AZ-204 Practice Exam 56 — 20 Questions

Question 1

You are designing a serverless application using Azure Functions. The function must process messages from an Azure Service Bus queue. The processing time for each message can vary from a few seconds to several minutes. You need to minimize costs while ensuring that messages are processed in a timely manner. Which hosting plan should you recommend?

Accepted Answer

Premium plan. The Premium plan is correct because it supports long execution times (up to 60 minutes by default, configurable to unlimited), always-warm instances to avoid cold starts, and virtual network integration—all while providing predictable pricing and scaling. This meets the requirement of processing messages that can take several minutes without incurring the cold-start penalties or execution-time limits of the Consumption plan.

Answer

Container Instances plan

Answer

App Service plan

Answer

Consumption plan

Question 2

You are deploying a critical web application on Azure App Service that must handle sudden traffic spikes. The application stores session data in memory. You need to ensure session state is preserved across scale-out events. Which THREE actions should you take?

Accepted Answer

Enable sticky sessions (ARR affinity) in the App Service configuration.. Option A is correct because enabling sticky sessions (ARR affinity) ensures that all requests from a client session are routed to the same App Service instance. This preserves in-memory session state during scale-out events, as the load balancer uses the ARR cookie to maintain affinity. Without this, requests could be distributed to different instances, losing session data.

Answer

Disable ARR affinity to allow any instance to handle requests.

Answer

Set the session state mode to 'InProc' in the web.config.

Question 3

Your company has an Azure Kubernetes Service (AKS) cluster. You need to deploy a containerized application that requires persistent storage across pod restarts. The storage must be backed by Azure Disk and support ReadWriteOnce access mode. Which volume type should you use?

Accepted Answer

Azure Disk. Azure Disk is the correct volume type because it provides a durable block storage device that can be attached to a pod in an AKS cluster. It supports the ReadWriteOnce (RWO) access mode, meaning the disk can be mounted as read-write by a single node, which aligns with the requirement for persistent storage that survives pod restarts. Azure Disk is ideal for stateful applications that need high-performance, low-latency storage and do not require concurrent access from multiple pods.

Answer

Azure Blob Storage

Answer

EmptyDir

Answer

Azure Files

Question 4

A developer needs to authenticate an Azure Function app to call Microsoft Graph API. Which THREE components are required?

Accepted Answer

Microsoft Entra ID app registration. Option B is correct because an app registration in Microsoft Entra ID (formerly Azure AD) is required to define the application identity, configure API permissions for Microsoft Graph, and obtain a client ID and tenant ID. This registration is the foundation for OAuth 2.0 authentication flows, enabling the Azure Function to request an access token for Microsoft Graph.

Answer

Azure API Management

Answer

Azure SQL Database

Question 5

Which THREE of the following are true about Azure Blob Storage access tiers? (Choose THREE.)

Accepted Answer

You can change the access tier of a blob after it has been uploaded.. Option C is correct because Azure Blob Storage allows you to change the access tier of a blob after it has been uploaded, either by directly setting the tier on the blob or using lifecycle management policies. This flexibility enables you to optimize storage costs based on changing access patterns without re-uploading data.

Answer

Hot tier has lower storage cost than Cool tier.

Answer

Archive tier allows immediate read access to blobs.

Question 6

Your application uses Azure Cosmos DB for NoSQL. You need to implement server-side computed properties that depend on multiple document fields. The computation must be performed atomically. Which approach should you use?

Accepted Answer

Use a stored procedure to compute and update the property in a single transaction. Stored procedures in Azure Cosmos DB for NoSQL execute within a transactional scope, allowing you to atomically compute a property based on multiple document fields and update the document in a single operation. This ensures that the computation and update are performed as an all-or-nothing unit, which is required for atomicity. Pre-triggers, change feeds, and UDFs do not provide atomic read-modify-write semantics across multiple fields.

Answer

Use a pre-trigger to compute the property on write

Answer

Use the change feed to compute the property asynchronously

Answer

Use a user-defined function (UDF) in queries

Question 7

You need to consume an Azure Cognitive Services Text Analytics API from a Python application. The API requires a subscription key. Where should you store the key to ensure security?

Accepted Answer

Store the key in an environment variable on the hosting machine.. Option B is correct because storing the subscription key in an environment variable on the hosting machine keeps it out of source code and configuration files, reducing the risk of accidental exposure. Environment variables are a standard security best practice for secrets in cloud applications, and Azure Cognitive Services APIs require key-based authentication unless Azure AD is explicitly configured.

Answer

Store the key in a text file in the application directory.

Answer

Use Azure AD authentication instead of a key.

Answer

Hardcode the key in the Python source code.

