authentication for API consumers. Option A (exposing the management endpoint) is insecure and should be restricted. Option C (rate limits) prevent resource exhaustion, not brute‑force attacks—that’s a different security control. Option E (sharing keys via email) is a security risk and not a best practice.

Answer

Expose the management endpoint publicly for easy configuration

Answer

Set rate limits to prevent brute force attacks

Answer

Share API keys with partners via email

Question 11

You are using Azure Cache for Redis to cache frequently accessed database query results. You need to ensure that the cache is updated automatically when the underlying data changes. Which pattern should you implement?

Accepted Answer

Cache-aside pattern with cache invalidation. The cache-aside (lazy loading) pattern is the most common approach for caching database queries. In this pattern, the application checks the cache first; on a cache miss, it loads data from the database and stores it in the cache with a TTL. To ensure the cache reflects data changes, the application invalidates (deletes) the cached entry whenever the underlying data is updated, so the next read fetches fresh data. This pattern is explicitly designed for scenarios like Azure Cache for Redis where automatic updates are needed. Option B (read-through) is similar but the cache itself loads data from the database; however, it does not handle cache invalidation on data changes automatically. Option C (event-driven invalidation using Azure Event Grid) is a valid pattern but is more complex and not the standard caching pattern; it requires additional infrastructure to detect changes and publish events. Option D (write-through) updates the cache synchronously on writes, but it does not address automatic updates when data changes outside the cache (e.g., direct database updates). Therefore, the cache-aside pattern with explicit invalidation is the correct choice for automatic cache updates.

Answer

Read-through pattern

Answer

Event-driven cache invalidation using Azure Event Grid

Answer

Write-through pattern

Question 12

An application publishes order events that multiple independent subscribers must process. Subscribers may be added later without changing the publisher. Which Azure messaging service should be used? The architecture review board prefers a managed Azure-native control.

Accepted Answer

Azure Service Bus topic. Azure Service Bus topics support a publish-subscribe pattern where multiple independent subscribers can process the same message. Subscribers can be added later without modifying the publisher, and each subscriber receives its own copy of the message through subscriptions. This matches the requirement for order events that must be processed by multiple independent subscribers.

Answer

Azure Blob Storage lifecycle policy

Answer

Azure Storage Queue

Answer

Azure Cache for Redis list only

Question 13

Which TWO permissions should be granted to an application's managed identity to allow it to read secrets from Azure Key Vault and use them to access Azure Storage?

Accepted Answer

Key Vault Secrets User role (includes get and list). To read secrets from Azure Key Vault, the Key Vault Secrets User role provides the necessary 'get' and 'list' permissions using the principle of least privilege. To access Azure Storage after retrieving a secret (e.g., a connection string), the Storage Blob Data Contributor role is required. Therefore, two distinct roles (D and E) satisfy the requirements. The Key Vault Secrets Officer role (B) would also allow reading secrets but grants excessive permissions beyond what is required for just reading, so it is not a least-privilege choice.

Answer

Key Vault Crypto User role

Answer

Key Vault Secrets Officer role (includes all operations)

Answer

Key Vault Reader role

Question 14

Coho Vineyard has an Azure Logic App that processes orders. The workflow must call a third-party API that uses Basic authentication. The credentials (username and password) must be stored securely in Azure Key Vault. The Logic App uses a system-assigned managed identity. The managed identity has been granted 'Get' permission on the Key Vault secrets. Which approach should the team use to pass the credentials to the third-party API?

Accepted Answer

Add a Key Vault connector step to retrieve the secret containing the password. Then use an HTTP connector with 'Basic' authentication type. In the authentication parameters, reference the secret for the password.. The correct approach is to add a Key Vault connector step to retrieve the secret containing the password, then use an HTTP connector with 'Basic' authentication type. In the authentication parameters, reference the secret for the password field. Option A is incorrect because Active Directory OAuth is not compatible with Basic authentication. Option B is incorrect because the third-party API does not support managed identity authentication. Option C is insecure as it stores credentials directly in the Logic App configuration. Option D is correct.

Answer

Use an HTTP connector with 'Active Directory OAuth' authentication. Provide the client ID and client secret.

Answer

Use managed identity authentication on the HTTP connector. The third-party API must support managed identity.

Answer

Store the username and password directly in the Logic App's connection settings for the HTTP connector.

Question 15

Your company has an Azure Kubernetes Service (AKS) cluster that hosts multiple microservices. You are tasked with deploying a new microservice that processes incoming HTTP requests and publishes messages to an Azure Service Bus topic. The microservice must scale based on the number of messages in the topic, and it must support graceful shutdown to complete in-flight requests. You need to choose the appropriate compute platform. The microservice is stateless and can be containerized. You want to minimize operational overhead and cost. The solution must automatically scale to zero when there are no messages. Which option should you choose?

