AZ-204 Practice Exam 53 — 20 Questions

Question 1

Your app uses Azure Key Vault to store secrets. You need to grant the app access to read secrets using managed identity. Which RBAC role should you assign to the app's managed identity?

Accepted Answer

Key Vault Secrets User. The Key Vault Secrets User role (D) is the correct RBAC role because it grants the managed identity permission to perform read operations on secrets, specifically 'Microsoft.KeyVault/vaults/secrets/read' and 'Microsoft.KeyVault/vaults/secrets/getSecret/action'. This aligns with the requirement to read secrets using managed identity without granting broader management or cryptographic key permissions.

Answer

Key Vault Crypto Officer

Answer

Key Vault Reader

Answer

Key Vault Contributor

Question 2

You are developing a solution that needs to retrieve secrets from Azure Key Vault. The solution will run as an Azure App Service managed identity. Which authentication method should you use?

Accepted Answer

DefaultAzureCredential. DefaultAzureCredential is the correct choice because it automatically chains multiple authentication sources, including managed identity, environment variables, and Visual Studio credentials. When running in an Azure App Service with a managed identity enabled, DefaultAzureCredential will first attempt to authenticate using the managed identity endpoint, making it the most seamless and recommended approach for this scenario.

Answer

SharedAccessSignatureCredential

Answer

InteractiveBrowserCredential

Answer

ClientSecretCredential

Question 3

You are developing an ASP.NET Core web API that authenticates users via Microsoft Entra ID. The API needs to call a downstream API (also secured by Microsoft Entra ID) on behalf of the signed-in user (On-Behalf-Of flow). You have already configured the web API to authenticate users with Microsoft.Identity.Web. How should you implement the token acquisition for the downstream API?

Accepted Answer

Inject `ITokenAcquisition` and call `GetAccessTokenForUserAsync` with the scopes for the downstream API. Microsoft.Identity.Web provides the `ITokenAcquisition` service specifically for ASP.NET Core applications to acquire tokens for downstream APIs using the OAuth 2.0 On-Behalf-Of flow. Calling `GetAccessTokenForUserAsync` with the required scopes handles the token exchange automatically, leveraging the incoming user token and client credentials configured in the app. This is the recommended approach when using Microsoft.Identity.Web, as it abstracts the complexity of the OBO flow and integrates seamlessly with the ASP.NET Core authentication pipeline.

Answer

Use ADAL.NET's `AcquireTokenOnBehalfOf` method

Answer

Use the `Azure.Identity` library with `DefaultAzureCredential` to acquire a token

Answer

Manually construct an HTTP POST to the Microsoft Entra ID token endpoint with the user access token and client credentials

Question 4

You are deploying a background processing job that reads messages from an Azure Storage Queue. The job must run on the same compute resources as the main web application and must not require additional deployment or monitoring overhead. Which solution should you use?

Accepted Answer

Add an Azure WebJob to the App Service that hosts the main application.. Azure WebJobs run in the same App Service plan as the main web application, sharing compute resources without requiring separate deployment or monitoring. A WebJob with a continuous trigger can read from an Azure Storage Queue using the QueueTrigger attribute, meeting the requirement of no additional overhead.

Answer

Deploy an Azure Function with a Queue trigger on the Consumption plan.

Answer

Create a separate Azure Container Instance to run a continuous job.

Answer

Use Azure Logic Apps with a recurrence trigger to poll the queue.

Question 5

Your application runs on Azure Kubernetes Service (AKS). It needs to access Azure Key Vault secrets. You want to avoid using a service principal. Which solution should you implement?

Accepted Answer

Deploy the Secrets Store CSI Driver with workload identity. The Secrets Store CSI Driver with workload identity allows your AKS pods to securely access Azure Key Vault secrets without managing a separate service principal. Workload identity uses Microsoft Entra ID pod-managed identities or federated identity credentials to authenticate directly to Key Vault, eliminating the need for explicit service principal credentials.

