AZ-204 Practice Exam 54 — 20 Questions

Question 1

You are developing a web app that authenticates users via Microsoft Entra ID. The app needs to read the user's profile and send emails on their behalf. You want to minimize user consent prompts. Which OAuth 2.0 grant type should you use?

Accepted Answer

Authorization code flow with PKCE. The authorization code flow with PKCE (Proof Key for Code Exchange) is the recommended OAuth 2.0 grant type for public clients (like a web app) that need delegated user authentication and consent. It allows the app to obtain an access token to read the user's profile and a refresh token to send emails on their behalf, while minimizing consent prompts by using a single consent request for both permissions. PKCE adds a cryptographic challenge to prevent authorization code interception attacks, making it secure for web apps without a client secret.

Answer

Client credentials flow

Answer

Resource owner password credentials

Answer

Implicit flow

Question 2

You are developing an API that uses managed identity to access Azure Key Vault. The API runs in an Azure App Service with system-assigned managed identity enabled. You need to retrieve a secret value. Which API endpoint should your code call?

Accepted Answer

https://myvault.vault.azure.net/secrets/{secret-name}?api-version=7.0. Option B is correct because it uses the full Key Vault REST API endpoint with the specific vault name ('myvault'), the 'secrets' resource path, the secret name, and the required 'api-version' query parameter (7.0). The managed identity in the App Service authenticates via Azure AD, and the code must call this specific endpoint to retrieve the secret value, as the vault name is part of the DNS name and the API version is mandatory.

Answer

https://vault.azure.net/secrets/{secret-name}

Answer

https://login.microsoftonline.com/{tenant}/oauth2/token

Answer

https://management.azure.com/subscriptions/{sub}/...

Question 3

You are developing an ASP.NET Core web API hosted on Azure App Service. The API needs to read secrets from Azure Key Vault at startup. You have enabled a system-assigned managed identity for the App Service. Which code should you use to create the Key Vault SecretClient?

Accepted Answer

new SecretClient(new Uri(keyVaultUrl), new DefaultAzureCredential()). Option A is correct because `DefaultAzureCredential` automatically attempts to authenticate using the environment's managed identity when running on Azure App Service. Since a system-assigned managed identity is enabled, `DefaultAzureCredential` will chain through available credential sources and successfully use the managed identity endpoint to obtain a token for Key Vault, without requiring any explicit tenant ID, client ID, or secret.

Answer

new SecretClient(new Uri(keyVaultUrl), new ClientSecretCredential(tenantId, clientId, clientSecret))

Answer

new SecretClient(new Uri(keyVaultUrl), new ChainedTokenCredential())

Answer

new SecretClient(new Uri(keyVaultUrl), new InteractiveBrowserCredential())

Question 4

You are developing an ASP.NET Core web app that uses Azure SQL Database. The SQL connection string contains a password that must be rotated every 30 days. The app runs on Azure App Service. You want to store the connection string securely and enable automatic rotation without redeploying the app. Which approach should you use?

Accepted Answer

Store the connection string in an App Setting and use Key Vault references. Configure a Key Vault policy to automatically rotate the secret.. Option A is correct because Azure App Service supports Key Vault references in App Settings, allowing you to securely store the connection string in Key Vault and reference it without exposing the password. By configuring a Key Vault policy to automatically rotate the secret (e.g., using a scheduled rotation or event-driven trigger), the password can be rotated every 30 days without redeploying the app, as the App Service runtime resolves the reference at runtime.

Answer

Store the connection string in an App Setting as a plain text value and use deployment slots to swap when the password changes.

Answer

Use a managed identity to access the SQL database directly, bypassing the connection string entirely.

Answer

Store the connection string in Azure Key Vault and use an ARM template with a secret reference at deployment time.

Question 5

Which TWO Azure services can be used to monitor and diagnose performance issues in an Azure Kubernetes Service (AKS) cluster?

Accepted Answer

Application Insights for AKS. Options A and C are correct. Container Insights monitors container workload performance, and Azure Monitor for AKS (part of Container Insights) provides diagnostics. Option B is wrong because it's for databases. Option D is wrong because it's a security solution. Option E is wrong because it's for network management.

Answer

Microsoft Defender for Cloud

Answer

Azure Network Watcher

Answer

Azure SQL Analytics

Question 6

You are using Azure API Management (APIM) to expose a REST API. The backend API requires mutual TLS (client certificate) for authentication. The client certificate is stored in Azure Key Vault. You need to configure APIM to use this certificate when calling the backend, without exposing the certificate contents in the policy files. Which APIM feature and policy should you use?

Accepted Answer

Use the authentication-certificate policy with a named value that references the Key Vault certificate.. Option A is correct because the `authentication-certificate` policy in Azure API Management can reference a client certificate stored in Azure Key Vault via a named value. Named values securely store secrets and can point to Key Vault certificates without exposing the certificate contents in policy files. This allows APIM to present the certificate during mutual TLS authentication to the backend API.