Option A: Deploy the microservice as an Azure Function with a Service Bus trigger on the Consumption plan.
Option B: Deploy the microservice as a container in AKS with a Horizontal Pod Autoscaler based on Service Bus queue length.
Option C: Deploy the microservice as an Azure Container App with a Service Bus scale rule.
Option D: Deploy the microservice as an Azure App Service WebJob with continuous mode.

Accepted Answer

Deploy the microservice as an Azure Container App with a Service Bus scale rule.. Azure Container Apps (ACA) with a Service Bus scale rule is the correct choice because it provides event-driven scaling based on the number of messages in a Service Bus topic, can scale to zero when there are no messages, supports graceful shutdown via terminationGracePeriodSeconds, and minimizes operational overhead compared to AKS. ACA is a serverless container platform that abstracts Kubernetes complexity while still allowing containerized workloads, making it ideal for stateless microservices that need to scale on demand. Azure Functions with a Service Bus trigger also scales based on messages and can scale to zero, but it does not natively support containerization (unless using custom containers which adds complexity) and has less control over graceful shutdown. AKS requires managing a cluster and does not scale to zero. App Service WebJobs are not containerized and do not scale based on Service Bus metrics.

Answer

Deploy the microservice as an Azure Function with a Service Bus trigger on the Consumption plan.

Answer

AKS with HPA based on Service Bus queue length

Answer

Azure App Service WebJob with continuous mode

Question 16

You are developing an application that stores user-uploaded profile pictures in Azure Blob Storage. Users frequently access these pictures for the first 7 days after upload, then rarely. To minimize costs, you need to automatically delete pictures that are older than 30 days. Which Azure Storage feature should you use to achieve this?

Accepted Answer

Lifecycle management policy. Azure Blob Storage lifecycle management policies allow you to automatically tier or expire blobs based on age. By defining a rule that deletes blobs after 30 days from creation, you can remove old profile pictures without manual intervention, directly minimizing storage costs.

Answer

Blob snapshots

Answer

Change feed

Answer

Soft delete

Question 17

A long-running webhook processor must process thousands of independent files. The developer wants status tracking, checkpoints, and replay-safe orchestration. Which Azure Functions capability should be used?

Accepted Answer

Durable Functions orchestrator. Durable Functions orchestrator is correct because it provides built-in support for status tracking, checkpointing, and replay-safe orchestration via the Event Sourcing pattern. The orchestrator function automatically saves execution history to a storage table, enabling reliable resumption after crashes or restarts, which is essential for processing thousands of independent files with long-running workflows.

Answer

Blob lifecycle management

Answer

Timer trigger only

Answer

Azure Policy remediation

Question 18

Your company uses Azure Logic Apps to automate workflows. A workflow must call an external REST API that requires an API key in the header. You need to securely store the API key and reference it in the Logic App without exposing it in the workflow definition. What should you do?

Accepted Answer

Store the API key in Azure Key Vault and use the Key Vault connector to retrieve it dynamically in the Logic App.. Azure Key Vault provides a secure, centralized store for secrets like API keys, and the Logic App Key Vault connector retrieves the key at runtime without exposing it in the workflow definition. This approach ensures the secret is never stored in plain text within the Logic App's JSON definition or source control, aligning with Azure security best practices for managed identities and access policies.

Answer

Store the API key in plain text directly in the Logic App HTTP action header.

Answer

Store the API key in an App Service application setting and reference it using the 'appsetting' expression.

Answer

Create an Azure Function with the API key hardcoded as an environment variable and call it from the Logic App.

Question 19

You are developing a web application that relies on a third-party weather API. The API has a rate limit of 10 requests per second per API key. You need to ensure your application never exceeds this limit and also caches responses for 10 minutes to reduce call frequency. Which combination of Azure services should you implement?

Accepted Answer

Azure API Management with rate-limit and caching policies.. Azure API Management (APIM) provides built-in rate-limit and caching policies that directly address the requirements: the `rate-limit` policy enforces a per-key request quota (e.g., 10 calls/second), and the `cache-store`/`cache-lookup` policies cache responses for a configurable duration (e.g., 10 minutes). This eliminates the need for custom throttling logic or external caching services, making it the most straightforward and maintainable solution.

Answer

Azure Functions with Durable Functions to throttle calls and a static in-memory cache.

Answer

Azure Logic Apps with a retry policy and a cache using Azure Redis Cache.

Answer

Azure Traffic Manager to distribute requests and Azure Front Door for caching.

Question 20

You are building an Azure Logic App that processes orders. When an order is placed, the Logic App must send a message to an Azure Service Bus queue. The queue is secured using managed identity. Which connector action should you use?

Accepted Answer

Service Bus connector with managed identity authentication. The Service Bus connector with managed identity authentication is correct because it allows the Logic App to authenticate to the Azure Service Bus queue using an Azure AD managed identity, eliminating the need for secrets or SAS tokens. This is the recommended approach for securing Service Bus resources when using Azure services, as it leverages Azure RBAC for fine-grained access control and aligns with the principle of least privilege.

Answer

HTTP action with SAS token

Answer

Azure Functions connector

Answer

Event Grid connector