Answer

Mount secrets as a ConfigMap from Key Vault

Answer

Create a service principal and assign it to the AKS cluster

Answer

Use a Helm chart to inject secrets

Question 6

You are designing a solution to store large amounts of structured data that is accessed frequently and requires low-latency reads. The data must be globally distributed and support automatic failover. Which Azure storage solution should you recommend?

Accepted Answer

Azure Cosmos DB with multi-region writes and automatic failover.. Azure Cosmos DB with multi-region writes and automatic failover is the correct choice because it provides globally distributed, low-latency reads and writes with automatic failover at the database level. It supports multiple consistency models and guarantees single-digit millisecond read latencies, making it ideal for frequently accessed structured data that requires global distribution and high availability.

Answer

Azure Table Storage with geo-replication.

Answer

Azure SQL Database with active geo-replication and failover groups.

Answer

Azure Blob Storage with read-access geo-redundant storage (RA-GRS).

Question 7

A company deploys a microservices application on Azure Kubernetes Service (AKS). They need to automatically scale individual microservices based on custom metrics (e.g., queue depth). Which feature should they use?

Accepted Answer

Horizontal Pod Autoscaler. The Horizontal Pod Autoscaler (HPA) is the correct choice because it automatically scales the number of pod replicas in a deployment or replica set based on observed metrics, including custom metrics like queue depth. HPA queries the Kubernetes Metrics API, which can be extended with custom metrics adapters (e.g., Prometheus Adapter) to support application-specific metrics, enabling fine-grained scaling for each microservice.

Answer

Virtual Node

Answer

Vertical Pod Autoscaler

Answer

Cluster Autoscaler

Question 8

You are using Azure Logic Apps to integrate with a third-party CRM. The CRM API requires OAuth 2.0 authentication with a client secret. The secret must be stored securely and rotated automatically. What should you do?

Accepted Answer

Store the secret in Azure Key Vault and use a managed identity to access it. Azure Key Vault is the recommended service for storing secrets, and a managed identity allows the Logic App to authenticate to Key Vault without embedding credentials. The Logic App can then retrieve the client secret at runtime, and Key Vault supports automatic rotation via versioning and rotation policies. This satisfies both secure storage and automatic rotation requirements.

Answer

Use a system-assigned managed identity without storing the secret

Answer

Store the secret in the Logic App definition as a string parameter

Answer

Store the secret in Azure App Configuration with encryption

Question 9

You need to grant a user the ability to read and write blobs in a specific container for 24 hours. The solution must use delegated access without exposing the storage account key. What should you use?

Accepted Answer

User delegation shared access signature (SAS). A user delegation SAS is secured with Microsoft Entra ID credentials and is the only SAS type that uses delegated authorization without exposing the storage account key. It allows you to grant granular, time-limited access (e.g., 24 hours) to a specific container for read and write operations, meeting the requirement exactly.

Answer

Storage account access key

Answer

Account shared access signature (SAS)

Answer

Service shared access signature (SAS)

Question 10

You are developing a solution that uses Azure Functions to process events from Azure Event Grid. The function must handle events reliably. Which TWO options should you implement?

Accepted Answer

Enable retry policy on the Event Grid subscription.. Event Grid subscriptions support automatic retry policies that can be configured to retry event delivery on transient failures, ensuring reliable processing. Option D is correct because a dead-letter destination (e.g., a storage blob) captures events that cannot be delivered after exhausting retries, preventing data loss and enabling later analysis.

Answer

Use Durable Functions for orchestration.

Answer

Implement manual checkpointing in the function code.

Answer

Use a queue trigger instead of an Event Grid trigger.

Question 11

A Durable Functions workflow for a booking backend must call five independent activity functions and continue only after all results are available. Which pattern is appropriate?

Accepted Answer

Fan-out/fan-in. The fan-out/fan-in pattern is designed for scenarios where multiple independent tasks must execute in parallel, and the workflow must wait for all results before proceeding. In Durable Functions, this is implemented using `Task.WhenAll()` to fan out activity function calls and then aggregate their results, which matches the requirement of calling five independent activities and continuing only after all results are available.