Answer

Use the authentication-managed-identity policy to authenticate to the backend.

Answer

Upload the client certificate directly to APIM's Certificate store and reference it in the policy.

Answer

Use a JavaScript policy to fetch the certificate from Key Vault and attach it.

Question 7

An API receives JWT access tokens from Microsoft Entra ID. Which two token properties should the API validate before accepting a request?

Accepted Answer

Issuer and signature are valid for the trusted tenant. Option A is correct because the API must validate that the JWT's issuer (iss) claim matches the trusted tenant's issuer URL (e.g., https://login.microsoftonline.com/{tenant-id}/v2.0) and that the token's cryptographic signature is valid, ensuring the token was issued by Microsoft Entra ID and hasn't been tampered with. This prevents token forgery and tokens from untrusted tenants.

Answer

The user's display name is present

Answer

The token was sent in a query string

Question 8

Your company stores API keys and connection strings in Azure Key Vault. You need to grant an Azure Function read access to these secrets using the principle of least privilege. Which identity type should you assign to the Function App?

Accepted Answer

System-assigned managed identity. A system-assigned managed identity is the correct choice because it is directly tied to the lifecycle of the Azure Function, automatically managed by Azure, and requires no manual credential rotation. It provides the most restrictive scope (only that specific Function App) and adheres to the principle of least privilege by granting access only to the identity that needs it, without the overhead of managing a separate identity or service principal.

Answer

User-assigned managed identity

Answer

Service principal

Answer

Access policy on the Key Vault

Question 9

You are developing an application that stores user secrets. You need to ensure that the secrets are encrypted at rest and rotated automatically. Which Azure service should you integrate?

Accepted Answer

Azure Key Vault.. Azure Key Vault is the correct choice because it provides centralized management of secrets, keys, and certificates with built-in encryption at rest using FIPS 140-2 Level 2 validated hardware security modules (HSMs). It also supports automatic rotation of secrets through integration with Azure Event Grid and Azure Functions, enabling you to schedule or trigger key rotation policies without manual intervention.

Answer

Azure Storage.

Answer

Azure Security Center.

Answer

Microsoft Entra ID.

Question 10

You have an App Service app that uses Azure SQL Database. Users report that some queries are slow. You need to monitor query performance and receive alerts when the average query duration exceeds 1 second. Which two Azure services should you use?

Accepted Answer

Application Insights. Option B (Application Insights) and Option D (Azure SQL Analytics) are correct because Application Insights can monitor the app's SQL dependency calls and set alerts, while Azure SQL Analytics provides deep query performance insights. Option A (Azure Monitor Logs) is too broad. Option C (Azure Monitor Alerts) can be used but requires a data source. Option E (Azure Advisor) gives recommendations but not real-time monitoring.

Answer

Azure Advisor

Answer

Azure Monitor Alerts

Answer

Azure Monitor Logs

Question 11

A developer is implementing Key Vault certificate retrieval. The application runs on Azure App Service and must avoid stored credentials. Which design should be used?

Accepted Answer

Enable managed identity and grant least-privilege access to the target resource. Option C is correct because Azure App Service supports Managed Identity, which allows the application to authenticate to Key Vault without storing any credentials in code or configuration. By enabling a system-assigned or user-assigned managed identity and granting it least-privilege access (e.g., via an access policy with `Get` permission for secrets), the app can securely retrieve certificates using the Azure Identity SDK's `DefaultAzureCredential` class, which automatically obtains an access token from Azure AD.

Answer

Use a shared administrator account

Answer

Store a client secret in source control

Answer

Disable authentication for the target resource

Question 12

A company has an Azure Storage account that stores sensitive data. They need to ensure that all access to the storage account is secured using Microsoft Entra ID authentication and that no storage account keys are used. Which configuration should be applied to enforce this?

Accepted Answer

Disable shared key access. Disabling shared key access (Option B) is the correct configuration because it explicitly blocks all authentication using storage account keys (both primary and secondary), forcing all requests to use Microsoft Entra ID (formerly Azure AD) for authorization. This ensures that only identities with appropriate RBAC roles (e.g., Storage Blob Data Owner) can access the storage account, meeting the requirement to eliminate key-based access entirely.

Answer

Enable firewall rules

Answer

Enable advanced threat protection

Answer

Enable soft delete

Question 13

You have an Azure Cosmos DB container with a high number of physical partitions. You observe that some partitions are hitting the request unit (RU) limit while others are underutilized. What should you do to better distribute the workload?

Accepted Answer

Choose a different partition key that evenly distributes workload. Option A is correct because a good partition key ensures even distribution of RU consumption. Option B (increasing throughput) doesn't fix skew. Option C (changing consistency) affects performance but not distribution. Option D (adding indexes) increases RU consumption.