Question 8

Which TWO Azure services can be used to implement serverless event-driven architectures?

Accepted Answer

Azure Logic Apps. Azure Logic Apps is correct because it provides a fully managed integration platform for orchestrating workflows that respond to events from various sources, such as HTTP requests, Azure services, or third-party apps, using a visual designer and connectors. Azure Functions is correct because it offers event-driven compute capabilities where code executes in response to triggers like HTTP requests, queue messages, or timer events, enabling serverless architectures without managing infrastructure.

Answer

Azure Batch

Answer

Azure Container Instances

Answer

Azure Virtual Machines

Question 9

You are developing a solution that uses Azure Functions to process events from Azure Event Grid. The function must handle events reliably. Which TWO options should you implement?

Accepted Answer

Enable retry policy on the Event Grid subscription.. Option B is correct because Event Grid subscriptions support automatic retry policies that can be configured to retry event delivery on transient failures, ensuring reliable processing. Option D is correct because a dead-letter destination (e.g., a storage blob) captures events that cannot be delivered after exhausting retries, preventing data loss and enabling later analysis.

Answer

Use Durable Functions for orchestration.

Answer

Implement manual checkpointing in the function code.

Answer

Use a queue trigger instead of an Event Grid trigger.

Question 10

You are building a real-time dashboard that displays data from Azure Event Hubs. You need to aggregate events over a one-minute window and update the dashboard every minute. Which Azure service should you use?

Accepted Answer

Azure Stream Analytics. Azure Stream Analytics is the correct choice because it is designed for real-time stream processing, allowing you to aggregate events from Azure Event Hubs over a one-minute tumbling window and output results to a dashboard or sink. It natively supports windowing functions (e.g., TumblingWindow, HoppingWindow) and can handle high-throughput, low-latency data streams, making it ideal for updating a dashboard every minute.

Answer

Azure Data Factory

Answer

Azure Analysis Services

Answer

Azure Logic Apps

Question 11

You have an Azure Function app that uses .NET 8 isolated process. The function must connect to an Azure SQL database using a managed identity. The function app has a system-assigned managed identity enabled. Which code snippet correctly retrieves the access token?

Accepted Answer

var credential = new DefaultAzureCredential(); var token = await credential.GetTokenAsync(new TokenRequestContext(new[] {"https://database.windows.net/.default"}));. Option C is correct because it uses `DefaultAzureCredential` to obtain an access token for Azure SQL Database by specifying the resource URI `https://database.windows.net/.default` in a `TokenRequestContext`. In a .NET 8 isolated process function app with a system-assigned managed identity, `DefaultAzureCredential` automatically attempts managed identity authentication as one of its credential sources, making it the recommended approach. The `GetTokenAsync` method requires a `TokenRequestContext` object, not a plain string, to correctly request the token for the Azure SQL resource.

Answer

new SqlConnection(connectionString) using Integrated Security=true;

Answer

var token = await new Azure.Identity.DefaultAzureCredential().GetTokenAsync("https://database.windows.net");

Answer

var credential = new ManagedIdentityCredential(); var token = await credential.GetTokenAsync("https://database.windows.net");

Question 12

Your web app hosted on Azure App Service needs to consume an external SaaS API that requires an API key. The key must be stored securely and rotated without redeploying the app. What is the best approach?

Accepted Answer

Store the API key in an App Service application setting.. Option D is correct because App Service application settings are encrypted at rest and can be updated directly in the Azure portal or via CLI without redeploying the app. The app reads the setting at runtime from environment variables, making it easy to rotate the API key by simply changing the setting value. This approach satisfies the requirements of secure storage and rotation without redeployment.

Answer

Store the API key in Azure SQL Database and query it at startup.

Answer

Store the API key in Azure Key Vault and use a managed identity to retrieve it.

Answer

Store the API key in a configuration file in the application code.

Question 13

You are designing a solution to store large amounts of unstructured data that is accessed infrequently (once a quarter). You need to minimize storage costs. Which Azure storage tier should you use?

Accepted Answer

Cool. The Cool tier is designed for data that is accessed infrequently (about once a quarter) and stored for at least 30 days, offering lower storage costs than Hot while still providing low-latency access. Since the data is unstructured and accessed only quarterly, Cool balances cost and availability without the long retrieval time or minimum storage duration of Archive.

Answer

Cold

Answer

Hot

Answer

Archive

Question 14

You have an Azure Function app that processes orders. The function uses a queue trigger from Azure Storage. Recent load tests show that the function is not scaling out fast enough under high load. What should you do to improve scaling?