Answer

Monitor pattern

Answer

Human interaction

Answer

Function chaining

Question 12

Refer to the exhibit. You run this KQL query in Azure Resource Graph Explorer. The query returns no results. What is the most likely reason?

Accepted Answer

The resource type is incorrect; it should be 'microsoft.insights/components' in lowercase.. The KQL query uses the resource type 'Microsoft.Insights/Components' with mixed case, but Azure Resource Graph Explorer requires resource types to be specified in all lowercase. The correct type is 'microsoft.insights/components'. When the case does not match, the query returns no results because Azure Resource Graph performs a case-sensitive match on the 'type' property.

Answer

The 'contains' operator is case-sensitive.

Answer

The query must specify a subscription filter.

Answer

The 'where' clause must use '== ' instead of '=='.

Question 13

You have an Azure Storage account configured as shown in the exhibit. You need to ensure that all traffic to the storage account uses HTTPS. Which Azure CLI command should you run next?

Accepted Answer

az storage account update --name mystorageaccount --resource-group myResourceGroup --https-only true. The `az storage account update` command with the `--https-only true` parameter enforces HTTPS for all traffic to the storage account by setting the `supportsHttpsTrafficOnly` property to true. This is the specific Azure CLI parameter that controls this setting, and it must be applied after account creation. The command directly meets the requirement to ensure all traffic uses HTTPS.

Answer

az storage account create --name mystorageaccount --resource-group myResourceGroup --https-only true

Answer

az storage account update --name mystorageaccount --resource-group myResourceGroup --secure-transfer-required true

Answer

az storage account update --name mystorageaccount --resource-group myResourceGroup --enable-https-traffic-only true

Question 14

Which THREE features of Azure API Management help enforce security policies for APIs? (Choose three.)

Accepted Answer

rate-limit policy. The rate-limit policy (A) is correct because it enforces security by throttling API calls to prevent abuse and denial-of-service attacks, limiting the number of requests within a specified time window per subscription or key. This protects backend services from being overwhelmed by excessive traffic, a core security requirement for API management.

Answer

xml-to-json policy

Answer

cache-lookup policy

Question 15

Which TWO actions can you perform using Azure Container Registry (ACR) tasks?

Accepted Answer

Schedule a task to patch base images. ACR Tasks support both scheduled and trigger-based workflows, so option A is correct: you can create a task with a cron schedule (az acr task create --schedule) to periodically rebuild and patch base images when upstream base layers change. Option B is also correct because ACR Tasks can be configured with a source trigger on a Git repository (az acr task create --context <git-repo> --source-trigger-enabled true) so that a commit automatically triggers a container image build. Option C is not an ACR Task action — importing images from another registry is done with the separate az acr import command, not a task. Option D is incorrect because ACR Tasks build and push images to a registry; deployment to AKS is handled by Kubernetes manifests, Helm, or GitOps tooling, not by ACR Tasks. Option E is incorrect because vulnerability scanning in ACR is provided by Microsoft Defender for Containers (or third-party integrations), not by ACR Tasks themselves.

Answer

Import images from another registry

Answer

Deploy images to AKS

Answer

Automatically scan images for vulnerabilities

Question 16

Fabrikam Inc. has an Azure Function app that processes image uploads. Each time a blob is added to a container in Azure Blob Storage, the function is triggered. The function resizes the image and stores the result in another container. Currently, the function uses an Azure Storage account connection string stored in application settings. The security team requires that no connection strings or access keys be stored in application settings. The function must use managed identity to access the storage account. The storage account is in the same subscription. Which action should the team take?

Accepted Answer

Enable system-assigned managed identity on the Function app. Assign the 'Storage Blob Data Contributor' role to the managed identity on the storage account. Remove the connection string from application settings. Update the code to use DefaultAzureCredential to authenticate to Blob Storage.. It uses a system-assigned managed identity, which is automatically tied to the Function app's lifecycle, and assigns the 'Storage Blob Data Contributor' role to that identity on the storage account. This eliminates the need for any connection strings or access keys in application settings. The code then uses DefaultAzureCredential, which automatically discovers and uses the managed identity when running in Azure, providing secure, passwordless authentication to Azure Blob Storage.