Answer

Add more composite indexes

Answer

Increase the total provisioned throughput

Answer

Change the default consistency level to eventual

Question 14

Which TWO actions can help you reduce latency for a globally distributed web application? (Choose two.)

Accepted Answer

Use Azure Traffic Manager with performance routing. Option A (Azure Front Door) and Option D (Azure Traffic Manager) are correct because they route traffic to the nearest endpoint. Option B (App Service scaling) helps with load but not geographic latency. Option C (Cosmos DB multi-region writes) reduces database latency but not overall application latency. Option E (Application Gateway) is regional.

Answer

Use Azure Application Gateway with Web Application Firewall

Answer

Scale up the App Service plan to a higher tier

Answer

Enable multi-region writes on Azure Cosmos DB

Question 15

Your Azure Logic Apps workflow fails intermittently with timeout errors. What should you do to improve reliability?

Accepted Answer

Configure retry policies for failed actions. Option D is correct because configuring retry policies handles transient failures. Option A is wrong because increasing timeout doesn't fix the root cause. Option B is wrong because it's for other services. Option C is wrong because it reduces parallelism, not reliability.

Answer

Increase the action timeout to maximum

Answer

Reduce the number of parallel branches

Answer

Use Azure API Management in front of Logic Apps

Question 16

You need to monitor the CPU and memory usage of an Azure Virtual Machine (VM) over the last 30 days. Which Azure service should you use?

Accepted Answer

Azure Monitor Metrics. Option A is correct because Azure Monitor Metrics collects and stores performance counters like CPU and memory for Azure VMs. Option B is wrong because Azure Log Analytics works with logs, not metrics. Option C is wrong because Azure Service Health monitors Azure service outages, not VM performance. Option D is wrong because Azure Advisor provides recommendations, not historical metrics.

Answer

Azure Service Health

Answer

Azure Advisor

Answer

Azure Log Analytics

Question 17

You query Application Insights with the KQL query in the exhibit. The chart shows a spike in 500 errors at 2:00 PM. What is the next step to diagnose the cause?

Accepted Answer

Query exceptions and traces for the 2:00 PM hour. Option C is correct because drilling into traces and exceptions around that time can pinpoint the specific error. Option A (profiler) is for slow requests. Option B (availability tests) check endpoints. Option D (scaling) is not diagnostic.

Answer

Check availability tests for the same period

Answer

Scale up the App Service plan

Answer

Run a profiler on the 2:00 PM time range

Question 18

Which TWO approaches can help you optimize the cost of Azure Storage accounts that store infrequently accessed data? (Choose two.)

Accepted Answer

Use Cool or Archive storage tier. Option B (Cool storage tier) and Option D (lifecycle management) are correct. Option A (premium tier) is for high-performance, more expensive. Option C (RA-GRS) adds cost. Option E (encryption) doesn't affect cost.

Answer

Use Premium storage tier

Answer

Enable geo-redundant storage (RA-GRS)

Answer

Enable Azure Storage encryption

Question 19

Your team is using Azure DevOps to deploy an Azure Kubernetes Service (AKS) cluster. You want to automatically roll back a deployment if the new version causes a high error rate. Which Azure service should you use to implement this?

Accepted Answer

Azure Monitor. Option D is correct because Azure Monitor autoscale is not for rollback; you need to use a deployment strategy with health probes and maybe a tool like Azure Deployment Manager or progressive exposure in Azure DevOps. However, the most direct answer for automated rollback based on metrics is to configure a canary deployment with Azure App Configuration or use Azure DevOps release gates. The question asks for a service, and Azure Monitor can detect errors, but for automated rollback, you typically use Azure DevOps with monitoring. Among the options, Azure Monitor combined with Azure DevOps release gates is the best. But given the limited options, 'Azure Monitor' is the core service for error detection. The correct answer is 'Azure Monitor' because it provides the metrics that trigger the rollback. Option A is wrong because Azure Policy is for compliance. Option B is wrong because Azure Service Health is for Azure platform issues. Option C is wrong because Azure Traffic Manager is for DNS traffic routing.

Answer

Azure Service Health

Answer

Azure Traffic Manager

Answer

Azure Policy

Question 20

You are developing a web app that experiences intermittent slow responses. You enable Application Insights and notice that the server-side request duration is normally under 200ms, but some requests take over 5 seconds. Which diagnostic tool should you use to identify the root cause?

Accepted Answer

Application Insights Profiler. Option B is correct because Profiler traces the specific line of code that causes slow requests. Option A (Snapshot Debugger) is for exceptions, not performance. Option C (Live Metrics) shows real-time data but doesn't pinpoint code. Option D (Availability Tests) checks endpoint availability, not performance.

Answer

Availability Tests

Answer

Snapshot Debugger

Answer

Live Metrics Stream