AZ-204 Practice Exam 55 — 20 Questions

Question 1

Refer to the exhibit. You are reviewing an ARM template for a storage account. A security audit requires that all storage accounts enforce TLS 1.2 or higher. Does this configuration meet the requirement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Yes, because minimumTlsVersion is set to TLS1_2. The `minimumTlsVersion` property in the ARM template explicitly enforces the minimum TLS version for requests to the storage account. Setting it to `TLS1_2` ensures that only TLS 1.2 or higher connections are accepted, meeting the security audit requirement. The `supportsHttpsTrafficOnly` property only enforces HTTPS but does not control the TLS version, so it alone is insufficient.

Answer

No, because supportsHttpsTrafficOnly does not enforce TLS version

Answer

No, because minimumTlsVersion is not a valid property

Answer

No, because the property should be minimumTlsVersion: "1.2"

Question 2

Your company stores sensitive documents in an Azure Storage account. You need to ensure that only authorized Microsoft Entra ID users can read the documents, and that shared keys (account access keys) cannot be used. Which two steps must you take? (Choose the most appropriate single answer that describes the combined action.)

Accepted Answer

Disable shared key access and configure RBAC roles for Microsoft Entra ID users. To ensure that only authorized Microsoft Entra ID users can read documents and that shared keys cannot be used, you must disable shared key access and configure RBAC roles to authorize specific users. Option A does exactly that. Option D disables shared key access but uses user-delegation SAS tokens, which can be used by anyone possessing the token, not only authorized Entra ID users. Therefore, only option A fully meets the requirement.

Answer

Enable Microsoft Entra ID authentication and use SAS tokens with a stored access policy

Answer

Enable firewall and virtual network service endpoints, then assign RBAC roles

Answer

Use user-delegation SAS tokens and disable shared key access

Question 3

Your company uses Azure File Sync to sync on-premises file shares to Azure Files. You notice that some files are not syncing to Azure. You need to diagnose the issue with minimal administrative effort. Which Azure service should you use?

Accepted Answer

Azure Monitor. Azure Monitor provides the Azure File Sync monitoring blade, which offers pre-built metrics and alerts for sync health, file-level errors, and sync session status. This allows you to diagnose sync failures with minimal administrative effort by directly viewing sync group health, per-server sync status, and error codes without needing to configure additional log queries or workbooks.

Answer

Microsoft Sentinel

Answer

Azure Storage Insights

Answer

Azure Log Analytics

Question 4

You are developing a solution that must encrypt data before it is sent to Azure Blob Storage. You need to manage encryption keys yourself using Azure Key Vault. Which approach should you use?

Accepted Answer

Implement client-side encryption using the Azure Storage SDK and store the encryption keys in Azure Key Vault.. Client-side encryption with the Azure Storage SDK allows you to encrypt data before it leaves your application, ensuring it is never transmitted or stored in plaintext. By storing the encryption keys in Azure Key Vault, you maintain full control over key management, which aligns with the requirement to manage encryption keys yourself.

Answer

Use Azure Information Protection to encrypt the files.

Answer

Use Azure Disk Encryption for the storage account.

Answer

Enable Azure Storage Service Encryption (SSE) with customer-managed keys.

Question 5

You have an Azure App Service web app that uses a system-assigned managed identity. The web app needs to authenticate to an Azure SQL Database to read and write data. You want to use the managed identity to avoid storing credentials in connection strings. Which steps are required to configure this access?

Accepted Answer

Create a contained database user in the SQL database mapped to the managed identity, grant required database roles, and use Microsoft Entra ID token-based authentication from the app.. To use a system-assigned managed identity with Azure SQL Database, you must create a contained database user mapped to the managed identity in the SQL database, grant it the necessary database roles (e.g., db_datareader, db_datawriter), and then acquire an access token for Microsoft Entra ID (formerly Azure AD) from the managed identity endpoint to authenticate. This token-based approach avoids storing credentials and leverages the managed identity's automatic credential rotation.

Answer

Assign the managed identity the 'SQL DB Contributor' RBAC role on the database, then use SQL authentication with the identity's client ID.

Answer

Enable Microsoft Entra ID authentication on the SQL server, add the managed identity as an Microsoft Entra ID admin, and use integrated security in the connection string.

Answer

Configure the connection string with the managed identity's principal ID as the user ID and leave the password empty.

Question 6

Refer to the exhibit. You run the Azure CLI command shown for an Azure Function app. What is the effect of this setting?

Accepted Answer

The function app runs from a deployment package in Azure Storage.. The `--run-from-package` flag in the Azure CLI command `az functionapp config appsettings set` sets the `WEBSITE_RUN_FROM_PACKAGE` app setting to `1`. This configures the function app to run from a deployment package (a .zip file) stored in Azure Blob Storage, which improves cold-start performance and ensures all files are consistent across instances. Option D correctly identifies this behavior.

Answer

The function app uses the latest runtime version.

Answer

Remote debugging is enabled for the function app.

Answer

The function app scales out to multiple instances.