Answer

Generate a SAS token for the storage account and store it in Key Vault. Retrieve the SAS token at runtime and use it to create the BlobServiceClient.

Answer

Create a user-assigned managed identity, assign it to the Function app, and grant it 'Storage Blob Data Contributor' role. Store the client ID in app settings. Use ManagedIdentityCredential with the client ID in code.

Answer

Keep the connection string in app settings but encrypt it using Azure Key Vault. Use Key Vault references to retrieve it.

Question 17

External partners are given Shared Access Signatures to upload product images to a specific Blob Storage container named 'images'. A partner reports accidentally uploading files to the 'contracts' container, which should not be accessible. What is the most likely configuration mistake?

Accepted Answer

The SAS was generated at the storage account level, granting write access that applies to multiple containers rather than being scoped to the 'images' container only. A SAS generated at the storage account level grants permissions across all containers within that account. When the SAS URI includes only the account endpoint (e.g., https://.blob.core.windows.net/) and a set of permissions (like write), the token can be used to access any container, including 'contracts'. To restrict access to a single container, the SAS must be scoped to the container resource URI (e.g., https://.blob.core.windows.net/images) and the signed resource type must be 'c' (container) or 'b' (blob), not 's' (service).

Answer

The SAS expiry time is too long, giving partners time to discover and access other containers

Answer

The partner used a storage account key instead of the provided SAS token

Answer

The SAS was signed with a stored access policy that did not name the correct container

Question 18

You need to deploy an Azure App Service web app that uses a custom domain (www.contoso.com) and SSL/TLS certificate. The certificate is stored in Azure Key Vault. What should you use to bind the certificate to the App Service?

Accepted Answer

Import the certificate from Key Vault into App Service using the 'Key Vault Certificate' option.. Azure App Service supports direct integration with Azure Key Vault to import a certificate using the 'Key Vault Certificate' option. This allows you to bind an SSL/TLS certificate stored in Key Vault to your custom domain without manually exporting or managing the PFX file, ensuring secure and seamless certificate lifecycle management.

Answer

Configure Azure Front Door to terminate SSL and forward traffic to App Service.

Answer

Use an App Service Managed Certificate for the custom domain.

Answer

Export the certificate from Key Vault as a PFX file and upload it to App Service.

Question 19

An Azure Functions report export service processes Service Bus messages. The function sometimes fails after partially completing work. Which two practices improve correctness?

Accepted Answer

Use dead-letter handling for repeatedly failing messages. Azure Functions can use dead-letter handling to isolate messages that repeatedly fail processing, preventing them from blocking the queue and allowing investigation without data loss. This is a standard pattern for Service Bus triggered functions to manage poison messages gracefully.

Answer

Store connection strings in source code

Answer

Disable retries for all messages

Question 20

A company deploys an Azure App Service web app that stores sensitive data in Azure Blob Storage. The security team requires that all access to the blob storage must be authenticated and authorized via Microsoft Entra ID, and that no anonymous access is permitted. The web app must also be able to access the storage using its managed identity. Which configuration should the company implement?

Accepted Answer

Enable the web app's system-assigned managed identity, assign the Storage Blob Data Contributor role to the identity, and disable anonymous access on the storage account.. It satisfies all requirements: enabling a system-assigned managed identity for the web app allows it to authenticate to Azure Blob Storage without storing credentials, assigning the Storage Blob Data Contributor RBAC role authorizes that identity to read/write blobs, and disabling anonymous access ensures no unauthenticated requests are permitted. This configuration enforces Microsoft Entra ID (formerly Azure AD) as the sole authentication mechanism, meeting the security team's mandate.

Answer

Create a custom RBAC role that allows full access to the storage account and assign it to the web app's service principal.

Answer

Use storage account access keys and store them in Key Vault, then configure the web app to retrieve them at runtime.

Answer

Generate a shared access signature (SAS) token with read permissions, store it in App Settings, and configure the web app to use it.