Accepted Answer

In host.json, increase the batchSize and increase the newBatchThreshold. Option B is correct because increasing the batchSize and newBatchThreshold in host.json allows the Azure Functions runtime to fetch more messages per polling cycle and trigger more parallel function instances sooner. This directly improves scaling velocity under high load by reducing the latency between message arrival and processing, which is the core issue identified in the load test.

Answer

In the function code, increase the number of retries on failure

Answer

In host.json, increase the batchSize and decrease the newBatchThreshold

Answer

Switch from Consumption plan to Premium plan

Question 15

Your company has a multi-tier application running on Azure Virtual Machines. The application experiences high CPU usage during peak hours. You need to implement autoscaling for the virtual machine scale set based on CPU usage. The scaling should be aggressive when CPU exceeds 80% and conservative when CPU drops below 30%. Which scaling rule configuration should you use?

Accepted Answer

Scale out when CPU > 80%, scale in when CPU < 30%. Option D is correct because the question explicitly requires aggressive scaling when CPU exceeds 80% and conservative scaling when CPU drops below 30%. The scale-out threshold of 80% triggers rapid addition of instances to handle high load, while the scale-in threshold of 30% ensures instances are removed only when utilization is consistently low, preventing premature scale-in and thrashing. This matches the exact thresholds specified in the requirement.

Answer

Scale out when CPU > 50%, scale in when CPU < 20%

Answer

Scale out when CPU > 90%, scale in when CPU < 10%

Answer

Scale out when CPU > 70%, scale in when CPU < 70%

Question 16

You are deploying a containerized application using Azure Kubernetes Service (AKS). You need to ensure that sensitive configuration data, such as API keys, is not stored in container images. Which Kubernetes resource should you use?

Accepted Answer

Secret. Option D is correct because Kubernetes Secrets are specifically designed to store sensitive data like API keys, connection strings, and passwords. They are stored in etcd as base64-encoded values (and can be encrypted at rest) and are injected into pods as environment variables or mounted as volumes, ensuring the sensitive data never resides in the container image.

Answer

Deployment

Answer

ConfigMap

Answer

PersistentVolume

Question 17

You are deploying an Azure App Service using an ARM template. After deployment, you find that the application settings are not applied. What is the most likely issue?

Accepted Answer

The resource is missing a dependsOn property for the parent site. When deploying application settings via an ARM template, the 'Microsoft.Web/sites/config' resource (which contains the appsettings) must have a 'dependsOn' property referencing the parent 'Microsoft.Web/sites' resource. Without this dependency, Azure Resource Manager may attempt to apply the settings before the site exists, causing the settings to be silently ignored or not applied. This is a common deployment ordering issue.

Answer

The resource type should be 'Microsoft.Web/sites/appsettings'

Answer

The apiVersion is outdated, use '2021-02-01'

Answer

The property 'MyApp:Setting1' uses a colon, which is not allowed

Question 18

You have an Azure App Service web app that experiences high CPU usage during peak hours. You need to scale out automatically based on CPU load. Which scaling solution should you use?

Accepted Answer

Autoscale with a CPU percentage rule. Autoscale with a CPU percentage rule is the correct solution because Azure App Service supports built-in autoscaling that can automatically increase or decrease the number of instances based on a metric like CPU percentage. This allows the web app to handle peak-hour traffic by scaling out when CPU usage exceeds a defined threshold, ensuring performance without manual intervention.

Answer

Manual scaling

Answer

Traffic Manager

Answer

Scale sets autoscale

Question 19

You need to restrict access to an Azure web app so that only traffic from a specific virtual network (VNet) can reach it. The web app is already deployed. What should you configure on the web app?

Accepted Answer

Access restrictions. Access restrictions (also known as IP restrictions) allow you to define allow/deny rules based on source IP addresses or Virtual Network (VNet) service endpoints. By configuring a service endpoint-based rule that permits traffic only from your specific VNet, you can block all other inbound traffic to the web app. This is the correct mechanism for restricting access at the web app level without modifying the underlying infrastructure.

Answer

VNet integration

Answer

Network Security Group (NSG) on the subnet

Answer

Point-to-Site VPN

Question 20

You need to enable client-side encryption for data stored in Azure Blob Storage. The encryption keys must be managed by your organization using Azure Key Vault. What should you use?

Accepted Answer

Azure Storage client-side encryption library with Key Vault. Option D is correct because client-side encryption requires the application to encrypt data before uploading it to Azure Blob Storage, and the Azure Storage client-side encryption library integrates with Azure Key Vault to allow your organization to manage the encryption keys. This approach ensures that the storage service never has access to the plaintext data or the keys, meeting the requirement for client-side encryption with customer-managed keys.

Answer

Azure Disk Encryption

Answer

Azure Information Protection

Answer

Azure Storage service-side encryption with customer-managed keys