Question 7

A document rendering job in Azure App Service must safely access Key Vault secrets without connection strings in configuration. Which two steps are required?

Accepted Answer

Enable a managed identity for the web app. A managed identity provides an automatically managed Azure AD identity for the web app, eliminating the need to store credentials in code or configuration. By enabling a system-assigned or user-assigned managed identity, the App Service can authenticate to Azure Key Vault without any connection strings or secrets in app settings. This is the foundational step for secure, identity-based access to Key Vault.

Answer

Enable anonymous access on the vault

Answer

Store the Key Vault access key in app settings

Question 8

You are deploying a containerized application to Azure Container Instances. The application requires writing temporary files to a local filesystem. You need to ensure that the files persist if the container restarts. What should you do?

Accepted Answer

Mount an Azure Files share as a volume in the container group.. Azure Container Instances (ACI) supports mounting Azure Files shares as volumes. When a container restarts, its writable layer is ephemeral and lost, but an Azure Files share persists independently. By mounting the share, temporary files written to the mount point survive container restarts, meeting the persistence requirement.

Answer

Use the container's writable layer to store files.

Answer

Use Azure Blob Storage and mount it as a volume.

Answer

Configure a Docker volume in the container image.

Question 9

You have a multi-tenant application that uses Azure AD (Microsoft Entra ID) for authentication. You want to allow only specific tenants to access your app. What is the recommended approach?

Accepted Answer

In the application code, validate the 'tid' claim against a list of allowed tenant IDs.. The 'tid' claim in the Azure AD-issued token uniquely identifies the tenant. By validating this claim against a hardcoded list of allowed tenant IDs in your application code, you can enforce multi-tenant access control without relying on Azure AD tenant-level restrictions or issuer URL validation, which can be less precise.

Answer

Configure the app manifest to require user assignment and assign users from allowed tenants.

Answer

Validate the 'iss' claim to ensure it matches one of your allowed tenant issuer URLs.

Answer

Use Azure AD tenant restrictions to block all tenants except the allowed ones.

Question 10

A system receives high-volume event notifications from Azure resources and routes them to serverless handlers. Events are lightweight and should use native event routing. Which service should be used? The architecture review board prefers a managed Azure-native control.

Accepted Answer

Azure Event Grid. Azure Event Grid is the correct choice because it is a fully managed event routing service designed for high-volume, lightweight event notifications using native event routing (HTTP push). It directly supports Azure resource events and serverless handlers like Azure Functions, aligning with the requirement for native event routing without polling or queuing overhead.

Answer

Azure DNS

Answer

Azure Files

Answer

Azure Service Bus queue

Question 11

A company stores secrets in Azure Key Vault. Developers need to retrieve secrets from a web app without storing connection strings in code. Which authentication method should the web app use?

Accepted Answer

Enable a managed identity for the web app. Managed identities for Azure resources provide an automatically managed identity in Azure AD, allowing the web app to authenticate to Key Vault without any credentials in code. The web app obtains an Azure AD access token directly from the Azure Instance Metadata Service (IMDS) endpoint, which Key Vault accepts. This eliminates the need to store connection strings, client secrets, or certificates in the application.

Answer

Register a service principal and use a client secret

Answer

Use a shared access signature (SAS) token

Answer

Use a certificate thumbprint in the app settings

Question 12

You develop an Azure Functions app that processes images triggered by blob uploads. You need to ensure the function can process images in parallel and handle high upload volumes without missing events. Which trigger and plan combination is recommended?

Accepted Answer

Event Grid trigger on Premium plan. The Event Grid trigger on a Premium plan is recommended because Event Grid provides reliable, high-throughput event delivery with built-in retry and dead-lettering, ensuring no blob upload events are missed. The Premium plan offers dedicated instances and VNET connectivity, which avoids cold starts and allows parallel processing of multiple images concurrently, unlike the Consumption plan which has scaling limitations and potential for event loss under high volume.

Answer

Blob Storage trigger on Consumption plan

Answer

Event Grid trigger on Consumption plan

Answer

Blob Storage trigger on Premium plan

Question 13

Your organization uses Azure Policy to enforce compliance. You need to ensure that all Azure SQL databases have Advanced Data Security (ADS) enabled. What type of Azure Policy effect should you use to automatically enable ADS if it is not already enabled?

Accepted Answer

DeployIfNotExists. DeployIfNotExists effect can automatically enable Advanced Data Security (ADS) on Azure SQL databases if it is not already enabled, by deploying the necessary configuration. Option A (Audit) only audits compliance but does not remediate. Option B (Modify) is typically used for tags and not for enabling ADS. Option C (Deny) blocks creation of non-compliant resources but does not automatically enable ADS on existing resources. Therefore, D is correct.

Answer

Audit

Answer

Modify

Answer

Deny

Question 14

You are deploying a web application to Azure App Service. The application needs to read configuration settings that vary by deployment environment (development, staging, production). You want to minimize application changes and leverage Azure services. What should you use?

Accepted Answer

Use Azure App Service application settings.. Azure App Service application settings are the correct choice because they are natively supported by the App Service platform, allowing you to define key-value pairs that are injected as environment variables at runtime. This approach requires no application code changes, as the settings are automatically available via standard configuration APIs (e.g., `Environment.GetEnvironmentVariable` in .NET or `process.env` in Node.js), and you can configure different values per deployment slot (e.g., development, staging, production) without redeploying the application.

Answer

Use Azure Key Vault secrets for configuration values.

Answer

Use Azure DevOps variable groups and inject them at build time.

Answer

Use Azure App Configuration with feature flags.

Question 15

You need to monitor the performance of an Azure App Service web app. You want to track the number of HTTP 500 errors over the last hour. Which Azure Monitor metric should you use?

Accepted Answer

Http5xx. The Http5xx metric in Azure Monitor tracks the count of HTTP 500-level server error responses returned by your App Service. Since the question specifically asks for the number of HTTP 500 errors over the last hour, this metric directly provides that count without any aggregation or filtering needed.

Answer

Data In

Answer

Average Response Time

Answer

Requests

Question 16

You are deploying an Azure Functions app using ARM template. The exhibit shows a portion of the template. You notice that the AzureWebJobsStorage connection string includes the account key directly. What is the MOST important security concern?

Accepted Answer

The storage account key is exposed in the template, which could be compromised.. Embedding the storage account key directly in an ARM template exposes a long-lived secret in plaintext. If the template is stored in source control, shared, or logged, the key can be compromised, granting an attacker full access to the storage account. This violates the principle of least privilege and security best practices for infrastructure as code.

Answer

The FUNCTIONS_WORKER_RUNTIME is set to dotnet-isolated, which is outdated.

Answer

The storage account name is hardcoded in the connection string.

Answer

The connection string does not use HTTPS.

Question 17

A company uses Azure Functions to process messages from Azure Service Bus. The function currently uses the Consumption plan. They notice that during high load, messages are processed slowly due to scaling latency. Which change would improve throughput most?

Accepted Answer

Switch to the Premium plan. The Premium plan for Azure Functions provides pre-warmed instances and faster scaling, eliminating the cold start and scaling latency inherent in the Consumption plan. This directly addresses the bottleneck during high load by ensuring that new instances are allocated instantly, thereby improving message processing throughput from Service Bus.

Answer

Set the maximum instance count to 20

Answer

Increase the function's batch size to 100

Answer

Enable Service Bus sessions

Question 18

Twenty Azure Functions across different teams all need read access to the same Azure Cosmos DB account. The security team wants to revoke or modify this access for all twenty functions at once without visiting each Function App individually. What managed identity design satisfies this requirement?

Accepted Answer

Create one user-assigned managed identity, attach it to all twenty Function Apps, and grant it the Cosmos DB Built-in Data Reader role. A single user-assigned managed identity can be created once and then attached to all twenty Function Apps. Granting that identity the Cosmos DB Built-in Data Reader role at the Cosmos DB account scope means that revoking or modifying the role assignment centrally affects all functions simultaneously, without needing to visit each app individually.

Answer

Enable a system-assigned managed identity on each Function App and grant each identity the Cosmos DB Built-in Data Reader role

Answer

Create a service principal, store its client secret in Key Vault, and reference the secret from all twenty Function Apps via Key Vault references

Answer

Store the Cosmos DB connection string in Azure App Configuration and reference it from all twenty Function Apps

Question 19

You are building a solution that uploads large files (up to 100 GB) to Azure Blob Storage. Users frequently experience timeout errors when uploading files over slow network connections. Which approach should you use to maximize reliability?

Accepted Answer

Use the Azure Storage SDK to upload the file as a block blob with multiple parallel blocks and implement retry logic with exponential backoff.. Uploading a large file as a block blob with multiple parallel blocks maximizes throughput and reliability over slow networks. The Azure Storage SDK automatically splits the file into blocks (up to 100 MB each), uploads them concurrently, and implements retry logic with exponential backoff to handle transient failures. This approach is specifically designed for large file uploads and mitigates timeout errors by keeping individual block transfers small and resumable.

Answer

Upload the file as a page blob in 512-byte chunks.

Answer

Increase the client-side timeout value to 10 minutes.

Answer

Use AzCopy with the /Z parameter to enable checkpointing.

Question 20

You need to run a batch job every night that processes data from Azure Blob Storage and writes results to Azure SQL Database. The job may run for up to 2 hours. Which Azure service should you use?

Accepted Answer

Azure Container Instances.. Azure Container Instances (ACI) is the correct choice because it allows you to run a containerized batch job on-demand without managing underlying infrastructure. The job's duration of up to 2 hours fits well within ACI's default timeout of 60 minutes (configurable up to 24 hours), and you can trigger it nightly via a scheduler like Azure Logic Apps or a timer-triggered Azure Function. ACI provides fast startup, per-second billing, and direct access to Azure Blob Storage and SQL Database via connection strings or managed identities.

Answer

Azure Logic Apps.

Answer

Azure Batch.

Answer

Azure Functions (Consumption plan).